Scoping a scan to changed files now works no matter how the config was built, and when a scope cannot be honored the run says so instead of quietly scanning nothing. Before this change, several common setups silently scanned zero files and reported a clean result, which is the worst way for a security scan to fail.

The failures this fixes

Each of these produced a green, empty scan with no warning.

The container case was the one nothing in a workflow could fix, because setting safe.directory in a workflow step writes the runner's git config rather than the container's.

One resolver for every source. changed_files used to be resolved only inside create_config_from_args(). Every config source now goes through the same resolver, so environment, JSON, and dashboard configs all behave identically. A raw string like "auto" is resolved against git rather than stored as characters.

Pull request base lookup. When GITHUB_BASE_REF is unset, the base now comes from pull_request.base.sha and pull_request.base.ref in the GitHub event payload. That covers pull_request_review and pull_request_review_comment, whose payloads carry a top-level pull_request.

It deliberately does not cover issue_comment. That payload only has issue.pull_request, which is URLs with no base ref or sha, so there is no base to be had without a GitHub API call. config.py makes no network requests today, and falling back to the default branch would diff against the wrong base for anything targeting a release or stacked branch. So that trigger now names itself in a warning and says to pass GITHUB_BASE_REF from the workflow instead.

Git ownership. When git refuses to read the workspace, the git reads retry with that one directory trusted, and log that they did. When git is not refusing, which is any ordinary local run, nothing is relaxed. The retry is scoped to the workspace path and never a wildcard.

A shallow checkout names fetch-depth: 0 as the fix. A workspace that is not a git repository, git refusing to read the repository, and a missing PR base each get their own warning. A scope that resolves to zero files warns that the scanners are being skipped.

All five previously returned an empty list in complete silence.

scan_all still overrides changed_files, but now logs a warning naming the scope it discarded, because that setting can come from a dashboard config rather than the workflow. The warning is explicit that the override is partial: only scanners that ask get_scan_targets() for their paths widen, while the secret and container scanners read changed_files directly and stay scoped, so setting both produces a mixed run.

TruffleHog and Trivy used to fall back to their own staged-file scope when an explicit changed_files request resolved to nothing, which quietly replaced the scope the user asked for.

Trivy's filesystem vulnerability scan also widened an empty scope back out to the whole workspace. It is the one scanner that builds its own path list instead of going through get_scan_targets(), so it needed the check in two places.

Two more came out of review. Trivy's Dockerfile scan kept scanning the configured Dockerfiles when the changed set contained none, so a Python-only change still triggered a Dockerfile scan. And TruffleHog was handed changed paths that no longer exist on disk, producing trufflehog filesystem <workspace>/gone.py for a deleted file. Both now skip cleanly.

scan_all keeps working the same way throughout: it does not mean "ignore the scope", it means "when the scope resolves to nothing, scan everything rather than nothing".

Testing

267 tests pass. The new coverage pins both directions for each fix: that a scope narrows when it should, and that it does not widen when it should not.

Worth noting for reviewers, two existing tests in test_trufflehog_excludes.py were encoding the old bug. They named changed files that were never created on disk and asserted those paths reached TruffleHog. They now get real files, with their assertions untouched.