From bd0b7989fe655d1f9c83eba379f5f69eb171818b Mon Sep 17 00:00:00 2001 From: SatoshiQaziMuhammed Date: Sat, 17 Oct 2026 21:16:49 +0400 Subject: [PATCH] ci(security): exempt the TruffleHog action from the AGPL licence denial Pinning the action made dependency review evaluate it for the first time. It runs unmodified in CI and is not linked into or shipped with anything. --- .github/workflows/security.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 5b31dbca..195c1e79 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -77,6 +77,10 @@ jobs: with: fail-on-severity: critical deny-licenses: GPL-3.0, AGPL-3.0 + # TruffleHog (AGPL-3.0) is run unmodified as a CI scanner; it is not + # linked into or shipped with anything, so the licence's obligations + # do not reach this repository. Only this package is exempt. + allow-dependencies-licenses: pkg:githubactions/trufflesecurity/trufflehog secret-scan: name: Secret Scan