Scan-only TruffleHog tests with exact historical finding allowlists.
trufflehog_test
load("@rules_trufflehog//:defs.bzl", "trufflehog_test")
trufflehog_test(name, git, repository_marker, allowlist, scanner, all_refs, tags, **kwargs)
Runs a fresh Git-history scan without credential verification.
PARAMETERS
| Name | Description | Default Value |
|---|
| name | Test target name. | none |
| git | Consumer-supplied Git executable. | none |
| repository_marker | File at the worktree root. | none |
| allowlist | JSON policy with exact detector/path/commit/line tuples. | none |
| scanner | Optional executable override for a custom scanner or fixture. | Label("@rules_trufflehog//:trufflehog") |
| all_refs | Include all local refs when true. | False |
| tags | Additional tags, such as manual for an all-ref audit. | [] |
| kwargs | Common Bazel test attributes. | none |