Repository navigation
fix(ci): select the qualified TruffleHog scanner image - #193
Conversation
|
🦞👀 Pull request received. I will update this pull request when review starts. ClawSweeper review completeClawSweeper finished reviewing this revision. The review result is being finalized. |
clawsweeper
Bot
added
clawsweeper:intake:bug
|
Codex review: needs maintainer review before merge. What this changesThis PR selects TruffleHog image version 3.99.4 through the pinned action’s existing version input. Example: A secret-scanning runner has an older cached latest image.
Review scores
ProductKind: Bug fix · Worth it: Yes · Fix scope: Complete Merge readiness✅ Ready for maintainer review This PR makes a focused scanner-runtime repair that main lacks; no actionable patch defects remain. Priority: P2 Before mergeNone. FindingsNone. Agent review detailsHow this fits togetherGitHub push and pull-request events provide a commit range to a workflow that runs TruffleHog and fails when verified credentials are detected. flowchart TD
A[Push or pull request] --> B[Resolve commit range]
B --> C[Pinned TruffleHog action]
C --> D[Scanner image 3.99.4]
D --> E[Verify detected credentials]
E --> F[Workflow result]
Technical reviewBest possible solution: Use the existing version input to select the qualified scanner runtime while preserving the established secret-scanning gate. Do we have a high-confidence way to reproduce the issue? The pinned action defaults to latest and invokes docker run without forcing a pull, establishing the cached-image reuse path from source. Is this the best way to solve the issue? The single existing input is the smallest complete fix for explicit runtime selection, with upstream tag mutability accurately acknowledged. AGENTS.md: not found in the target repository. Codex review notes: model internal, reasoning medium; reviewed against 4a8f491bebec. Provenance checked
TestingProof path: shipped entry point. SecurityNone. EvidenceWhat I checked:
Likely related people:
LabelsLabel changes:
Label justifications:
Rating scale6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior. WorkflowClawSweeper edits this one comment on every review. Comment HistoryReview history (1 earlier review cycle)
Reviewed October 23, 2026, 10:23 PM ET / October 24, 2026, 02:23 UTC (Revision 2). |
|
@clawsweeper re-review The PR body now includes inspectable exact-artifact observations for the requested evidence gap, with platform and component-reuse limits stated. Product source is unchanged. |
|
🦞👀 Re-review progress:
|
clawsweeper
Bot
added
proof: sufficient
What Problem This Solves
The source-pinned action otherwise defaults to mutable latest, allowing historical cached scanner contents. Select the released TruffleHog3.99.4 scanner image whose actual payloads have incident-hardening evidence.
User Impact
CI secret scanning uses the selected qualified runtime. Product code/data and scan policy remain unchanged. This is a scanner-input change, not complete repository or fleet remediation; upstream image version tags remain mutable.
Why This Change Was Made
Use the pinned action's existing
versioninput. Preserve its source reference, image namespace, scan ranges, --only-verified/--debug where already selected, --fail/--no-update, triggers, permissions and failure gate. All caller action references were source-verified to use identical action.yml bytes that run IMAGE:VERSION.Evidence
git diff --checkpasses. Fresh independent P0–P2 review is scoped-clean.Exact source and artifact identities
Candidate
b543c79d3ff820a22212471b57df37959fede7d7, base4a8f491bebeca8adb6f492c209804855ef49f301, tree02291981ef3d0f8277f68fc5822c390e30d6b3e5. Workflow SHA2569d3c56f318ae4b93924d0b03ef2c8b0e70c7c620bb57dc92cf065e056e08c645.Captured canonical3.99.4 image index SHA256
bf9238f5bdf26ac28230d4b0bae5162a752b151bf10bea612dad7a62da938731; ARM64 image payloadb57ff51268b83496fd58889b252e61549cd1071467aed4f4706b1df53ec13150; AMD64 payload70b9108715250b19518b03acea56b2f4907a36dcfaaf77693444bdc007a761b1. Action body SHA256c3847cdbebcf469ef336c9b3f32dc6075ed65523e80e661cf404daebd57e5ba9. Qualification retains upstream +dirty/build-metadata limitations rather than claiming a reproducible source attestation.Inspectable additional validation evidence
Inspectable canonical scanner-image TLS observations
Exact consumer head
b543c79d3ff820a22212471b57df37959fede7d7;.github/workflows/secret-scan.ymlSHA2569d3c56f318ae4b93924d0b03ef2c8b0e70c7c620bb57dc92cf065e056e08c645selects TruffleHog3.99.4 through the unchanged action. These are reused actual qualified component/image observations, not a newly executed whole consumer workflow.The consumer action bytes and version input match the canonical Gitcrawl qualification. Existing exact-head consumer CI separately exercises the hosted scanner step. The normal upstream version tag remains mutable; this evidence identifies the tested artifact, not every historical runner cache.
Linux ARM64 actual OCI entrypoint
Image/binary identity:
{ "imageReference": "ghcr.io/trufflesecurity/trufflehog@sha256:adb1cb57ef6196ea097e86c8fdb18f9df327f3865b0444c313d0303efcd9702d", "binarySHA256": "b57ff51268b83496fd58889b252e61549cd1071467aed4f4706b1df53ec13150", "privateRequests": [ { "case": "private-CA", "bodySHA256": "d39a20381bef4f59ed806646d146317f79fdd63468bfd1949c4e0b7a05ff201c", "tls": "TLSv1.3" }, { "case": "git-verified-gate", "bodySHA256": "d39a20381bef4f59ed806646d146317f79fdd63468bfd1949c4e0b7a05ff201c", "tls": "TLSv1.3" } ], "syntheticRepo": { "base": "8fedc5b6baba0d5f4e447318ba223947ea62a5a7", "head": "e45261687ca9acb003eddbff6a6b74098c721688" }, "verdict": "passed-focused-image-entrypoint-and-git-gate", "limits": "LinuxARM64 actualimageentrypoint/customverifier only, not everybuiltin/externalclient/nativeAMD64image/fleet. DefaultUnknownIssuer is rejection notkey-specific; explicitoldCA retains exactobservedx509error." }Per-case actual verifier output, projected from retained JSON stdout (all record hashes retained locally):
Actual stderr/stdout examples are bounded below. The synthetic custom detector exercises the selected verifier; it is not a claim that every built-in detector/external transport is covered.
incident-00-oldCA stdout SHA256
adaeeb1fa983bb7ee3dd80f3cbfc3f4fae4030bb23e33ebcb98bd41a9445ff4b:{ "Verified": false, "VerificationError": "x509: no valid chains built", "VerificationFromCache": false }Linux AMD64 image ELF under full-system emulation
Image/binary identity:
{ "imageReference": "ghcr.io/trufflesecurity/trufflehog@sha256:a3a8f49c82805a99bba4cec01c0cce2f3daeaeb59884eef70aafc88715003d1e", "binarySHA256": "70b9108715250b19518b03acea56b2f4907a36dcfaaf77693444bdc007a761b1", "privateRequests": [ { "case": "private-CA", "bodySHA256": "d39a20381bef4f59ed806646d146317f79fdd63468bfd1949c4e0b7a05ff201c", "tls": "TLSv1.3" }, { "case": "git-verified-gate", "bodySHA256": "d39a20381bef4f59ed806646d146317f79fdd63468bfd1949c4e0b7a05ff201c", "tls": "TLSv1.3" } ], "syntheticRepo": { "base": "79afa832b8811f4aafdf60f23ea6644be8d69a3e", "head": "ca06eab2acd67b386b3ce69b91313ce63776a595" }, "verdict": "passed-extracted-amd64-image-native-custom-verifier-and-git-gate", "limits": "ExtractedactualLinuxAMD64imageELF runs infullsystemx86_64QEMUTCGguest; imageCAbundleexplicitfile/emptydir ratherthanOCIentrypoint. Notnativehardware/timing,notactualAMD64containerorallbuiltins/externalclient/fleet. DefaultUnknownIssuer is rejection notkey-specific; explicitoldCA retains exactobservedx509error." }Per-case actual verifier output, projected from retained JSON stdout (all record hashes retained locally):
Actual stderr/stdout examples are bounded below. The synthetic custom detector exercises the selected verifier; it is not a claim that every built-in detector/external transport is covered.
incident-00-oldCA stdout SHA256
92923f530253b8b73a3f2eaf55a315211e756b519914247b687a1971c8aaa0a9:{ "Verified": false, "VerificationError": "x509: no valid chains built", "VerificationFromCache": false }Historical-root bundle SHA256
c3aa6ce83618c247fdeb0afad3a4eb1d01da2eb9035defe70f74c4bbaaca986f. Existing matched historical-store controls established the fixture chains were valid/accepted before remediation. Default UnknownIssuer alone is not key-specific proof; explicit old-root-store failures carry the stronger evidence. No timeout, DNS error or setup failure is counted as rejection.ARM archive SHA256
ce12d49b56d5cb1ec2a3d9c9ae2add6e7d39e5d7104f3e2bca75fa2614118381; AMD archive6310c1d1299ea1b05af4fe2558e4b4dbcf67018e0fb03c28170f18caab0bbe39. No native AMD64 OCI entrypoint, native macOS/Windows, all-detector or fleet-delivery claim.Only synthetic loopback/private fixtures were used; loopback addresses are redacted in the projected traces.