Bryan Beverly
4d2a8ef686
* Add man page generation for trufflehog Add a hidden --generate-man-page flag that uses an enhanced Kingpin template to produce a standards-compliant roff man page. The man page includes auto-generated OPTIONS and COMMANDS sections (synced with the CLI definitions), plus hand-maintained EXAMPLES, EXIT STATUS, ENVIRONMENT, FILES, BUGS, and SEE ALSO sections. The DESCRIPTION and EXAMPLES sections call out the interactive TUI that launches when trufflehog is run without a command in a terminal. To keep the generated output deterministic, the --concurrency flag is defined with a static "N" placeholder; the runtime.NumCPU() default is applied at runtime instead of at flag-definition time. The usage line also uses the lowercase binary name. Distribution: - Makefile `man` target to regenerate locally - GoReleaser before hook to regenerate at release time with the correct version injected via ldflags - Release archives explicitly include LICENSE, README.md, and docs/man/trufflehog.1 - Homebrew formula installs the man page to man1 The Makefile `test-release` target is also updated to GoReleaser v2 flag syntax (--skip=publish,sign), which is needed for the snapshot release to succeed locally without cosign installed. Made-with: Cursor * Add man page maintenance guardrails Add a CI job that regenerates the man page on every PR and fails if the checked-in copy at docs/man/trufflehog.1 is out of date with the current CLI definitions. Document the regeneration workflow in CONTRIBUTING.md so contributors know to run `make man` and commit the result when changing flags or subcommands. Made-with: Cursor
GitHub Workflows
This directory contains GitHub Actions workflows for the TruffleHog repository.
PR Approval Check (pr-approval-check.yml)
This workflow enforces that at least one PR approver must be an active member of the @trufflesecurity/product-eng team or any of its child teams.
How it works:
-
Triggers: The workflow runs on:
pull_request_reviewevents when a review is submitted (submittedtype)pull_requestevents when a PR is opened, reopened, or synchronized (opened,reopened,synchronizetypes)
-
Approval Check Process: The workflow:
- Fetches all reviews for the PR using the GitHub API
- Filters for reviews with state
APPROVED - Gets all child teams of
@trufflesecurity/product-engusinglistChildInOrgAPI - Checks if any approver is an active member (not pending) of either:
- The parent
@trufflesecurity/product-engteam, OR - Any of its child teams
- The parent
- Sets a commit status accordingly
-
Status Check: Creates a commit status named
product-eng-approvalwith:- ✅ Success: When at least one approver is an active member of
@trufflesecurity/product-engor any child team - ❌ Failure: When there are no approvals or there are approvals but none from active
@trufflesecurity/product-engmembers
- ✅ Success: When at least one approver is an active member of
Error Handling
If there are errors listing reviews or checking team membership, the workflow reports a failure status and also fails itself.
Branch Protection
To make this check required:
- Go to Settings → Branches
- Add or edit a branch protection rule for your main branch
- Enable "Require status checks to pass before merging"
- Add
pr-approval-checkto the required status checks
Permissions
The workflow uses the default GITHUB_TOKEN which has sufficient permissions to:
- Read PR reviews
- List child teams and check team membership (for public teams)
- Create commit statuses
Note: If the product-eng team or its child teams are private, you may need to use a personal access token with appropriate permissions. The Github API returns 404 for non-members and for lack of permissions.