From 4fe953e1400b4a54649f4621b1ae3e26bffca940 Mon Sep 17 00:00:00 2001 From: Satoshi Qazi Muhammed Date: Sat, 17 Oct 2026 21:16:47 +0400 Subject: [PATCH] ci(security): exempt the TruffleHog action from the AGPL licence denial Pinning the action made dependency review evaluate it for the first time. It runs unmodified in CI and is not linked into or shipped with anything. --- .github/workflows/security.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index cb0601c..a27b28a 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -89,3 +89,7 @@ jobs: with: fail-on-severity: high deny-licenses: GPL-3.0, AGPL-3.0 + # TruffleHog (AGPL-3.0) is run unmodified as a CI scanner; it is not + # linked into or shipped with anything, so the licence's obligations + # do not reach this repository. Only this package is exempt. + allow-dependencies-licenses: pkg:githubactions/trufflesecurity/trufflehog