ci: replace flaky hardcoded-secrets job with trufflehog-git in Trunk

[jamesnrokt]

What

Two changes to how secrets get scanned on a PR:

1. Remove the pr-check-hadcoded-secrets job from .github/workflows/pull-request.yml.
2. Enable trufflehog-git@3.90.6 in .trunk/trunk.yaml.

 # .github/workflows/pull-request.yml
-  pr-check-hadcoded-secrets:
-    name: "Check PR for hardcoded secrets"
-    uses: mParticle/mparticle-workflows/.github/workflows/security-hardcoded-secrets.yml@main

 # .trunk/trunk.yaml
     - trufflehog@3.90.6
+    - trufflehog-git@3.90.6

Net effect: secret scanning stays at the PR level and gains git-history coverage, while the flaky job goes away.

Why remove the job

It was intermittently red — 3 failures in 70 recent runs, always in ~5s. It failed on #742 while passing on #743 and #744 with identical config.

The cause is in the reusable workflow, which resolves and downloads latest TruffleHog at runtime:

curl --location "https://api.github.com/repos/trufflesecurity/trufflehog/releases" -o ./releases.json
remotes=$(cat ./releases.json | grep "browser_download_url.*linux_amd64" | ...)

That breaks when the GitHub API rate-limits, which matches the ~5s failure signature. The same script also contains an invalid shell assignment ($remote_version=$(...)). Trunk pins its TruffleHog version and does no runtime download, so it does not share this failure mode.

Why add trufflehog-git

.trunk/trunk.yaml already enabled trufflehog@3.90.6, but it runs:

trufflehog filesystem --json --fail --only-verified --no-update ${target}

That scans changed files in the working tree. If a secret is committed and then removed in a later commit on the same branch, the file no longer exists — so it is never scanned. The removed job did cover that case, because it scanned branch git history with fetch-depth: 0.

trufflehog-git restores it:

trufflehog git --json --fail --only-verified --no-update file://. --since-commit ${upstream-ref}

Scoped to the commits the PR adds, so it is fast and does not resurface historical findings.

Verification

Committed a private key on a branch, then removed it in a follow-up commit, and scanned both ways:

Scan	Result
filesystem — what trufflehog already did	❌ missed it; reported only a pre-existing false positive
git --since-commit — what trufflehog-git adds	✅ PrivateKey ← probe-key.pem @ f48c6617

Also confirmed:

• trunk check --filter=trufflehog-git runs clean on this branch in ~1.7s.
• Config parses; actionlint and full trunk check pass on both modified files.
• Workflow YAML parses; 13 jobs remain; nothing referenced the removed job via needs:.

Scope note for reviewers

Both linters keep Trunk's default --only-verified, so TruffleHog reports a secret only when it can validate the credential as live. This PR widens scan scope (working tree → the PR's commits); it does not lower the reporting threshold.

The removed job ran without --only-verified and so also reported unverified detections. Measured on a test RSA private key: --only-verified → 0 findings, default → 1 finding. Restoring that strength is a separate, deliberate change — a full-repo scan without the flag takes 3.4s and surfaces exactly 1 false positive (.github/workflows/daily.yml:54, a SHA-pinned action misread as a 40-hex PAT), so it is cheap if we decide we want it.

🤖 Generated with Claude Code

[cursor]

PR Summary

Low Risk
CI and lint configuration only; no application runtime, auth, or data-path changes.

Overview
Removes the standalone pr-check-hadcoded-secrets reusable workflow job from the PR workflow and moves git-history secret coverage into Trunk, which already runs on every PR via trunk-check.

Trunk now enables trufflehog-git@3.90.6 alongside the existing filesystem trufflehog scan, so commits introduced by the PR are scanned even when a secret was added and then deleted on the branch. Comments in .trunk/trunk.yaml document that behavior.

Net effect: fewer flaky CI failures from runtime TruffleHog downloads, pinned tooling, and retained (improved) PR-scoped secret detection without a separate job.

^{Reviewed by Cursor Bugbot for commit 437b884. Bugbot is set up for automated code reviews on this repo. Configure here.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 437b884. Configure here.}