Skip to content

build(deps): bump trufflesecurity/trufflehog from 3.95.6 to 3.95.8#37

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/trufflesecurity/trufflehog-3.95.8
Open

build(deps): bump trufflesecurity/trufflehog from 3.95.6 to 3.95.8#37
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/trufflesecurity/trufflehog-3.95.8

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 8, 2026

Copy link
Copy Markdown
Contributor

Bumps trufflesecurity/trufflehog from 3.95.6 to 3.95.8.

Release notes

Sourced from trufflesecurity/trufflehog's releases.

v3.95.8

What's Changed

Full Changelog: trufflesecurity/trufflehog@v3.95.7...v3.95.8

v3.95.7

What's Changed

New Contributors

Full Changelog: trufflesecurity/trufflehog@v3.95.6...v3.95.7

Commits
  • 00155c9 Include encoded resume info instead of clobbering it (#5110)
  • 4d3a66f fixed syntax error (#5109)
  • 797f02b [INS-334] Octopus Deploy detector (#4787)
  • 7f04a89 [INS-465] Skip unverified JWT Detector results when feature flag is enabled (...
  • 459d5a7 Add prometheus metrics for engine channels and workers (#5095)
  • f38f8f7 fix(azuresastoken): match SAS tokens regardless of parameter order (#5043)
  • 6261f5c removed "unauthorized" as exception for rotated graphana secrets (#5068)
  • f446421 [INS-407] Fixed AWS detector producing non deterministic output (#4836)
  • 885fa2d [INS-197] Add redhatpyxis api key detector (#4995)
  • c09d726 [INS-497] Add Pganalyze Read Key Detector (#4993)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
build(deps): bump trufflesecurity/trufflehog from 3.95.6 to 3.95.8
76cb4c7 
Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.6 to 3.95.8.
- [Release notes](https://github.com/trufflesecurity/trufflehog/releases)
- [Commits](trufflesecurity/trufflehog@v3.95.6...v3.95.8)

---
updated-dependencies:
- dependency-name: trufflesecurity/trufflehog
  dependency-version: 3.95.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 8, 2026
@dependabot dependabot Bot requested a review from a team as a code owner July 8, 2026 06:43
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 8, 2026
@dependabot dependabot Bot mentioned this pull request Jul 8, 2026
Closed
@github-actions github-actions Bot added the build label Jul 8, 2026
@clawsweeper

clawsweeper Bot commented Jul 8, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex review: needs maintainer review before merge. Reviewed July 8, 2026, 2:47 AM ET / 06:47 UTC.

Summary
The PR updates .github/workflows/secret-scan.yml to use trufflesecurity/trufflehog@v3.95.8 instead of v3.95.6.

Reproducibility: not applicable. This is a dependency update PR, and the review checked the workflow diff, current main, upstream tag, and PR check rollup rather than reproducing a product bug.

Review metrics: 2 noteworthy metrics.

  • Workflow ref changed: 1 file changed, 1 insertion, 1 deletion. The entire PR surface is one GitHub Action version reference in the secret-scan workflow.
  • Check rollup: 12 successful, 1 skipped. The updated workflow path, CI, CodeQL, and security checks completed without failures on the PR head.

Root-cause cluster
Relationship: canonical
Canonical: #37
Summary: This PR is the live canonical Dependabot bump from TruffleHog v3.95.6 to v3.95.8, and the older v3.95.7 PR was closed as superseded.

Members:

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🦞 diamond lobster
Proof: 🌊 off-meta tidepool
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Risk before merge

  • [P1] The only residual uncertainty is ordinary trust in the upstream TruffleHog patch release; the workflow permissions and inputs are unchanged, and the updated secret-scan job completed successfully on the PR.

Maintainer options:

  1. Decide the mitigation before merge
    Merge the clean Dependabot patch if maintainers are comfortable taking TruffleHog v3.95.8; otherwise let Dependabot recreate or advance the GitHub Actions bump.
  2. Pause or close
    Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

  • [P2] No repair lane is needed because there are no review findings; this can proceed through ordinary maintainer review and merge checks.

Security
Cleared: The diff only advances an existing TruffleHog GitHub Action ref under unchanged read-only workflow permissions and adds no scripts, secrets, or broader permissions.

Review details

Best possible solution:

Merge the clean Dependabot patch if maintainers are comfortable taking TruffleHog v3.95.8; otherwise let Dependabot recreate or advance the GitHub Actions bump.

Do we have a high-confidence way to reproduce the issue?

Not applicable. This is a dependency update PR, and the review checked the workflow diff, current main, upstream tag, and PR check rollup rather than reproducing a product bug.

Is this the best way to solve the issue?

Yes. A one-line version bump in the existing secret-scan workflow is the narrowest maintainable path for this patch update.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning high; reviewed against b5c480e0492b.

Label changes

Label changes:

  • add P3: This is a low-risk Dependabot patch update to an existing GitHub Actions security-scan dependency.
  • add rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🌊 off-meta tidepool and patch quality is 🦞 diamond lobster.
  • add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Not applicable because this is a Dependabot bot dependency bump; the PR check rollup shows the updated secret-scan workflow completed successfully.

Label justifications:

  • P3: This is a low-risk Dependabot patch update to an existing GitHub Actions security-scan dependency.
  • rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🌊 off-meta tidepool and patch quality is 🦞 diamond lobster.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Not applicable because this is a Dependabot bot dependency bump; the PR check rollup shows the updated secret-scan workflow completed successfully.
Evidence reviewed

What I checked:

  • current main still uses old action: Current main references trufflesecurity/trufflehog@v3.95.6 at the TruffleHog OSS step, so the requested bump is not already implemented. (.github/workflows/secret-scan.yml:52, b5c480e0492b)
  • PR head applies the requested patch bump: The PR head changes the same action reference to trufflesecurity/trufflehog@v3.95.8 and leaves the workflow inputs unchanged. (.github/workflows/secret-scan.yml:52, 76cb4c739c4d)
  • PR state and checks: GitHub reports the PR as mergeable, with CI, CodeQL, Socket, and both secret-scan check runs successful and only the release-draft update skipped. (76cb4c739c4d)
  • upstream tag check: The upstream TruffleHog repository has tags for both v3.95.6 and v3.95.8, and v3.95.8 resolves to commit 00155c9dc586f34d189adc83d3ac2698c2ec551f. (00155c9dc586)
  • older Dependabot bump is superseded: The earlier v3.95.7 Dependabot PR is closed unmerged, and Dependabot commented that it was superseded by this PR. (3dbb0ee4735e)
  • workflow ownership and history: CODEOWNERS routes workflow changes to @openclaw/openclaw-secops; git history shows the workflow was introduced in 2cc577b8 and later hardened in 4156d9f6. (.github/CODEOWNERS:5, b5c480e0492b)

Likely related people:

  • Peter Steinberger: Git blame and file history show this author introduced the secret-scan workflow, Dependabot config, and CODEOWNERS routing in the v0.3.1 preparation commit. (role: introduced behavior; confidence: high; commits: 2cc577b8ebf4; files: .github/workflows/secret-scan.yml, .github/dependabot.yml, .github/CODEOWNERS)
  • Vincent Koc: Recent history shows this author hardened the secret-scan workflow after the initial release commit, and the live PR is assigned to this account. (role: recent area contributor; confidence: high; commits: 4156d9f6390d; files: .github/workflows/secret-scan.yml)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@clawsweeper clawsweeper Bot added rating: 🦞 diamond lobster Very strong PR readiness with only minor maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. labels Jul 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@vincentkoc vincentkoc

Labels

build dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. rating: 🦞 diamond lobster Very strong PR readiness with only minor maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@vincentkoc