Skip to content

build(deps): bump trufflesecurity/trufflehog from 3.99.3 to 3.99.7 - #173

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/trufflesecurity/trufflehog-3.99.7
Closed

build(deps): bump trufflesecurity/trufflehog from 3.99.3 to 3.99.7#173
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/trufflesecurity/trufflehog-3.99.7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 30, 2026

Copy link
Copy Markdown
Contributor

Bumps trufflesecurity/trufflehog from 3.99.3 to 3.99.7.

Release notes

Sourced from trufflesecurity/trufflehog's releases.

v3.99.7

What's Changed

New Contributors

Full Changelog: trufflesecurity/trufflehog@v3.99.6...v3.99.7

v3.99.6

v3.99.5 was tagged but never published because its release build failed. v3.99.6 supersedes it and includes all of the changes below.

What's Changed

Full Changelog: trufflesecurity/trufflehog@v3.99.4...v3.99.6

v3.99.4

What's Changed

Full Changelog: trufflesecurity/trufflehog@v3.99.3...v3.99.4

Commits
  • 31ce31e Fix 7z and rar panics in the archive handler and log recovered panic stacks (...
  • 50bc667 feat(detectors): add Infisical service token detector (#5445)
  • 4723140 feat(detectors): add Fireworks AI API key detector (#5447)
  • 8276bc4 ci(lint): pin the semgrep container image by digest (#5245)
  • f6984be Add xAI analyzer (#5456)
  • 282085c fix(detectors/anypointoauth2): stop treating HTTP 422 as verified (#5386)
  • b1bb823 Fix --include-wikis help typo and huggingface README description (#5471)
  • fd43a88 Keep GoReleaser temp files off the tmpfs /tmp in releases (#5473)
  • 3bd461f security: bump andybalholm/brotli to v1.2.7 (CVE-2026-111497) (#5472)
  • d6ea4a5 Clean up Filesystem source logging for per-source debug (#5465)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
build(deps): bump trufflesecurity/trufflehog from 3.99.3 to 3.99.7
c13ff63 
Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.99.3 to 3.99.7.
- [Release notes](https://github.com/trufflesecurity/trufflehog/releases)
- [Commits](trufflesecurity/trufflehog@e63326d...31ce31e)

---
updated-dependencies:
- dependency-name: trufflesecurity/trufflehog
  dependency-version: 3.99.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 30, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner October 30, 2026 07:26
@clawsweeper

clawsweeper Bot commented Oct 30, 2026 •
edited
Loading

Copy link
Copy Markdown

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

@clawsweeper clawsweeper Bot added P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels Oct 30, 2026
@clawsweeper

clawsweeper Bot commented Oct 30, 2026

Copy link
Copy Markdown

Codex review: needs maintainer review before merge.

What this changes

Updates the TruffleHog action reference from v3.99.3 to v3.99.7 while retaining scanner image version 3.99.4.

Example: GitHub Actions scans a pull request for verified secrets.

  • Before: The v3.99.3 action wrapper runs the 3.99.4 scanner image.
  • After: The identical v3.99.7 action wrapper runs the same 3.99.4 scanner image.

Review scores

Measure Result What it means
Overall readiness 🐚 platinum hermit (4/6) A correct, minimal maintenance update supported by upstream source identity and successful exact-head checks.
Proof confidence 🌊 off-meta tidepool Not applicable: This bot-authored maintenance PR is outside the ordinary contributor-proof gate; exact-head workflow steps passed, and identical action blobs establish unchanged execution behavior, although detailed job logs were inaccessible.
Patch quality 🐚 platinum hermit (4/6) No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: The CI action reference trails the newer upstream release.
Reason: A minimal dependency refresh follows the established pinned-action maintenance pattern without changing scanner behavior.

Merge readiness

✅ Ready for maintainer review

This PR is a correct, narrowly scoped action-pin update that is absent from current main; no introduced defect was found.

Priority: P3
Reviewed head: c13ff632446deee8b6ae7e5256e2b1214f788213

Before merge

None.

Findings

None.

Agent review details

How this fits together

The secret-scanning workflow passes repository commit ranges to a composite action that launches the selected scanner image and fails when verified secrets are found.

flowchart LR
  A[Push or pull request] --> B[Checkout repository]
  B --> C[Resolve commit range]
  C --> D[Pinned TruffleHog action]
  D --> E[Scanner image 3.99.4]
  E --> F[Secret scanning gate]
Loading

Technical review

Best possible solution:

Land the action-pin refresh while preserving the separately qualified scanner image selection.

Do we have a high-confidence way to reproduce the issue?

This is dependency maintenance rather than a reported bug; source comparison establishes the exact scope without executing target code.

Is this the best way to solve the issue?

The one-line reference update is the smallest complete change and preserves the existing scanner qualification.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against b7cf3a6de3dc.

Provenance checked

Testing

Proof path: none.

Security

None.

Evidence

What I checked:

  • Exact introduced change: The sole introduced hunk changes the action SHA; scan inputs, image version, permissions, triggers, and failure handling remain unchanged. (.github/workflows/secret-scan.yml:52, c13ff632446d)
  • Executed dependency contract: The workflow executes this repository's action.yml, making its runtime contract applicable. Both action references resolve action.yml to blob 1e2af3fbb9ef7eb5f19e21af9d0c6c3278de1a73; it runs IMAGE:VERSION. The v3.99.7 tag resolves to the proposed commit. No root AGENTS.md was available at that revision. (action.yml, 31ce31ee1abb)
  • Preserved scanner qualification: Merged fix(ci): select the qualified TruffleHog scanner image #171 deliberately selected scanner image 3.99.4 using the existing version input; this PR preserves that choice. (.github/workflows/secret-scan.yml:57, b7cf3a6de3dc)
  • Exact-head workflow result: The secret-scanning job completed successfully for the reviewed head, including Resolve scan range and TruffleHog OSS. Job: https://github.com/openclaw/crawlkit/actions/runs/41020079087/job/123945148276. Reading its detailed logs was blocked by the sandbox's artifact-host allowlist. (.github/workflows/secret-scan.yml:50, c13ff632446d)
  • Feature ownership and original intent: History identifies Vincent Koc's original secret-scanning implementation, repeated security-tool refreshes by Peter Steinberger, and Josh Avant's scanner-image selection; CODEOWNERS routes workflows to openclaw-secops. Follow-history reached the creation boundary before a missing parent object, while the creation commit itself was readable. (.github/workflows/secret-scan.yml, b7cf3a6de3dc)
  • Repository policy applied: Read the complete root AGENTS.md; no nested workflow policy or maintainer-notes directory was present. Read-only review restrictions precluded running validation commands or the autoreview helper, and the checkout remained clean. (AGENTS.md, c13ff632446d)

Likely related people:

  • Josh Avant: Raw commit b7cf3a6 adds .github/workflows/secret-scan.yml:57 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: b7cf3a6de3dc; files: .github/workflows/secret-scan.yml)
  • Vincent Koc: Raw commit ae16f4d adds .github/workflows/secret-scan.yml:13 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: ae16f4d2a0bd; files: .github/workflows/secret-scan.yml)

Labels

Label changes:

  • add P3: Routine dependency maintenance with an identical executed action wrapper and unchanged scanner runtime.
  • add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
  • add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

  • P3: Routine dependency maintenance with an identical executed action wrapper and unchanged scanner runtime.
  • rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 30, 2026, 3:38 AM ET / 07:38 UTC.

@vincentkoc

vincentkoc commented Oct 30, 2026

Copy link
Copy Markdown
Member

Closing after source review: this updates the TruffleHog action wrapper pin, but the complete action.yml at both pins is identical (blob 1e2af3fbb9ef7eb5f19e21af9d0c6c3278de1a73). This workflow explicitly selects scanner version 3.99.4, so the proposed wrapper change does not upgrade the executed scanner or deliver the newer scanner fixes. No operational uplift is established. A scanner-binary update should change the explicit version and qualify that artifact.

Reviewed exact head: c13ff632446deee8b6ae7e5256e2b1214f788213.

@vincentkoc vincentkoc closed this Oct 30, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 30, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/github_actions/trufflesecurity/trufflehog-3.99.7 branch October 30, 2026 15:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@vincentkoc