fix: support TruffleHog exclude patterns (#94)

* fix: handle trufflehog exclude paths

* fix: use absolute trufflehog scan targets

* fix: complete trufflehog exclude handling

* docs: clarify trufflehog exclude fix

* fix: support trufflehog exclude globs

* fix: complete trufflehog exclusions for v2.2.1

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* fix(trufflehog): Address review feedback

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

---------

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

Author: lelia

CHANGELOG.md

@@ -8,6 +8,24 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [2.2.1] - 2026-07-30
+
+### Fixed
+
+- Fixed TruffleHog secret scanning when `trufflehog_exclude_dir` is configured:
+  all entries now pass through one filter file and are honored for changed-file
+  and explicit-file scans. Previously, configured values could be interpreted
+  as filter filenames and fail or alter scans.
+- Added glob-pattern support for exclusions such as
+  `**/appsettings.*.json`, with matching anchored beneath the workspace and
+  root-relative globs kept distinct from recursive `**` globs.
+- Normalized exclusion entries before pattern generation so dot segments and
+  repeated path separators behave consistently.
+- Fixed exclusion matching when the configured workspace is the filesystem root.
+- Normalized in-workspace TruffleHog finding paths relative to the workspace so
+  host paths do not appear in facts and component identifiers remain stable
+  across runs, working directories, and operating systems.
+
 ## [2.2.0] - 2026-07-29
 
 ### Added

action.yml

@@ -4,7 +4,7 @@ author: "Socket"
 
 runs:
   using: "docker"
-  image: "docker://ghcr.io/socketdev/socket-basics:2.2.0"
+  image: "docker://ghcr.io/socketdev/socket-basics:2.2.1"
   env:
     # Core GitHub variables (these are automatically available, but we explicitly pass GITHUB_TOKEN)
     GITHUB_TOKEN: ${{ inputs.github_token }}
@@ -428,7 +428,7 @@ inputs:
     required: false
     default: "false"
   trufflehog_exclude_dir:
-    description: "Comma-separated list of directories to exclude from secret scanning"
+    description: "Comma-separated literal directory/file names or glob patterns to exclude from secret scanning beneath the workspace root; matching is case-sensitive"
     required: false
     default: ""
   trufflehog_show_unverified:

docs/parameters.md

@@ -321,7 +321,9 @@ socket-basics --disable-secrets
 ```
 
 ### `--exclude-dir EXCLUDE_DIR`
-Comma-separated list of directories to exclude from secret scanning.
+Comma-separated literal directory/file names or glob patterns to exclude from
+secret scanning beneath the workspace root. Matching is case-sensitive. For
+example, `**/appsettings.*.json` matches files at any directory depth.
 
 **Example:**
 ```bash

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "socket_basics"
-version = "2.2.0"
+version = "2.2.1"
 description = "Socket Basics with integrated SAST, secret scanning, and container analysis"
 readme = "README.md"
 requires-python = ">=3.10"

socket_basics/__init__.py

@@ -12,7 +12,7 @@
 from .socket_basics import SecurityScanner, main
 from .core.config import load_config_from_env, Config
 
-__version__ = "2.2.0"
+__version__ = "2.2.1"
 __author__ = "Socket.dev"
 __email__ = "support@socket.dev"
 

socket_basics/connectors.yaml

@@ -406,7 +406,7 @@ connectors:
           - trufflehog_show_unverified
       - name: trufflehog_exclude_dir
         option: --exclude-dir
-        description: "Comma-separated list of directories to exclude from secret scanning"
+        description: "Comma-separated literal directory/file names or glob patterns to exclude from secret scanning beneath the workspace root; matching is case-sensitive"
         env_variable: INPUT_TRUFFLEHOG_EXCLUDE_DIR
         type: str
         default: ""