plan files

docs/plans/phase2-step1-trufflehog.md

@@ -0,0 +1,17 @@
+# Implementation Plan: TruffleHog Scanner
+
+## Objective
+Implement the TruffleHog secrets scanning step as a parallel task in the DAG.
+
+## Requirements
+- Define a task template named `scan-trufflehog`.
+- Depend on the `clone-repo` task.
+- Mount the shared PVC at `/workspace`.
+- Run TruffleHog against the `/workspace` directory.
+- Configure TruffleHog to output its findings in JSON or SARIF format.
+- Save the output to `/workspace/reports/trufflehog.json` (or `.sarif`).
+- Ensure the task exits successfully (exit code 0) even if secrets are found, so the pipeline can proceed to the aggregation step (Phase 3). (Use `continueOn` or `ignoreError` or a wrapper script like `trufflehog ... || true`).
+
+## Agent Instructions
+1. Add the `scan-trufflehog` template to the `ClusterWorkflowTemplate`.
+2. Wire it into the DAG alongside the other scanners.