feat(action): add image input to allow registry mirror overrides (#4965)

* feat(action): add image input to allow registry mirror overrides

* quote variables to prevent shell injection risk

---------

Co-authored-by: Kashif Khan <[email protected]>
Co-authored-by: Shahzad Haider <[email protected]>

README.md

@@ -711,6 +711,10 @@ TruffleHog statically detects [https://canarytokens.org/](https://canarytokens.o
     head: # optional
     # Extra args to be passed to the trufflehog cli.
     extra_args: --log-level=2 --results=verified,unknown
+    # Scan with a specific TruffleHog version (default: latest).
+    version:
+    # Docker image to pull. Override to use a registry mirror (default: ghcr.io/trufflesecurity/trufflehog).
+    image:
 ```
 
 If you'd like to specify specific `base` and `head` refs, you can use the `base` argument (`--since-commit` flag in TruffleHog CLI) and the `head` argument (`--branch` flag in the TruffleHog CLI). We only recommend using these arguments for very specific use cases, where the default behavior does not work.

action.yml

@@ -22,6 +22,10 @@ inputs:
     default: "latest"
     description: Scan with this trufflehog cli version.
     required: false
+  image:
+    default: "ghcr.io/trufflesecurity/trufflehog"
+    description: Docker image to use. Override to point at a registry mirror.
+    required: false
 branding:
   icon: "shield"
   color: "green"
@@ -37,6 +41,7 @@ runs:
         ARGS: ${{ inputs.extra_args }}
         COMMIT_IDS: ${{ toJson(github.event.commits.*.id) }}
         VERSION: ${{ inputs.version }}
+        IMAGE: ${{ inputs.image }}
       run: |
         ##########################################
         ## ADVANCED USAGE                       ##
@@ -94,7 +99,7 @@ runs:
         ##          Run TruffleHog              ##
         ##########################################
         docker run --rm -v .:/tmp -w /tmp \
-        ghcr.io/trufflesecurity/trufflehog:${VERSION} \
+        "${IMAGE}:${VERSION}" \
         git file:///tmp/ \
         --since-commit \
         ${BASE:-''} \