Skip to content

build(deps): bump trufflesecurity/trufflehog from 3.99.3 to 3.99.7 - #276

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/trufflesecurity/trufflehog-3.99.7
Open

build(deps): bump trufflesecurity/trufflehog from 3.99.3 to 3.99.7#276
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/trufflesecurity/trufflehog-3.99.7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 29, 2026

Copy link
Copy Markdown
Contributor

Bumps trufflesecurity/trufflehog from 3.99.3 to 3.99.7.

Release notes

Sourced from trufflesecurity/trufflehog's releases.

v3.99.7

What's Changed

New Contributors

Full Changelog: trufflesecurity/trufflehog@v3.99.6...v3.99.7

v3.99.6

v3.99.5 was tagged but never published because its release build failed. v3.99.6 supersedes it and includes all of the changes below.

What's Changed

Full Changelog: trufflesecurity/trufflehog@v3.99.4...v3.99.6

v3.99.4

What's Changed

Full Changelog: trufflesecurity/trufflehog@v3.99.3...v3.99.4

Commits
  • 31ce31e Fix 7z and rar panics in the archive handler and log recovered panic stacks (...
  • 50bc667 feat(detectors): add Infisical service token detector (#5445)
  • 4723140 feat(detectors): add Fireworks AI API key detector (#5447)
  • 8276bc4 ci(lint): pin the semgrep container image by digest (#5245)
  • f6984be Add xAI analyzer (#5456)
  • 282085c fix(detectors/anypointoauth2): stop treating HTTP 422 as verified (#5386)
  • b1bb823 Fix --include-wikis help typo and huggingface README description (#5471)
  • fd43a88 Keep GoReleaser temp files off the tmpfs /tmp in releases (#5473)
  • 3bd461f security: bump andybalholm/brotli to v1.2.7 (CVE-2026-111497) (#5472)
  • d6ea4a5 Clean up Filesystem source logging for per-source debug (#5465)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
build(deps): bump trufflesecurity/trufflehog from 3.99.3 to 3.99.7
d3e93d8 
Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.99.3 to 3.99.7.
- [Release notes](https://github.com/trufflesecurity/trufflehog/releases)
- [Commits](trufflesecurity/trufflehog@e63326d...31ce31e)

---
updated-dependencies:
- dependency-name: trufflesecurity/trufflehog
  dependency-version: 3.99.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 29, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner October 29, 2026 18:44
@clawsweeper

clawsweeper Bot commented Oct 29, 2026 •
edited
Loading

Copy link
Copy Markdown

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

@clawsweeper clawsweeper Bot added P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels Oct 29, 2026
@clawsweeper

clawsweeper Bot commented Oct 29, 2026

Copy link
Copy Markdown

Codex review: needs maintainer review before merge.

What this changes

This PR updates the pinned TruffleHog action from v3.99.3 to v3.99.7 while retaining scanner runtime version 3.99.4.

Example: Secret scanning runs for a pull request.

  • Before: Action revision e63326d6545de8f425d93ce24078c6e68d83f70e launches scanner image version 3.99.4.
  • After: Action revision 31ce31ee1abbcc7dc8eee5764c17121c3044c8b2 launches the same scanner image version 3.99.4.

Review scores

Measure Result What it means
Overall readiness 🐚 platinum hermit (4/6) A focused dependency refresh with verified identical action content, preserved runtime qualification, passing checks, and no actionable findings.
Proof confidence 🌊 off-meta tidepool Not applicable: This bot-authored dependency refresh is outside the ordinary contributor proof gate; identical upstream action content establishes no changed runtime behavior, and exact-head CI remains supporting validation.
Patch quality 🐚 platinum hermit (4/6) No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: The security workflow references an older upstream action release.
Reason: This is a minimal, established dependency refresh that retains existing execution behavior and qualified runtime choices.

Merge readiness

✅ Ready for maintainer review

Keep this PR open: main still uses the older action reference, and the update preserves identical action code and the qualified scanner runtime without introducing an actionable defect.

Priority: P3
Reviewed head: d3e93d8fd82410a6d8c0e7bf7ada0e1a2ab0d34f

Before merge

None.

Findings

None.

Agent review details

How this fits together

The GitHub Actions security workflow checks out repository history, resolves the commit range, and invokes TruffleHog to fail the gate when verified secrets are found.

flowchart TD
  A[Push or pull request] --> B[Checkout repository history]
  B --> C[Resolve commit range]
  C --> D[Pinned TruffleHog action]
  D --> E[Scanner image version 3.99.4]
  E --> F[Verified secret gate]
Loading

Technical review

Best possible solution:

Land the focused action-reference refresh while preserving the qualified scanner runtime.

Do we have a high-confidence way to reproduce the issue?

No product bug is asserted; source inspection verifies the reference update and unchanged runtime selection.

Is this the best way to solve the issue?

The one-line reference update follows established dependency maintenance and preserves the earlier runtime qualification.

AGENTS.md: found but not applied because it conflicted with ClawSweeper's review contract.

Codex review notes: model internal, reasoning medium; reviewed against 033ab003a71d.

Provenance checked

Testing

Proof path: none.

Security

None.

Evidence

What I checked:

  • Exact introduced change: The sole introduced edit replaces the action SHA and version comment; the explicit runtime version, scan range, verification flags, and permissions remain unchanged. (.github/workflows/secret-scan.yml:52, d3e93d8fd824)
  • Current main still has the older reference: GitHub confirms main remains at the fetched revision, whose workflow pins action v3.99.3 and scanner runtime 3.99.4; the exact proposed reference update is not implemented there. (.github/workflows/secret-scan.yml:52, 033ab003a71d)
  • Executed dependency contract is identical: The target workflow directly executes this composite action, establishing the dependency boundary. Both pinned revisions contain identical action.yml blob 1e2af3fbb9ef7eb5f19e21af9d0c6c3278de1a73, including the version input and Docker invocation; no upstream root AGENTS.md exists at the new revision. (action.yml:21, 31ce31ee1abb)
  • Release identity and dependency cooldown: The v3.99.7 tag resolves to the proposed commit and was published on 2026-10-24, before the target repository's three-day dependency cooldown elapsed for this PR. (31ce31ee1abb)
  • Prior runtime repair is preserved: The merged repair at fix(ci): pin qualified TruffleHog runtime image #272 deliberately selected the qualified 3.99.4 runtime through the existing version input; this PR retains that decision. (.github/workflows/secret-scan.yml:54, f1c40bc03f86)
  • Exact-head checks: All recorded checks completed: eight succeeded, two dispatch jobs were skipped, and CodeQL was neutral; both secret-scanning jobs succeeded on the reviewed head. (.github/workflows/secret-scan.yml:12, d3e93d8fd824)

Likely related people:

  • Josh Avant: Raw commit f1c40bc adds .github/workflows/secret-scan.yml:54 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: f1c40bc03f86; files: .github/workflows/secret-scan.yml)
  • Peter Steinberger: Raw commit f80cc94 adds .github/workflows/secret-scan.yml:19 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: f80cc94dcdbd; files: .github/workflows/secret-scan.yml)
  • Vincent Koc: Raw commit a4ab91b adds .github/workflows/secret-scan.yml:13 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: a4ab91b035da; files: .github/workflows/secret-scan.yml)

Labels

Label changes:

  • add P3: Routine dependency-reference maintenance with identical executable action content and no scanner runtime change.
  • add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
  • add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

  • P3: Routine dependency-reference maintenance with identical executable action content and no scanner runtime change.
  • rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 29, 2026, 2:57 PM ET / 18:57 UTC.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants