Add Trufflehog check for each PR

[janaknat]

This ensures no secrets are committed as part of a PR.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[wash-amzn]

It kind of looks like the scan didn't work (even though it "passed")

2023-09-18T22:38:19Z	info-1	trufflehog	cloned repo	{"path": "./"}
2023-09-18T22:38:[19](https://github.com/aws/aperf/actions/runs/6228769763/job/16906086601?pr=81#step:4:20)Z	info-0	trufflehog	error scanning repository	{"job_id": 1, "source_manager_worker_id": "4WORD", "source_type": "SOURCE_TYPE_GIT", "source_name": "trufflehog - git", "repo": "./", "error": "unable to resolve base ref: no base refs succeeded for base: \"main\""}
[20](https://github.com/aws/aperf/actions/runs/6228769763/job/16906086601?pr=81#step:4:21)23-09-18T22:38:19Z	info-1	trufflehog	Git source finished scanning	{"job_id": 1, "source_manager_worker_id": "4WORD", "source_type": "SOURCE_TYPE_GIT", "source_name": "trufflehog - git", "repo_count": 1}

[wash-amzn]

Will this scan the content of PRs, or will it wind up scanning main?

I suggest adding a commit with credentials and verifying this actually works.

[wash-amzn]

Also check if it works from a fork (normal PR)

[janaknat]

I added the test-key from the trufflehog repo (a private RSA key) and it was detected by the Github action.

[wash-amzn]

It doesn't appear that the scan actually complained about the private key, but instead the URL above it

[janaknat]

Remove the URL and it flagged a base64 encoding.

[janaknat]

It kind of looks like the scan didn't work (even though it "passed")

2023-09-18T22:38:19Z	info-1	trufflehog	cloned repo	{"path": "./"}
2023-09-18T22:38:[19](https://github.com/aws/aperf/actions/runs/6228769763/job/16906086601?pr=81#step:4:20)Z	info-0	trufflehog	error scanning repository	{"job_id": 1, "source_manager_worker_id": "4WORD", "source_type": "SOURCE_TYPE_GIT", "source_name": "trufflehog - git", "repo": "./", "error": "unable to resolve base ref: no base refs succeeded for base: \"main\""}
[20](https://github.com/aws/aperf/actions/runs/6228769763/job/16906086601?pr=81#step:4:21)23-09-18T22:38:19Z	info-1	trufflehog	Git source finished scanning	{"job_id": 1, "source_manager_worker_id": "4WORD", "source_type": "SOURCE_TYPE_GIT", "source_name": "trufflehog - git", "repo_count": 1}

Yeah. Trying to figure that out. I went by the example in the README for the project.

[janaknat]

It kind of looks like the scan didn't work (even though it "passed")

2023-09-18T22:38:19Z	info-1	trufflehog	cloned repo	{"path": "./"}
2023-09-18T22:38:[19](https://github.com/aws/aperf/actions/runs/6228769763/job/16906086601?pr=81#step:4:20)Z	info-0	trufflehog	error scanning repository	{"job_id": 1, "source_manager_worker_id": "4WORD", "source_type": "SOURCE_TYPE_GIT", "source_name": "trufflehog - git", "repo": "./", "error": "unable to resolve base ref: no base refs succeeded for base: \"main\""}
[20](https://github.com/aws/aperf/actions/runs/6228769763/job/16906086601?pr=81#step:4:21)23-09-18T22:38:19Z	info-1	trufflehog	Git source finished scanning	{"job_id": 1, "source_manager_worker_id": "4WORD", "source_type": "SOURCE_TYPE_GIT", "source_name": "trufflehog - git", "repo_count": 1}

Yeah. Trying to figure that out. I went by the example in the README for the project.

Hopefully it's not because this is a private repo.

[wash-amzn]

Naughty naughty!