Skip to content

build(deps): bump trufflesecurity/trufflehog from 3.95.3 to 3.95.5 in the github-actions group - #140

Merged
steipete merged 1 commit into
mainfrom
dependabot/github_actions/github-actions-94486116bf
Jun 15, 2026
Merged

build(deps): bump trufflesecurity/trufflehog from 3.95.3 to 3.95.5 in the github-actions group#140
steipete merged 1 commit into
mainfrom
dependabot/github_actions/github-actions-94486116bf

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 15, 2026

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 1 update: trufflesecurity/trufflehog.

Updates trufflesecurity/trufflehog from 3.95.3 to 3.95.5

Release notes

Sourced from trufflesecurity/trufflehog's releases.

v3.95.5

What's Changed

New Contributors

Full Changelog: trufflesecurity/trufflehog@v3.95.3...v3.95.5

v3.95.4

What's Changed

... (truncated)

Commits
  • d411fff feat(apk): adds some debugging info for APKs and fixes issues parsing obfusca...
  • 26eae1f [SCAN-795] HTML decoder: ASPX and entity-encoded HTML support (#4981)
  • 6c8f640 Added source config flags to sharepoint proto (#4972)
  • 9f0b97f Update CODEOWNERS: replace 5 slugs with scanning + integrations (#4983)
  • 36f6f69 Pin GitHub Actions to SHA digests (#4985)
  • 52ebebb Update Go security dependencies (#4986)
  • ec67ff2 Add feature flags for Pinecone, Cloudinary, and GitLab OAuth detectors (#4961)
  • 0ec3634 Fix line numbers for duplicate secrets within a chunk (#4910)
  • 79acbf4 Remove over speculation from Corpora CI workflow (#4974)
  • d86254e feat: add host, db and username to ExtraData for database detectors (#4849)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump trufflesecurity/trufflehog in the github-actions group
680f958 
Bumps the github-actions group with 1 update: [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog).


Updates `trufflesecurity/trufflehog` from 3.95.3 to 3.95.5
- [Release notes](https://github.com/trufflesecurity/trufflehog/releases)
- [Commits](trufflesecurity/trufflehog@v3.95.3...v3.95.5)

---
updated-dependencies:
- dependency-name: trufflesecurity/trufflehog
  dependency-version: 3.95.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from a team as a code owner June 15, 2026 16:10
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jun 15, 2026
@clawsweeper

clawsweeper Bot commented Jun 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge. Reviewed June 15, 2026, 12:51 PM ET / 16:51 UTC.

Summary
The branch updates .github/workflows/secret-scan.yml to use trufflesecurity/trufflehog@v3.95.5 instead of v3.95.3.

Reproducibility: not applicable. this is a dependency maintenance PR, not a reported runtime bug. The relevant verification is source, diff, upstream tag, and CI inspection.

Review metrics: 2 noteworthy metrics.

  • Workflow files changed: 1 changed. The patch is isolated to the secret-scan GitHub Actions workflow.
  • Upstream action metadata matches: 0 matched. No upstream action metadata path matched the compare scan, reducing concern that the action invocation contract changed.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • none.

Next step before merge

  • No ClawSweeper repair lane is needed; the PR is ready for ordinary maintainer dependency-update handling.

Security
Cleared: No concrete security or supply-chain regression was found in the one-line TruffleHog action patch bump.

Review details

Best possible solution:

Keep the narrow dependency update open for normal maintainer review and merge it if the clean merge state and passing checks remain acceptable.

Do we have a high-confidence way to reproduce the issue?

Not applicable; this is a dependency maintenance PR, not a reported runtime bug. The relevant verification is source, diff, upstream tag, and CI inspection.

Is this the best way to solve the issue?

Yes; the one-line action-version bump is the narrowest maintainable way to apply this Dependabot update.

AGENTS.md: found, but no applicable review policy affected this item.

Codex review notes: model internal, reasoning high; reviewed against a4b5efd0981a.

Label changes

Label justifications:

  • P3: This is a low-risk patch-level GitHub Actions dependency update with a one-line workflow diff and passing checks.
  • rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Dependabot-authored dependency bump; the external contributor real behavior proof gate does not apply.
Evidence reviewed

What I checked:

  • Current main still has the old action tag: Line 49 on current main references trufflesecurity/trufflehog@v3.95.3, so the requested dependency update has not already landed. (.github/workflows/secret-scan.yml:49, a4b5efd0981a)
  • PR diff is isolated: The PR diff changes only the TruffleHog action version line from v3.95.3 to v3.95.5. (.github/workflows/secret-scan.yml:49, 680f95892108)
  • Workflow provenance: git blame attributes the existing secret-scan workflow and action invocation to the v0.6.0 release commit. (.github/workflows/secret-scan.yml:49, 17944c1e97b1)
  • PR status: GitHub reports the PR as mergeable and clean, with CI, CodeQL, and secret-scan check runs successful on the PR head. (680f95892108)
  • Upstream tag check: The upstream tags for v3.95.3 and v3.95.5 both resolve, and v3.95.5 points at upstream commit d411fff7b8879a62509f3fa98c07f247ac089a51. (d411fff7b887)
  • Upstream action interface scan: The upstream compare covers 20 commits and 300 files, but no action.yml, action.yaml, or .github/actions/** paths matched the changed-file scan. (d411fff7b887)

Likely related people:

  • steipete: git blame, git log --follow, and GitHub commit metadata show the secret-scan workflow and Dependabot configuration were introduced in the v0.6.0 release commit by this author. (role: introduced workflow; confidence: high; commits: 17944c1e97b1; files: .github/workflows/secret-scan.yml, .github/dependabot.yml)
  • vincentkoc: Repository history shows prior adjacent work on security hardening workflows under .github/workflows, which is relevant routing context for CI security automation. (role: adjacent security workflow contributor; confidence: medium; commits: e4a60f499475, 65e44128eac7; files: .github/workflows)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@clawsweeper clawsweeper Bot added rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. labels Jun 15, 2026
@steipete
steipete merged commit 3753a33 into main Jun 15, 2026
6 checks passed
@steipete
steipete deleted the dependabot/github_actions/github-actions-94486116bf branch June 15, 2026 21:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@steipete