feat(trufflehog): centralize path exclusions and support .trufflehogignore

[isaiah-grafana]

Adds configurable path exclusions to the TruffleHog scan so we stop flagging hashes in lock files, vendor code, and other known false-positive paths.

How it works

• Org-wide exclusions (trufflehog/exclude-paths.txt) — default patterns that apply to every repo (vendor/, lock files, dependency manifests, grafana dashboards). Managed centrally here, fetched at runtime.
• Per-repo exclusions (.trufflehogignore) — any repo can add a .trufflehogignore to its root with Go regex patterns for repo-specific paths. Gets merged with the org-wide list automatically.

How to use

• Org-wide: add a regex to trufflehog/exclude-paths.txt, merge to main.
• Repo-specific: add a .trufflehogignore file to the repo root.

Other fixes

• Moved ${{ }} expressions out of run: blocks into env: blocks (code injection fix)

• Simplified scan loop with a grep pre-filter instead of per-file case statements

• Fixed jq CHANGELOG filter with try/catch

Testing

Tested on cloud-traces-operators #194 — confirmed exclusions load correctly and files are skipped as expected.

[ezebunandu]

It looks like the workflow will accept a trufflehog exclusion from the PR head, allowing a contributor to exclude files that should otherwise be scanned.

Would accepting the trufflehog exclusion from only the main branch not be a better approach?

[isaiah-grafana]

It looks like the workflow will accept a trufflehog exclusion from the PR head, allowing a contributor to exclude files that should otherwise be scanned.

Would accepting the trufflehog exclusion from only the main branch not be a better approach?

Good point. I thought about this too. The .trufflehogignore is read from the checked-out tree, so technically a contributor could add it in the same PR to skip scanning on certain paths. But in practice, the change to .trufflehogignore would show up in the PR diff, so reviewers would see it. It's also the same trust model as the inline trufflehog:ignore comment, which already works from the PR head.

We could read it from the default branch instead, but that adds friction for the legitimate use cases. Teams would have to merge the ignore file first before it takes effect. Since this is mostly catching accidental commits from internal contributors, I think reading from the working tree is a reasonable here

[ezebunandu]

LGTM.