From 4dfd587b2e37355552f1b9dae9d310ccbea21208 Mon Sep 17 00:00:00 2001 From: Satoshi Qazi Muhammed Date: Fri, 9 Oct 2026 06:03:40 +0400 Subject: [PATCH] ci: allow the secret scanner's own licence in dependency review Pinning trufflehog to a commit made dependency review list it as a changed dependency, and its AGPL-3.0 licence is on the deny list. It is the scanner this workflow runs, executed in CI and never shipped or served, so it is allowed by name; the deny list still applies to everything else. --- .github/workflows/security.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 755c3e7..2fe1728 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -48,6 +48,9 @@ jobs: with: fail-on-severity: high deny-licenses: GPL-3.0, AGPL-3.0 + # TruffleHog (AGPL-3.0) is the secret scanner this workflow runs; it + # executes in CI and is never shipped, served or distributed. + allow-dependencies-licenses: pkg:githubactions/trufflesecurity/trufflehog secret-scan: name: Secret Scan