Scanning Your GitLab Repository with TruffleHog

About TruffleHog

TruffleHog is an open-source security tool that can scan your GitLab repository for stored secrets that could be exploited by malicious actors. These secrets could include API keys, passwords, and cryptographic keys, access tokens, and more.

When enabled, TruffleHog will scan your repository when your CI/CD pipeline is run. TruffleHog saves its output as a downloadable report and, if secrets are detected, it fails the pipeline.

Configure TruffleHog

InterSystems provides a preinstalled copy of the TruffleHog binary with your GitLab repository. Enabling it requires you to make the following additions to your .gitlab-ci.yaml file at the top level of your project in GitLab.

First add a new stage called security in the existing stages section of the file:

stages:
  - security

Then add a job called security-secrets that will run during the security stage of the pipeline:

security-secrets:
  stage: security
  tags:
    - <tag_name>
  script:
    - export WORKING_DIR=$(pwd)
    - trufflehog git "file://$WORKING_DIR" --json --fail --no-update > trufflehog-report.json || SCAN_EXIT_CODE=$?
    - test -f trufflehog-report.json || touch trufflehog-report.json
    - exit ${SCAN_EXIT_CODE:-0}
  artifacts:
    when: always
    paths:
      - trufflehog-report.json 

Under tags, <tag_name> must match a GitLab runner tagged with the same name in order for the job to be picked up.

The script section runs TruffleHog over the entire repository in git mode (as opposed to filesystem mode), meaning it can inspect the history and not just the current version of each file. If any secrets are detected the pipeline fails.

The output of the scan is saved as a downloadable artifact with the name trufflehog-report.json. This can be found in GitLab under Build > Artifacts.