feat: add trufflehog to ci and precommit

.github/workflows/test-and-lint.yml

@@ -12,6 +12,8 @@ jobs:
     runs-on: self-hosted
     steps:
     - uses: actions/checkout@v4
+      with:
+        fetch-depth: 0  # Fetch all history for trufflehog
     - name: Set up Python 3.11
       uses: actions/setup-python@v5
       with:
@@ -36,6 +38,13 @@ jobs:
           echo "pyupgrade would make changes. Please run pyupgrade locally and commit the changes."
           exit 1
         fi
+    - name: Run TruffleHog
+      uses: trufflesecurity/trufflehog@v3.82.6
+      with:
+        path: ./
+        base: ${{ github.event.pull_request.base.sha }}
+        head: ${{ github.event.pull_request.head.sha }}
+        extra_args: --only-verified --exclude-globs=".venv/*"
 
   test:
     needs: lint

.pre-commit-config.yaml

@@ -34,3 +34,12 @@ repos:
     hooks:
       - id: pyupgrade
         args: [--py310-plus]
+
+  - repo: https://github.com/trufflesecurity/trufflehog
+    rev: v3.82.6
+    hooks:
+      - id: trufflehog
+        name: TruffleHog
+        description: Detect secrets in your data with TruffleHog.
+        entry: trufflehog git file://. --only-verified --no-update --fail --exclude-globs=".venv/*"
+        language: system

README.md

@@ -8,7 +8,7 @@
   <strong>
     <a href="https://www.flow-ai.com/judge">Technical Report</a> |
     <a href="https://huggingface.co/collections/flowaicom/flow-judge-v01-66e6af5fc3b3a128bde07dec">Model Weights</a> |
-    <a href="https://huggingface.co/spaces/flowaicom/Flow-Judge-v0.1">HuggingFace Space</a> |   
+    <a href="https://huggingface.co/spaces/flowaicom/Flow-Judge-v0.1">HuggingFace Space</a> |
     <a href="https://github.com/flowaicom/lm-evaluation-harness/tree/Flow-Judge-v0.1_evals/lm_eval/tasks/flow_judge_evals">Evaluation Code</a> |
     <a href="https://github.com/flowaicom/flow-judge/tree/main/examples">Tutorials</a>
   </strong>