trufflesecurity/trufflehog "BASE and HEAD are the same commit"

By Kaveh Alemi·Latchkey

trufflehog scans the diff between BASE and HEAD. When both point at the same commit (often a shallow checkout or a push with no range), there is no diff to scan and the action errors or scans nothing.

What this error means

The trufflehog step fails or warns that BASE and HEAD are the same commit and scans no diff.

Error: BASE and HEAD commits are the same. TruffleHog won't scan anything.
Please see https://github.com/trufflesecurity/trufflehog#scanning-a-github-pull-request

Common causes

Shallow checkout

fetch-depth: 1 leaves no prior commit to diff against, collapsing BASE and HEAD.

Missing base/head inputs

On non-PR events the action cannot infer a range, so BASE equals HEAD.

How to fix it

Fetch full history and set base/head

1. Set fetch-depth: 0 on checkout so the full history is available.
2. Set base and head inputs (or rely on PR context) so a real range exists.
3. Re-run the scan.

- uses: actions/checkout@v4
  with:
    fetch-depth: 0
- uses: trufflesecurity/trufflehog@main
  with:
    base: ${{ github.event.repository.default_branch }}
    head: HEAD

How to prevent it

• Use fetch-depth: 0 for any action that diffs commit ranges.
• Provide base/head explicitly outside pull_request contexts.

Frequently asked questions

Related guides

References

• GitHub Actions documentation
• Workflow syntax for GitHub Actions