Function execute

worker/src/components/security/trufflehog.ts:368–531

({ inputs, params }, context)

    ],
  },
  async execute({ inputs, params }, context) {
    const parsedParams = parameterSchema.parse(params);
    const runnerPayload = {
      ...inputs,
      ...parsedParams,
    };

    context.logger.info(
      `[TruffleHog] Scanning ${runnerPayload.scanType} target: ${runnerPayload.scanTarget}`,
    );

    const optionsSummary = {
      scanType: runnerPayload.scanType,
      onlyVerified: runnerPayload.onlyVerified ?? true,
      jsonOutput: runnerPayload.jsonOutput ?? true,
      branch: runnerPayload.branch ?? null,
      sinceCommit: runnerPayload.sinceCommit ?? null,
      hasFilesystemContent: !!runnerPayload.filesystemContent,
    };

    context.emitProgress({
      message: 'Launching TruffleHog scan…',
      level: 'info',
      data: { target: runnerPayload.scanTarget, options: optionsSummary },
    });

    // Handle filesystem scanning with isolated volumes
    let volume: IsolatedContainerVolume | undefined;
    let effectiveInput = runnerPayload;

    const baseRunner = definition.runner;
    if (baseRunner.kind !== 'docker') {
      throw new ContainerError('TruffleHog runner must be docker', {
        details: { reason: 'runner_type_mismatch', expected: 'docker', actual: baseRunner.kind },
      });
    }

    try {
      // If filesystemContent is provided, use isolated volume
      if (
        runnerPayload.filesystemContent &&
        Object.keys(runnerPayload.filesystemContent).length > 0
      ) {
        if (runnerPayload.scanType !== 'filesystem') {
          throw new ValidationError('filesystemContent can only be used with scanType=filesystem', {
            fieldErrors: { scanType: ['Must be "filesystem" when using filesystemContent'] },
          });
        }

        const tenantId = (context as any).tenantId ?? 'default-tenant';
        volume = new IsolatedContainerVolume(tenantId, context.runId);

        // Initialize volume with files
        const volumeName = await volume.initialize(runnerPayload.filesystemContent);
        context.logger.info(`[TruffleHog] Created isolated volume: ${volumeName}`);

        // Override scanTarget to point to mounted volume
        effectiveInput = {