TruffleHog on self-hosted runners

Install TruffleHog without sudo for self-hosted GitHub Actions runners.

Context

Self-hosted runners often lack sudo privileges. The standard TruffleHog installation script uses sudo which fails on restricted environments.

Problem

# Standard install fails on self-hosted runners
curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sudo sh -s -- -b /usr/local/bin

Solution

Install to a user-writable directory and add to PATH:

curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b $HOME/.local/bin
echo "$HOME/.local/bin" >> $GITHUB_PATH

Reusability

• Score: 4/5
• Used in: Aloysius-Productions-Knowledge-Vault CI

Trade-offs

• Pro: Works without elevated privileges
• Pro: User-scoped installation is cleaner
• Con: Requires PATH modification in workflow

Source

Discovered while adding security scanning to Knowledge Vault CI pipeline.

Related

• ops-core - Central CI/CD patterns

See also: Pattern Library