Tamp TruffleHog

Tamp.TruffleHog

Wrapper for TruffleHog 3 — the secret scanner from Truffle Security. GitHub PAT typed as Secret so it joins the runner's redaction table.

using Tamp.TruffleHog.V3;

Full reference: https://github.com/tamp-build/tamp-trufflehog.

Sources

TruffleHog.Git(tool, s => …)         // scan local or remote git repo
TruffleHog.GitHub(tool, s => …)      // scan repos / orgs (PAT typed as Secret)
TruffleHog.Filesystem(tool, s => …)  // scan paths on disk
TruffleHog.Docker(tool, s => …)      // scan docker images
TruffleHog.Raw(tool, …)              // escape hatch — s3, gcs, slack, jira, …

Common flags (all sources): --json, --only-verified, --no-verification, --filter-entropy, --filter-unverified, --include-detectors / --exclude-detectors (comma-list), --concurrency, --fail, --log-level, --no-update, --print-avg-detector-time, --results, --output, --archive-max-size, --archive-max-depth, --archive-timeout, --allow-verification-overlap.

CI gate pattern

By default TruffleHog reports findings but exits 0. To turn it into a hard CI gate add --fail:

.SetFail()       // exit non-zero when ANY finding is reported

Pair with .SetOnlyVerified() to skip noise from unverified candidates.

Detector filter gotcha

The AWS docs example key (AKIAIOSFODNN7EXAMPLE) is filtered as known-fake by the AWS detector — handy for AWS, less handy when you're writing a fixture to prove the gate fires. The most reliable synthetic-secret shape for fixture work is a Slack webhook URL (https://hooks.slack.com/services/T…/B…/…); it triggers the SlackWebhook detector without entropy or canary-value filtering.

Quick example — pre-merge CI gate

[NuGetPackage("trufflehog", UseSystemPath = true)]
readonly Tool TruffleHogTool = null!;

[Secret("GitHub PAT", EnvironmentVariable = "GH_TOKEN")]
readonly Secret? GitHubToken = null!;

Target SecretScan => _ => _.Executes(() =>
    TruffleHog.GitHub(TruffleHogTool, s => s
        .AddRepo($"https://github.com/{Repo}")
        .SetToken(GitHubToken)
        .SetCommitSince(LastReleaseDate)
        .SetOnlyVerified()
        .SetJson()
        .SetFail()
        .SetNoUpdate()));

See also

• Module Catalog
• Tamp.CodeQL — complement to TruffleHog; static analysis vs secret scanning
• Parameter & Secret Injection — typed Secret + redaction table
• Satellite repo: https://github.com/tamp-build/tamp-trufflehog

Settings authoring style

The example(s) above use the fluent Set*-chain shape. Every wrapper verb on this page also accepts a new XxxSettings { ... } object-init form. Both produce identical CommandPlans; the fluent shape stays canonical in docs and the tamp init template. See Build Script Authoring → Two authoring styles for the side-by-side comparison.