ci(security): pin trufflesecurity/trufflehog@v3.88.18#4
Conversation
@main was unstable: 2026-05-11 goblin_ui PR #425 hit a 502 pulling trufflehog:latest, breaking the security/secrets job. Pin to v3.88.18 (same version goblin_ui and goblin_bot adopted) so the fleet's secret-scan job has a deterministic image source. iac fleet sweep per po/docs/audits/pre-commit-hooks-bug-review-001.md v7 #42. Dispatched-By: iac
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 231d04c353
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| uses: trufflesecurity/trufflehog@v3.88.18 | ||
| with: | ||
| extra_args: --only-verified |
There was a problem hiding this comment.
This pins the composite action wrapper, but the v3.88.18 action still defaults its version input to latest and runs ghcr.io/trufflesecurity/trufflehog:${VERSION}; I checked https://raw.githubusercontent.com/trufflesecurity/trufflehog/v3.88.18/action.yml. In the security/secrets job, because no version: is supplied under with:, CI will continue pulling the mutable trufflehog:latest image, so the 502/immutability risk this commit is meant to remove remains. Add version: 3.88.18 (or another pinned image tag) alongside extra_args.
Useful? React with 👍 / 👎.
1 participant
Summary
trufflesecurity/trufflehog@main→@v3.88.18in.github/workflows/*.ymltrufflehog:latest)po/docs/audits/pre-commit-hooks-bug-review-001.mdv7 #42Test plan
@v3.88.18adopted by goblin_ui (PR #425) + goblin_bot (PR #13354) + coordinator (PR #1701) + goblin_infra (this sweep)🤖 Generated with Claude Code