Fix trufflehog-extra-args exclude-globs silently ignored

[gpmayorga]

What

app-ci-checks.yml's trufflehog-extra-args default wrapped its comma-separated
--exclude-globs list in double quotes: --exclude-globs "**/dist/**,**/build/**" ....

Why this was broken

The upstream trufflesecurity/trufflehog action appends extra_args via unquoted
${ARGS:-''} in its own entrypoint script:

docker run ... git file:///tmp/ --since-commit ... --branch ... --fail --no-update --github-actions ${ARGS:-''}

Bash only strips quote characters when it parses them as syntax in the original script
text — not when they're embedded inside a variable's runtime value. Since ${ARGS} here is
unquoted, bash performs word-splitting/globbing on the expansion but never removes the quote
characters that are part of the string. Reproduced locally:

$ ARGS='--exclude-globs "**/dist/**,**/build/**,.github/**,.env-config/**" --results=verified,unknown'
$ for a in --github-actions ${ARGS:-''}; do printf '[%s]\n' "$a"; done
...
[--exclude-globs]
["**/dist/**,**/build/**,.github/**,.env-config/**"]
[--results=verified,unknown]

The literal " characters land on the first and last glob in the list ("**/dist/**
and **/build/**" here), corrupting exactly those two patterns — trufflehog never matches
them against real paths, so they silently stop excluding anything. Middle entries in a
longer list (e.g. apps-invest's override, which puts .env-config/** last) are equally
corrupted; this is exactly what caused apps-invest#268's secrets-scan to flag
VITE_INFURA_KEY in .env-config/* even though that path was supposedly excluded.

Fix

Drop the wrapping quotes. They were never doing anything useful — the list has no spaces to
protect from word-splitting — and they actively corrupt the boundary globs. Companion fix
already pushed to apps-invest's own caller override (same bug, same root cause).

Verification

• yamllint -d "{extends: relaxed, rules: {line-length: disable}}" clean (matches lib-ci's config).
• Reproduced the exact quote-corruption bug and the fix locally via a standalone bash script mimicking the upstream action's append.

🤖 Generated with Claude Code

---

Generated by Claude Code