From 2fe6aa459e28b6c5ce5813bf8c9368c46f61b97e Mon Sep 17 00:00:00 2001 From: Peter Lord Date: Sun, 2 Aug 2026 18:41:18 -0700 Subject: [PATCH] Retry the trufflehog image pull before the secret scan --- .github/workflows/ci.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index bde328ef..7aaaf83e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -50,7 +50,14 @@ jobs: - name: TruffleHog secret scan # Version-pinned so a hijacked :latest can't silently defeat the gate. + # Docker Hub rate-limits anonymous pulls from the shared GitHub + # runner IPs, so the pull retries with backoff before the scan. run: | + for i in 1 2 3 4 5; do + docker pull -q trufflesecurity/trufflehog:3.96.0 && break + [ "$i" = 5 ] && exit 1 + sleep $((i * 15)) + done docker run --rm -v "$GITHUB_WORKSPACE:/repo:ro" trufflesecurity/trufflehog:3.96.0 \ filesystem /repo --only-verified --fail