build(deps): bump the github-actions group with 3 updates

[dependabot]

Bumps the github-actions group with 3 updates: github/codeql-action/init, github/codeql-action/analyze and trufflesecurity/trufflehog.

Updates github/codeql-action/init from 4.36.2 to 4.36.3

Release notes

Sourced from github/codeql-action/init's releases.

v4.36.3

No user facing changes.

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

• Cache CodeQL CLI version information across Actions steps. #3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
• Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

• Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
• Add support for SHA-256 Git object IDs. #3893
• Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

• We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899
• For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791
• If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892
• Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

4.35.4 - 07 May 2026

• Update default CodeQL bundle version to 2.25.4. #3881

4.35.3 - 01 May 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837
• Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850
• Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853
• Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852
• Update default CodeQL bundle version to 2.25.3. #3865

4.35.2 - 15 Apr 2026

• The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #3795

... (truncated)

Commits

• 54f647b Merge pull request #3984 from github/update-v4.36.3-1f34ec164
• e78819e Trigger checks
• 2c9d3d6 Update changelog for v4.36.3
• 1f34ec1 Merge pull request #3983 from github/mbg/repo-props/ff-for-config-file-prop
• d5f0145 Log when repository property has a value but is ignored
• f27f563 Add test for when the FF is off
• 0025d0f Use FF
• f7fa18f Add FF for config file repo property
• 628fc3f Merge pull request #3979 from github/henrymercer/overlay-db-cleanup-size-tele...
• 9cfb67b Add clarifying comments
• Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.36.2 to 4.36.3

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.36.3

No user facing changes.

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

• Cache CodeQL CLI version information across Actions steps. #3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
• Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

• Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
• Add support for SHA-256 Git object IDs. #3893
• Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

• We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899
• For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791
• If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892
• Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

4.35.4 - 07 May 2026

• Update default CodeQL bundle version to 2.25.4. #3881

4.35.3 - 01 May 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837
• Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850
• Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853
• Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852
• Update default CodeQL bundle version to 2.25.3. #3865

4.35.2 - 15 Apr 2026

• The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #3795

... (truncated)

Commits

• 54f647b Merge pull request #3984 from github/update-v4.36.3-1f34ec164
• e78819e Trigger checks
• 2c9d3d6 Update changelog for v4.36.3
• 1f34ec1 Merge pull request #3983 from github/mbg/repo-props/ff-for-config-file-prop
• d5f0145 Log when repository property has a value but is ignored
• f27f563 Add test for when the FF is off
• 0025d0f Use FF
• f7fa18f Add FF for config file repo property
• 628fc3f Merge pull request #3979 from github/henrymercer/overlay-db-cleanup-size-tele...
• 9cfb67b Add clarifying comments
• Additional commits viewable in compare view

Updates trufflesecurity/trufflehog from 3.95.6 to 3.95.8

Release notes

Sourced from trufflesecurity/trufflehog's releases.

v3.95.8

What's Changed

• removed "unauthorized" as exception for rotated graphana secrets by @​jordanTunstill in trufflesecurity/trufflehog#5068
• fix(azuresastoken): match SAS tokens regardless of parameter order by @​genisis0x in trufflesecurity/trufflehog#5043
• Add prometheus metrics for engine channels and workers by @​mcastorina in trufflesecurity/trufflehog#5095
• [INS-465] Skip unverified JWT Detector results when feature flag is enabled by @​MuneebUllahKhan222 in trufflesecurity/trufflehog#5072
• [INS-334] Octopus Deploy detector by @​MuneebUllahKhan222 in trufflesecurity/trufflehog#4787
• Fix Syntax error in feature.go by @​MuneebUllahKhan222 in trufflesecurity/trufflehog#5109
• Include encoded resume info instead of clobbering it by @​bill-rich in trufflesecurity/trufflehog#5110

Full Changelog: trufflesecurity/trufflehog@v3.95.7...v3.95.8

v3.95.7

What's Changed

• fix(sources/filesystem): order resume comparison by path component by @​genisis0x in trufflesecurity/trufflehog#5041
• test(handlers): point APK test fixture at trufflehog-test-assets by @​amanfcp in trufflesecurity/trufflehog#5053
• fixed regex typo that was causing conf uuid's to be surfaced as non-live atlassian secrets. by @​jordanTunstill in trufflesecurity/trufflehog#5029
• Fix GitHub App cross-org member enumeration using per-installation tokens by @​dustin-decker in trufflesecurity/trufflehog#4774
• fix: add git worktree support in PrepareRepo by @​andoniaf in trufflesecurity/trufflehog#4690
• [INS-406] Braintrust detector by @​MuneebUllahKhan222 in trufflesecurity/trufflehog#4826
• huggingface: add bucket scanning by @​julien-c in trufflesecurity/trufflehog#5017
• Skip reverification results during deduplication by @​mcastorina in trufflesecurity/trufflehog#5069
• chore(renovate): bump shared config to v1.0.3 by @​bryanbeverly in trufflesecurity/trufflehog#5044
• Add scan_all_installations option for multi-org GitHub App scanning by @​dustin-decker in trufflesecurity/trufflehog#4775
• Expose SecretParts in the JSON output by @​bradlarsen in trufflesecurity/trufflehog#5073
• [INS-497] Add Pganalyze Read Key Detector by @​MuneebUllahKhan222 in trufflesecurity/trufflehog#4993
• [INS-197] Add redhatpyxis api key detector by @​MuneebUllahKhan222 in trufflesecurity/trufflehog#4995
• [INS-407] Fixed AWS detector producing non deterministic output by @​MuneebUllahKhan222 in trufflesecurity/trufflehog#4836

New Contributors

• @​genisis0x made their first contribution in trufflesecurity/trufflehog#5041
• @​andoniaf made their first contribution in trufflesecurity/trufflehog#4690
• @​julien-c made their first contribution in trufflesecurity/trufflehog#5017

Full Changelog: trufflesecurity/trufflehog@v3.95.6...v3.95.7

Commits

• 00155c9 Include encoded resume info instead of clobbering it (#5110)
• 4d3a66f fixed syntax error (#5109)
• 797f02b [INS-334] Octopus Deploy detector (#4787)
• 7f04a89 [INS-465] Skip unverified JWT Detector results when feature flag is enabled (...
• 459d5a7 Add prometheus metrics for engine channels and workers (#5095)
• f38f8f7 fix(azuresastoken): match SAS tokens regardless of parameter order (#5043)
• 6261f5c removed "unauthorized" as exception for rotated graphana secrets (#5068)
• f446421 [INS-407] Fixed AWS detector producing non deterministic output (#4836)
• 885fa2d [INS-197] Add redhatpyxis api key detector (#4995)
• c09d726 [INS-497] Add Pganalyze Read Key Detector (#4993)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 9, 2026, 10:43 AM ET / 14:43 UTC.

Summary
The branch bumps two CodeQL action refs to v4.36.3 and TruffleHog to v3.95.8 across the CodeQL and secret-scanning workflows.

Reproducibility: not applicable. This PR is a maintenance dependency bump, and the changed workflow behavior is exercised by successful CodeQL and secret-scan runs on the PR head.

Review metrics: 3 noteworthy metrics.

• Workflow files changed: 2 modified, 0 added, 0 removed. Both touched files are CI/security automation workflows, so review focus is action behavior and supply-chain impact.
• Action refs bumped: 3 updated. All functional changes are action version/ref updates with no workflow logic or permission changes.
• Relevant workflow runs: 4 successful job runs. The PR head ran the updated CodeQL and secret-scanning workflows successfully in GitHub Actions.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster ✨ media proof bonus
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• [P2] Have the security automation owner confirm the upstream action trust decision before merge.

Risk before merge

• [P1] Merging changes executable GitHub Actions code used by CodeQL and TruffleHog; the current runs passed, but the upstream action trust decision belongs to the security automation owner.
• [P1] TruffleHog patch releases include detector and scan-behavior changes, so future secret-scan results may differ even though this PR's scan passed.

Maintainer options:

1. Merge after secops approval (recommended)
   Merge once @openclaw/openclaw-secops is satisfied with the upstream action releases and the passing workflow runs.
2. Hold for upstream diff review
   Review the upstream CodeQL and TruffleHog release diffs or pinning policy first if maintainers want stronger supply-chain assurance.
3. Pause this group update
   Close or defer the Dependabot group update if maintainers do not want to adopt these action versions yet.

Next step before merge

• No ClawSweeper repair is needed; this PR is already a narrow dependency bump and the remaining action is owner review and merge judgment.

Security
Cleared: No concrete security defect was found: the PR only bumps existing action refs and does not broaden permissions, add new actions, or change secret handling.

Review details

Best possible solution:

Merge the narrow bump only after the security automation owner accepts the upstream action versions, while preserving the existing workflow permissions and Dependabot grouping.

Do we have a high-confidence way to reproduce the issue?

Not applicable. This PR is a maintenance dependency bump, and the changed workflow behavior is exercised by successful CodeQL and secret-scan runs on the PR head.

Is this the best way to solve the issue?

Yes, assuming maintainers accept the upstream action versions. The branch is the narrow dependency-only path and keeps workflow permissions, triggers, and scan arguments intact.

AGENTS.md: found, but no applicable review policy affected this item.

Codex review notes: model internal, reasoning high; reviewed against 7f8653598ea3.

Label changes

Label changes:

• add merge-risk: 🚨 security-boundary: The diff changes third-party action code that runs in repository security workflows with repository read and security-events write permissions.
• add merge-risk: 🚨 automation: The diff changes CodeQL and secret-scanning action versions, so future security automation behavior depends on the updated actions.
• add proof: sufficient: Contributor real behavior proof is sufficient. The changed GitHub Actions workflows ran successfully on the PR head, which is the real behavior surface for this automation dependency bump.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (linked_artifact): The changed GitHub Actions workflows ran successfully on the PR head, which is the real behavior surface for this automation dependency bump.

Label justifications:

• P3: This is a routine dependency maintenance PR with passing checks and no user-facing runtime behavior change.
• merge-risk: 🚨 security-boundary: The diff changes third-party action code that runs in repository security workflows with repository read and security-events write permissions.
• merge-risk: 🚨 automation: The diff changes CodeQL and secret-scanning action versions, so future security automation behavior depends on the updated actions.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (linked_artifact): The changed GitHub Actions workflows ran successfully on the PR head, which is the real behavior surface for this automation dependency bump.
• proof: sufficient: Contributor real behavior proof is sufficient. The changed GitHub Actions workflows ran successfully on the PR head, which is the real behavior surface for this automation dependency bump.

Evidence reviewed

What I checked:

• Repository policy read: AGENTS.md was read in full; it contains general TypeScript CLI and security guidance but no item-specific rule that changes this review. (AGENTS.md:1, 7f8653598ea3)
• PR diff is limited to action refs: The PR changes only three GitHub Actions dependency refs in two workflow files and does not alter workflow permissions, triggers, or shell logic. (.github/workflows/codeql.yml:69, 19a1496837f6)
• Current main still has the older refs: Current main still references the previous CodeQL and TruffleHog versions, so this PR is not already implemented on main. (.github/workflows/secret-scan.yml:49, 7f8653598ea3)
• Live workflow checks passed: GitHub reports the PR merge state as CLEAN and relevant CodeQL and secret-scan check runs completed successfully on the PR head. (19a1496837f6)
• Security automation ownership: CODEOWNERS assigns .github/workflows and .github/dependabot.yml to @openclaw/openclaw-secops, and the PR has that team requested for review. (.github/CODEOWNERS:13, 7f8653598ea3)
• CodeQL tag provenance: The upstream CodeQL v4.36.3 tag peels to commit 54f647b7e1bb85c95cddabcd46b0c578ec92bc1a, matching the PR's pinned action commit. (54f647b7e1bb)

Likely related people:

• @openclaw/openclaw-secops: CODEOWNERS assigns .github/workflows and .github/dependabot.yml to this team, and GitHub shows the team requested for this PR. (role: security automation owner; confidence: high; commits: 0cd24d07a262; files: .github/CODEOWNERS, .github/workflows/codeql.yml, .github/workflows/secret-scan.yml)
• Peter Steinberger: Blame on the changed workflow lines and CODEOWNERS rules points to the v0.7.0 release commit as the source of the current security automation baseline. (role: introduced current workflow baseline; confidence: medium; commits: 0cd24d07a262; files: .github/workflows/codeql.yml, .github/workflows/secret-scan.yml, .github/CODEOWNERS)
• dependabot[bot]: Dependabot authored the prior merged GitHub Actions group update on the same workflow dependency surface and authored this grouped update. (role: recent dependency updater; confidence: medium; commits: 2ee188e5cc26, 19a1496837f6; files: .github/workflows/codeql.yml, .github/workflows/secret-scan.yml)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (1 earlier review cycle)

• reviewed 2026-07-06T16:12:06.056Z sha 19a1496 :: needs maintainer review before merge. :: none

[steipete]

Exact-head maintainer proof for ba7a5a3dd9edfcdbcdcb2be3a8bb8385e8581a77:

• Refreshed the Dependabot update in place, preserving its original commit, to current official stable refs: actions/checkout v7, github/codeql-action v4.37.0, and trufflesecurity/trufflehog v3.95.9. All action sources use the verified upstream commit SHA corresponding to the named release.
• Bounded TruffleHog's executable payload with version: "3.95.9"; its composite action otherwise defaults to latest. Pinned checkout and set persist-credentials: false before the repository is mounted into the scanner container.
• Fresh exact-diff manual review covered permissions, credential persistence, secret exposure, action/composite source, shell and YAML semantics, migration compatibility, and hosted behavior. No actionable findings. CodeQL retains only actions: read, contents: read, and security-events: write; secret scanning retains only contents: read. TruffleHog's existing verified-secret network checks remain the intentional external boundary.
• Public Model Identifier Gate: PASS; workflow-only diff, no model-bearing surface.
• Local proof: actionlint, pnpm typecheck, pnpm lint, pnpm format:check, 877 tests passed with 1 skipped, pnpm build, package smoke under supported Node 24, website smoke, and pnpm audit with zero advisories.
• Structured autoreview was attempted but fail-closed first on the sensitive workflow filename and then on purported truncated input for the three-line CodeQL-only slice. Per repository policy, a fresh equivalent manual review was completed instead; no retry loop or bypass used.
• Hosted CI: https://github.com/openclaw/clawpatch/actions/runs/29167598507
• Hosted CodeQL: https://github.com/openclaw/clawpatch/actions/runs/29167598539 — both TypeScript and Actions analyses passed using the pinned action and CodeQL bundle 2.26.0.
• Hosted secret scan: https://github.com/openclaw/clawpatch/actions/runs/29167598510 — passed using the pinned action, persist-credentials: false, and TruffleHog 3.95.9. The pulled manifest digest matched the independently inspected upstream GHCR manifest.

Recommendation: merge exact head.

[steipete]

Approved at exact head ba7a5a3dd9edfcdbcdcb2be3a8bb8385e8581a77 after verified upstream provenance, fresh manual security-workflow review, full local validation, and passing hosted CI, CodeQL, and secret scanning.