feat(ess) add helm charts #1953

	# SPDX-FileCopyrightText: Copyright (c) NVIDIA CORPORATION & AFFILIATES. All rights reserved.
	# SPDX-License-Identifier: Apache-2.0

	name: secret-scan

	on:
	push:
	branches: [main, 'release-**']
	pull_request:
	branches: [main, 'release-**']
	merge_group:
	types: [checks_requested]
	workflow_dispatch:

	permissions:
	actions: read
	contents: read
	pull-requests: write

	concurrency:
	group: secret-scan-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	trufflehog-secret-scan:
	name: Secret Scan with TruffleHog
	runs-on: ubuntu-latest
	timeout-minutes: 30
	steps:
	- name: Checkout repository
	uses: actions/checkout@v4
	with:
	fetch-depth: 0

	- name: Run TruffleHog Scan
	# No repository secrets or custom env vars are required; PR comments are disabled.
	uses: NVIDIA/dsx-github-actions/.github/actions/trufflehog-scan@9a9ce3a7770a8b53d2726afa920be3276bc3ddd7
	with:
	# On merge_group there is no push/PR context for TruffleHog to derive a
	# diff range from, so it errors with "BASE == HEAD" and fails the gate,
	# blocking the merge queue. Pass the merge queue's base..head range
	# explicitly. push and pull_request events keep the empty defaults so
	# the action uses its own event-based range.
	base: ${{ github.event_name == 'merge_group' && github.event.merge_group.base_sha \|\| '' }}
	head: ${{ github.event_name == 'merge_group' && github.event.merge_group.head_sha \|\| '' }}
	extra-args: '--results=verified,unknown'
	post-pr-comment: 'false'
	fail-on-findings: 'true'
	version: '3.95.2'

Navigation Menu