name: Scan for secrets

on:
  push:
    tags:
      - v*
    branches:
      - main
  pull_request:
  workflow_dispatch:

jobs:
  test:
    if: ${{ github.repository == 'trufflesecurity/trufflehog' && !github.event.pull_request.head.repo.fork }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          fetch-depth: 0
          ref: ${{ github.head_ref }}
      - name: Dogfood
        uses: ./
        id: dogfood
        with:
          extra_args: --results=verified