Skip to content

chore(deps): bump trufflesecurity/trufflehog from 3.95.6 to 3.95.8#61

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/trufflesecurity/trufflehog-3.95.8
Open

chore(deps): bump trufflesecurity/trufflehog from 3.95.6 to 3.95.8#61
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/trufflesecurity/trufflehog-3.95.8

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 8, 2026

Copy link
Copy Markdown
Contributor

Bumps trufflesecurity/trufflehog from 3.95.6 to 3.95.8.

Release notes

Sourced from trufflesecurity/trufflehog's releases.

v3.95.8

What's Changed

Full Changelog: trufflesecurity/trufflehog@v3.95.7...v3.95.8

v3.95.7

What's Changed

New Contributors

Full Changelog: trufflesecurity/trufflehog@v3.95.6...v3.95.7

Commits
  • 00155c9 Include encoded resume info instead of clobbering it (#5110)
  • 4d3a66f fixed syntax error (#5109)
  • 797f02b [INS-334] Octopus Deploy detector (#4787)
  • 7f04a89 [INS-465] Skip unverified JWT Detector results when feature flag is enabled (...
  • 459d5a7 Add prometheus metrics for engine channels and workers (#5095)
  • f38f8f7 fix(azuresastoken): match SAS tokens regardless of parameter order (#5043)
  • 6261f5c removed "unauthorized" as exception for rotated graphana secrets (#5068)
  • f446421 [INS-407] Fixed AWS detector producing non deterministic output (#4836)
  • 885fa2d [INS-197] Add redhatpyxis api key detector (#4995)
  • c09d726 [INS-497] Add Pganalyze Read Key Detector (#4993)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
chore(deps): bump trufflesecurity/trufflehog from 3.95.6 to 3.95.8
e0e1699 
Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.6 to 3.95.8.
- [Release notes](https://github.com/trufflesecurity/trufflehog/releases)
- [Commits](trufflesecurity/trufflehog@v3.95.6...v3.95.8)

---
updated-dependencies:
- dependency-name: trufflesecurity/trufflehog
  dependency-version: 3.95.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 8, 2026
@dependabot dependabot Bot requested a review from a team as a code owner July 8, 2026 02:53
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 8, 2026
@dependabot dependabot Bot mentioned this pull request Jul 8, 2026
Closed
@github-actions github-actions Bot added the chore label Jul 8, 2026
@clawsweeper

clawsweeper Bot commented Jul 8, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex review: needs maintainer review before merge. Reviewed July 7, 2026, 10:57 PM ET / 02:57 UTC.

Summary
The branch updates the TruffleHog GitHub Action in .github/workflows/secret-scan.yml from v3.95.6 to v3.95.8.

Reproducibility: not applicable. this is a dependency maintenance PR, not a bug report with runtime reproduction steps. The relevant verification is source review, upstream tag presence, and GitHub workflow checks on the PR head.

Review metrics: 1 noteworthy metric.

  • Workflow action refs: 1 changed. The only behavior change is the TruffleHog GitHub Action version used by the secret-scan workflow.

Root-cause cluster
Relationship: canonical
Canonical: #61
Summary: This PR is the active canonical TruffleHog v3.95.8 bump; the earlier v3.95.7 Dependabot PR was closed as superseded, and older TruffleHog updates are adjacent dependency history.

Members:

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • none.

Next step before merge

  • [P2] No repair job is needed because the branch is a narrow one-line Dependabot update with green checks and no actionable findings.

Security
Cleared: The diff only updates an existing third-party action tag under the current permissions and adds no secrets, broader permissions, scripts, lockfile changes, or publishing behavior.

Review details

Best possible solution:

Merge the narrow Dependabot bump through the normal maintainer dependency-review path while preserving the existing workflow permissions and scan-range behavior.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a dependency maintenance PR, not a bug report with runtime reproduction steps. The relevant verification is source review, upstream tag presence, and GitHub workflow checks on the PR head.

Is this the best way to solve the issue?

Yes: updating the existing action reference is the narrowest maintainable way to take this TruffleHog patch release. The PR does not introduce a parallel workflow, new permissions, or new configuration surface.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning high; reviewed against 7754b9d416df.

Label changes

Label changes:

  • add P3: This is a low-risk dependency maintenance PR with a one-line GitHub Actions version bump and green checks.
  • add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
  • add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Contributor proof is not required for this Dependabot bot dependency bump; source review, upstream tag presence, and successful GitHub checks are the relevant validation signal.

Label justifications:

  • P3: This is a low-risk dependency maintenance PR with a one-line GitHub Actions version bump and green checks.
  • rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Contributor proof is not required for this Dependabot bot dependency bump; source review, upstream tag presence, and successful GitHub checks are the relevant validation signal.
Evidence reviewed

What I checked:

  • Current main source: Current main still uses trufflesecurity/trufflehog@v3.95.6 in the verified secret-scan workflow, so the requested bump is not already implemented. (.github/workflows/secret-scan.yml:52, 7754b9d416df)
  • PR diff: The PR changes only the existing TruffleHog action reference from v3.95.6 to v3.95.8. (.github/workflows/secret-scan.yml:52, e0e169971dc8)
  • PR checks: GitHub reports the PR as mergeable, with CI, CodeQL, Socket, and both secret-scanning check runs successful on the PR head. (e0e169971dc8)
  • Upstream action tag: The upstream TruffleHog repository has the requested v3.95.8 tag, resolving to commit 00155c9dc586f34d189adc83d3ac2698c2ec551f. (00155c9dc586)
  • Related dependency PR: The previous v3.95.7 Dependabot PR is closed unmerged, and Dependabot commented that it was superseded by this PR. (c93e84ded81e)
  • Workflow ownership: CODEOWNERS routes .github/workflows/ changes to @openclaw/openclaw-secops, which is relevant maintainer review context for this security workflow dependency update. (.github/CODEOWNERS:5, 7754b9d416df)

Likely related people:

  • vincentkoc: Git history shows this person introduced the verified secret-scanning workflow and protected automation ownership for this workflow surface. (role: introduced behavior; confidence: high; commits: b5e289c4bd77, 54e6b97d0d60; files: .github/workflows/secret-scan.yml, .github/CODEOWNERS)
  • steipete: Local history and blame show recent maintenance-tooling updates in the workflow area, including the current TruffleHog v3.95.6 pin. (role: recent area contributor; confidence: high; commits: 9e078d5be63f, 5637c35da08a; files: .github/workflows/secret-scan.yml, .github/workflows/ci.yml, .github/workflows/codeql.yml)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@clawsweeper clawsweeper Bot added rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. labels Jul 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@vincentkoc vincentkoc

Labels

chore dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@vincentkoc