Skip to content

build(deps): bump trufflesecurity/trufflehog from 3.95.9 to 3.96.0 - #135

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/trufflesecurity/trufflehog-3.96.0
Open

build(deps): bump trufflesecurity/trufflehog from 3.95.9 to 3.96.0#135
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/trufflesecurity/trufflehog-3.96.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 30, 2026

Copy link
Copy Markdown
Contributor

Bumps trufflesecurity/trufflehog from 3.95.9 to 3.96.0.

Release notes

Sourced from trufflesecurity/trufflehog's releases.

v3.96.0

What's Changed

New Contributors

Full Changelog: trufflesecurity/trufflehog@v3.95.9...v3.96.0

Commits
  • 6f3c981 fix(handlers): apk handler now doesnt check for apk extension since json-enum...
  • 05a5832 fix(detectors/posthog): widen phx_ key body to {43,48} (#5133)
  • a2ef4f5 [chore] Change job_id in metric to source_type (#5149)
  • e74404a updated detector to include underscore char (#5121)
  • 4d82f21 Fix scan_all_installations Rejecting Org Member Personal Repos (#5142)
  • 38999f8 Retry git clone on transient network errors (#5132)
  • 0eb1a81 Update module github.com/go-git/go-git/v5 to v5.19.1 [SECURITY] (#5034)
  • ec20cb3 document Config.SourceManager (#5002)
  • 4ecd7d5 Log analyze errors for HuggingFace analyzer (#5130)
  • 1247638 Log analyze errors for Postgres analyzer (#5131)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
build(deps): bump trufflesecurity/trufflehog from 3.95.9 to 3.96.0
68f3ad0 
Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.95.9 to 3.96.0.
- [Release notes](https://github.com/trufflesecurity/trufflehog/releases)
- [Commits](trufflesecurity/trufflehog@v3.95.9...v3.96.0)

---
updated-dependencies:
- dependency-name: trufflesecurity/trufflehog
  dependency-version: 3.96.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 30, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner July 30, 2026 18:44
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 30, 2026
@clawsweeper clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. merge-risk: 🚨 automation 🚨 Merging this PR could break CI, automerge, proof capture, label sync, or automation. labels Jul 30, 2026
@clawsweeper

clawsweeper Bot commented Jul 30, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex review: needs maintainer review before merge. Reviewed August 1, 2026, 5:22 PM ET / 21:22 UTC.

ClawSweeper review

What this changes

Updates the TruffleHog GitHub Action used by the repository’s verified-secret scan from v3.95.9 to v3.96.0.

Merge readiness

⛔ Blocked until real behavior proof from a real setup is added - 5 items remain

This PR remains necessary because current main still runs TruffleHog v3.95.9. The one-line update is clean and its workflow check passed, but it changes third-party executable code in the verified-secret scan, so a human should explicitly accept the upstream v3.96.0 trust boundary before merge.

Priority: P3
Reviewed head: 68f3ad017cc08dec6621daf3fdbdcb130257d652
Owner decision: Required. See Decision needed.

Review scores

Measure Result What it means
Overall readiness 🦪 silver shellfish (2/6) The patch is focused and passes its relevant workflow checks, but real-behavior evidence is limited to CI and the action-release trust decision remains open.
Proof confidence 🦪 silver shellfish (2/6) Needs real behavior proof before merge: The PR has successful GitHub Actions secret-scan checks, but its body provides no independent after-fix runtime artifact beyond CI; maintainer release-provenance review remains necessary before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality 🐚 platinum hermit (4/6) Security review found an item that needs attention.

Verification

Check Result Evidence
Real behavior Needs proof Needs real behavior proof before merge: The PR has successful GitHub Actions secret-scan checks, but its body provides no independent after-fix runtime artifact beyond CI; maintainer release-provenance review remains necessary before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed 7 items Current main still uses the old action version: The current default-branch workflow invokes trufflesecurity/trufflehog@v3.95.9; this PR’s requested update is not already implemented on main.
Patch scope is one executable workflow reference: The proposed branch changes only the TruffleHog action reference from v3.95.9 to v3.96.0; its inputs, permissions, scan range, and failure handling remain unchanged.
Workflow preserves a constrained token boundary: The workflow sets no global permissions and grants the scan job only contents: read; the update nevertheless selects new third-party action code to execute within that boundary.
Findings None None.
Security Needs attention Review the newly selected action release: Changing the TruffleHog version tag changes the executable code fetched by the workflow. The job is constrained to contents: read, but green checks do not independently establish trust in the upstream v3.96.0 release.

How this fits together

The secret-scanning workflow runs on pushes and pull requests, checks out the repository, determines a commit range, and invokes TruffleHog for verified credentials. Its result gates changes by failing when a verified secret is found.

flowchart LR
  A[Push or pull request] --> B[Secret-scanning workflow]
  B --> C[Checkout repository]
  C --> D[Resolve commit range]
  D --> E[TruffleHog action]
  E --> F[Verified-secret result]
  F --> G[Pass or block change]
Loading

Decision needed

Question Recommendation
Should the repository accept TruffleHog v3.96.0 as the executable third-party action for verified-secret scans? Approve the v3.96.0 action release: Verify the upstream release provenance and accept the version-tagged action update under the existing workflow pinning pattern.

Why: The patch is mechanically narrow, but selecting a new action release is an intentional supply-chain trust decision that source review and green workflow checks cannot make on behalf of maintainers.

Before merge

  • Resolve security concern: Review the newly selected action release - Changing the TruffleHog version tag changes the executable code fetched by the workflow. The job is constrained to contents: read, but green checks do not independently establish trust in the upstream v3.96.0 release.
  • Resolve merge risk (P1) - Merging changes the version-tagged third-party action code that executes in the repository’s verified-secret scan; successful CI proves execution, not independent approval of the upstream v3.96.0 release.
  • Resolve merge risk (P1) - The partial clone and unavailable upstream host prevented an independent fetch of older workflow history or upstream release provenance during this review.
  • Complete next step (P2) - No code repair is needed; a human must decide whether to trust and accept the new third-party action release.

Findings

  • [medium] Review the newly selected action release — .github/workflows/secret-scan.yml:52
Agent review details

Security

Needs attention: The patch changes a third-party GitHub Action release that executes during secret scanning, so upstream provenance needs maintainer acceptance before merge.

Review metrics

Metric Value Why it matters
Workflow surface 1 file changed; 1 line updated The entire patch changes the executable dependency used by the verified-secret scan.
Observed scan runs 2 successful secret-scan checks The supplied PR checks show the updated action ran successfully on the proposed head.

Merge-risk options

Maintainer options:

  1. Verify and accept the upstream action release (recommended)
    A workflow/security owner should review the TruffleHog v3.96.0 provenance and approve the new executable action version before merge.
  2. Pause for immutable-pinning policy
    Defer this bump if maintainers want SHA-pinned GitHub Actions rather than continuing the repository’s current version-tag pattern.

Technical review

Best possible solution:

Have a workflow/security owner verify the upstream v3.96.0 release provenance and intended behavior, then merge this narrow Dependabot update if that trust decision is accepted.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a GitHub Actions dependency update rather than a report of broken product behavior. The supplied successful secret-scan checks do show the proposed workflow executes on the PR head.

Is this the best way to solve the issue?

Yes, conditionally: updating the existing single action reference is the narrowest maintainable path, but accepting an upstream executable release requires a maintainer trust decision.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning high; reviewed against dcdf94703540.

Labels

Label justifications:

  • P3: This is a contained maintenance update with no demonstrated user-facing regression.
  • merge-risk: 🚨 security-boundary: The patch selects a new release of third-party code that executes in the repository’s security-scanning workflow.
  • rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
  • status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR has successful GitHub Actions secret-scan checks, but its body provides no independent after-fix runtime artifact beyond CI; maintainer release-provenance review remains necessary before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

Security concerns:

  • [medium] Review the newly selected action release — .github/workflows/secret-scan.yml:52
    Changing the TruffleHog version tag changes the executable code fetched by the workflow. The job is constrained to contents: read, but green checks do not independently establish trust in the upstream v3.96.0 release.
    Confidence: 0.96

What I checked:

  • Current main still uses the old action version: The current default-branch workflow invokes trufflesecurity/trufflehog@v3.95.9; this PR’s requested update is not already implemented on main. (.github/workflows/secret-scan.yml:52, dcdf94703540)
  • Patch scope is one executable workflow reference: The proposed branch changes only the TruffleHog action reference from v3.95.9 to v3.96.0; its inputs, permissions, scan range, and failure handling remain unchanged. (.github/workflows/secret-scan.yml:52, 68f3ad017cc0)
  • Workflow preserves a constrained token boundary: The workflow sets no global permissions and grants the scan job only contents: read; the update nevertheless selects new third-party action code to execute within that boundary. (.github/workflows/secret-scan.yml:9, dcdf94703540)
  • Current action reference provenance: Blame attributes the existing TruffleHog reference to the v0.8.7 release-preparation commit, making Peter Steinberger the strongest available history route for this workflow surface. (.github/workflows/secret-scan.yml:52, 4f737bb846e0)
  • Release provenance for the existing workflow: The commit that introduced the currently pinned reference is contained in release v0.8.7. (.github/workflows/secret-scan.yml:52, 4f737bb846e0)
  • Observed after-change CI execution: The supplied PR check data records successful Scan for Verified Secrets runs at the proposed head, which shows the updated workflow executed successfully in GitHub Actions. (68f3ad017cc0)

Likely related people:

  • Peter Steinberger: Git blame attributes the existing TruffleHog workflow reference to the v0.8.7 release-preparation commit. (role: current action-reference introducer; confidence: high; commits: 4f737bb846e0; files: .github/workflows/secret-scan.yml)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

  • Attach or link a redacted workflow-run artifact showing the v3.96.0 action execution if a maintainer wants proof beyond check status.
  • Have a workflow/security owner verify the upstream release provenance before merge.

Rating scale

Score Internal tier Crab rank Meaning
6/6 S 🦀 challenger crab Exceptional readiness
5/6 A 🦞 diamond lobster Very strong readiness
4/6 B 🐚 platinum hermit Good normal PR; ordinary maintainer review
3/6 C 🦐 gold shrimp Useful, but confidence is limited
2/6 D 🦪 silver shellfish Proof or implementation needs work
1/6 F 🧂 unranked krab Not merge-ready
N/A NA 🌊 off-meta tidepool Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (13 earlier review cycles; latest 8 shown)
  • reviewed 2026-07-31T18:17:54.908Z sha 68f3ad0 :: needs maintainer review before merge. :: none
  • reviewed 2026-07-31T21:16:17.302Z sha 68f3ad0 :: needs maintainer review before merge. :: none
  • reviewed 2026-08-01T05:08:02.048Z sha 68f3ad0 :: needs maintainer review before merge. :: none
  • reviewed 2026-08-01T11:18:05.399Z sha 68f3ad0 :: needs maintainer review before merge. :: none
  • reviewed 2026-08-01T13:11:22.714Z sha 68f3ad0 :: needs maintainer review before merge. :: none
  • reviewed 2026-08-01T16:15:05.938Z sha 68f3ad0 :: needs maintainer review before merge. :: none
  • reviewed 2026-08-01T17:34:09.742Z sha 68f3ad0 :: needs maintainer review before merge. :: none
  • reviewed 2026-08-01T20:14:25.612Z sha 68f3ad0 :: needs maintainer review before merge. :: none

@clawsweeper clawsweeper Bot added rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. merge-risk: 🚨 security-boundary 🚨 Merging this PR could weaken sandboxing, authorization, credentials, or sensitive data. proof: sufficient Contributor real behavior proof is sufficient. and removed rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. merge-risk: 🚨 automation 🚨 Merging this PR could break CI, automerge, proof capture, label sync, or automation. proof: sufficient Contributor real behavior proof is sufficient. labels Jul 30, 2026
@clawsweeper clawsweeper Bot added status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. and removed rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels Aug 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code merge-risk: 🚨 security-boundary 🚨 Merging this PR could weaken sandboxing, authorization, credentials, or sensitive data. P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants