Fail the secret scanning job when the scan errors out

[albertvillanova]

Stacked on top of #6757.

This PR makes the secret scanning job fail when the scan itself errors out, instead of reporting success.

Motivation

The scanner exits 0 when it cannot scan. If it fails to resolve the commit range it was handed, it logs an error, reports "chunks": 0, "bytes": 0, and the job goes green:

error  trufflehog  encountered errors during scan  {"errors": ["error chunking dir ...: unable to resolve ref: no base refs succeeded for base: \"main\""]}
info-0 trufflehog  finished scanning  {"chunks": 0, "bytes": 0, "verified_secrets": 0, "unverified_secrets": 0}

That is not hypothetical. The same workflow in huggingface/transformers has been in exactly this state since huggingface/transformers#47945, where every pull request branch and every merge queue push scans zero bytes and passes:

run	branch	chunks
31792591798	fix_qwen2_5_vl_batch_wo_image	0
31793095807	serge/fix/itf-...	0
31795946540	gh-readonly-queue/main/pr-47960-...	0

A secret scan that covers nothing is worse than one that fails, because a green check invites nobody to look.

Solution

Pass --fail-on-scan-errors, so the job fails closed on scan errors. Verified against the pinned scanner image:

scenario	current	with the flag
unresolvable commit range, 0 chunks scanned	exit 0	exit 1
verification error on a found secret	exit 183	exit 183

The flag covers source and chunking errors only, so results whose verification errored are still reported through --results=verified,unknown exactly as before.

Changes

• Add --fail-on-scan-errors to the scanner arguments, with a comment recording why

---

Note

Low Risk
CI-only workflow tweak that tightens secret-scan reliability; no application or auth logic changes, with possible extra failures on genuine scan errors.

Overview
The TruffleHog workflow now passes --fail-on-scan-errors in extra_args, so the secret scanning job fails when the scanner hits source/chunking errors (e.g. unresolvable commit range) instead of exiting successfully with zero bytes scanned.

A short comment in .github/workflows/trufflehog.yml documents that behavior. Existing flags (--results=verified,unknown, detector exclusions) are unchanged.

^{Reviewed by Cursor Bugbot for commit 5dc4139. Bugbot is set up for automated code reviews on this repo. Configure here.}

[bot-ci-comment]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

[albertvillanova]

Reported the upstream case that motivates this flag:

• Secret Leaks workflow scans nothing on branch and merge queue pushes transformers#47973

Their Secret Leaks workflow has been scanning zero bytes on every pull request branch and every merge queue push since huggingface/transformers#47945, passing green throughout, because scan errors are not fatal by default.

[qgallouedec]

Same as #6759 feel free to merge it, or wait for @McPatate's opinion if you think it's necessary.