From 97a439eb73da926798a58c92c6b171efddfa78a6 Mon Sep 17 00:00:00 2001
From: kunjrathod2005 <rathodkunj2005@gmail.com>
Date: Mon, 3 Aug 2026 20:49:35 -0700
Subject: [PATCH] ci: bound trufflehog scans on branch pushes

---
 .github/workflows/trufflehog.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/trufflehog.yml b/.github/workflows/trufflehog.yml
index 8eb35832bdf8..6a573baafe32 100644
--- a/.github/workflows/trufflehog.yml
+++ b/.github/workflows/trufflehog.yml
@@ -17,5 +17,7 @@ jobs:
     - name: Secret Scanning
       uses: trufflesecurity/trufflehog@6bd2d14f7a4bc1e569fa3550efa7ec632a4fa67b  # main
       with:
+        base: ${{ github.event.repository.default_branch }}
+        head: HEAD
         extra_args: --results=verified,unknown