feat: add concurrency to TruffleHog scans (#105)

  1. **Add concurrency** - Use `--concurrency 16` to parallelize scanning, reducing scan time by 60-70%

  2. **Fix file detection** - Use base branch ref instead of SHA to ensure we only scan files actually changed in the PR, not hundreds of unrelated files

  3. **Filter CHANGELOG false positives** - Remove git commit hashes from CHANGELOG/HISTORY/NEWS files to eliminate ~60 false positives per scan while still catching
  real secrets

Author: isaiah-grafana

.github/workflows/reusable-trufflehog.yml

@@ -81,14 +81,17 @@ jobs:
 
       - name: Scan for secrets
         id: scan
+        env:
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
+          SHA: ${{ github.sha }}
         run: |
           set +e
           echo "[]" > results.json
 
           if [[ "${{ github.event_name }}" == "pull_request" ]]; then
             # PR: Scan only changed files (using three-dot diff to show only PR changes)
             echo "Scanning changed files in PR..."
-            git diff --name-only ${{ github.event.pull_request.base.sha }}...${{ github.sha }} > changed-files.txt
+            git diff --name-only origin/${BASE_REF}...${SHA} > changed-files.txt
 
             if [[ -s changed-files.txt ]]; then
               while IFS= read -r file; do
@@ -105,7 +108,7 @@ jobs:
 
                 if [[ -f "${file}" ]]; then
                   echo "Scanning: ${file}"
-                  trufflehog filesystem "${file}" --exclude-paths /tmp/trufflehog-exclude.txt --json --no-update --results=verified,unverified >> results.ndjson || true
+                  trufflehog filesystem "${file}" --exclude-paths /tmp/trufflehog-exclude.txt --concurrency 16 --json --no-update --results=verified,unverified >> results.ndjson || true
                 fi
               done < changed-files.txt
             else
@@ -114,12 +117,18 @@ jobs:
           else
             # Push to main: Scan current filesystem
             echo "Scanning current filesystem..."
-            trufflehog filesystem . --exclude-paths /tmp/trufflehog-exclude.txt --json --no-update --results=verified,unverified > results.ndjson || true
+            trufflehog filesystem . --exclude-paths /tmp/trufflehog-exclude.txt --concurrency 16 --json --no-update --results=verified,unverified > results.ndjson || true
           fi
 
-          # Process results
+          # Process results and filter git hashes from CHANGELOG files
           if [[ -s results.ndjson ]]; then
-            grep -v '^$' results.ndjson | jq -s '.' > results.json 2>/dev/null || echo "[]" > results.json
+            grep -v '^$' results.ndjson | jq -c 'select(
+              not(
+                ((.SourceMetadata?.Data?.Filesystem?.file // .SourceMetadata?.Data?.Git?.file) // "") as $file |
+                ($file | test("CHANGELOG|HISTORY\\.md|NEWS\\.md"; "i")) and
+                (.Raw | test("^[0-9a-f]{7,40}$"; "i"))
+              )
+            )' | jq -s '.' > results.json 2>/dev/null || echo "[]" > results.json
           fi
 
           # Count secrets