Skip to content

build(deps): bump trufflesecurity/trufflehog from 3.96.0 to 3.97.0 - #185

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/trufflesecurity/trufflehog-3.97.0
Closed

build(deps): bump trufflesecurity/trufflehog from 3.96.0 to 3.97.0#185
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/trufflesecurity/trufflehog-3.97.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps trufflesecurity/trufflehog from 3.96.0 to 3.97.0.

Release notes

Sourced from trufflesecurity/trufflehog's releases.

v3.97.0

What's Changed

New Contributors

Full Changelog: trufflesecurity/trufflehog@v3.96.0...v3.97.0

Commits
  • bcfcf73 fix(detectors/harness): allow underscore in PAT account segment (#5153)
  • f567838 Add AWS Secrets Manager metadata type (#5210)
  • ee476c7 update huggingface to fix unbounded resources bug (#5204)
  • 37ed218 fix blogger detector to use Google API prefix instead of generic hex string (...
  • 55db46b Add custom endpoint support to the S3 source (#5202)
  • 96b593f fix(jiratoken): stop 202 reverification retry loop (#5200)
  • f9daad8 Add SolarWinds Observability detector (#5199)
  • 8b5a47c Deprecated bingsubscriptionkey detector (#5179)
  • 3539500 Anthropic detector: surface API error detail on non-2xx verification (#5180)
  • 58cb799 Deprecate AppOptics detector (#5198)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
build(deps): bump trufflesecurity/trufflehog from 3.96.0 to 3.97.0
2092f43 
Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.96.0 to 3.97.0.
- [Release notes](https://github.com/trufflesecurity/trufflehog/releases)
- [Commits](trufflesecurity/trufflehog@v3.96.0...v3.97.0)

---
updated-dependencies:
- dependency-name: trufflesecurity/trufflehog
  dependency-version: 3.97.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 22, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner August 22, 2026 12:52
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 22, 2026
@clawsweeper

clawsweeper Bot commented Aug 22, 2026

Copy link
Copy Markdown
Contributor

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

@clawsweeper clawsweeper Bot added merge-risk: 🚨 automation 🚨 Merging this PR could break CI, automerge, proof capture, label sync, or automation. merge-risk: 🚨 security-boundary 🚨 Merging this PR could weaken sandboxing, authorization, credentials, or sensitive data. P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels Aug 22, 2026
@clawsweeper

clawsweeper Bot commented Aug 22, 2026

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge. Reviewed August 22, 2026, 8:55 AM ET / 12:55 UTC.

ClawSweeper review

What this changes

The PR updates the TruffleHog GitHub Action in the secret-scanning workflow from v3.96.0 to v3.97.0.

Merge readiness

⚠️ Ready for maintainer review - 2 items remain

Current main still uses TruffleHog v3.96.0, so this fresh, isolated update remains useful. No patch defect was identified; await the remaining GitHub checks before merging.

Priority: P3
Reviewed head: 2092f439963920be6537a4c1ecb402c6df3e41d3

Review scores

Measure Result What it means
Overall readiness 🐚 platinum hermit (4/6) A normal, tightly scoped dependency update with no identified correctness defect; routine CI completion remains the merge gate.
Proof confidence 🌊 off-meta tidepool Not applicable: Not applicable: this bot-authored CI-only dependency update is exempt from the external-contributor real-behavior-proof gate.
Patch quality 🐚 platinum hermit (4/6) No actionable review findings were identified.

Verification

Check Result Evidence
Real behavior Not applicable Not applicable: Not applicable: this bot-authored CI-only dependency update is exempt from the external-contributor real-behavior-proof gate.
Evidence reviewed 5 items Current-main baseline: Current main still invokes TruffleHog v3.96.0, so the requested v3.97.0 update is not already implemented.
Exact PR scope: The PR changes only the action reference from v3.96.0 to v3.97.0.
Workflow provenance: The secret-scan workflow, including its v3.96.0 baseline and contents-read job permission, was introduced in the v0.13.3 release commit.
Findings None None.
Security None None.

Live Verification

Command: git show HEAD:.github/workflows/secret-scan.yml

Result: FAIL (failed) — execution before step 1 run: sh -lc pnpm install --ignore-scripts --frozen-lockfile failed: ! Corepack is about to download https://registry.npmjs.org/pnpm/-/pnpm-11.22.0.tgz

sh -lc pnpm install --ignore-scripts --frozen-lockfile failed: ! Corepack is about to download https://registry.npmjs.org/pnpm/-/pnpm-11.22.0.tgz

Assertions:

  • FAIL expect_output: uses: trufflesecurity/trufflehog@v3.97.0

How this fits together

The secret-scan workflow receives repository changes, resolves a commit range, and invokes TruffleHog to report verified secrets as a CI gate. Its result feeds the pull-request status checks.

flowchart LR
A[Repository changes] --> B[Secret-scan workflow]
B --> C[Commit-range resolution]
C --> D[TruffleHog action]
D --> E[Verified-secret result]
E --> F[Pull-request status]
Loading

Before merge

  • Resolve merge risk (P1) - Merging changes the version of a third-party action that executes in the repository’s secret-scanning CI gate; the workflow keeps the action constrained to contents-read permission.
  • Complete next step (P2) - No repair is needed; complete the ordinary CI and maintainer merge review.
Agent review details

Security

None.

Review metrics

Metric Value Why it matters
Workflow scope 1 file changed; 1 line added, 1 line removed The PR is limited to the secret-scanning action reference.

Merge-risk options

Maintainer options:

  1. Validate and land the scanner update (recommended)
    Allow required checks to complete, then merge this one-line update if they pass on the current head.
Copy recommended automerge instruction 
@clawsweeper automerge

Special instructions:
Wait for required checks to pass on the current head, then merge.

Technical review

Best possible solution:

Keep the existing least-privilege workflow structure and merge the isolated scanner update once required checks accept v3.97.0.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR updates a CI action dependency rather than fixing a user-reported runtime defect.

Is this the best way to solve the issue?

Yes: changing only the existing action reference is the narrowest maintainable path for consuming the requested scanner release.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning high; reviewed against 938b6b279dfc.

Labels

Label changes:

  • add P3: This is a routine, narrowly scoped CI dependency update.
  • add merge-risk: 🚨 security-boundary: The changed action evaluates repository contents for verified credentials, despite being restricted to contents-read permission.
  • add merge-risk: 🚨 automation: The changed dependency executes in the repository’s GitHub Actions secret-scan workflow.
  • add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
  • add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Not applicable: this bot-authored CI-only dependency update is exempt from the external-contributor real-behavior-proof gate.

Label justifications:

  • P3: This is a routine, narrowly scoped CI dependency update.
  • merge-risk: 🚨 automation: The changed dependency executes in the repository’s GitHub Actions secret-scan workflow.
  • merge-risk: 🚨 security-boundary: The changed action evaluates repository contents for verified credentials, despite being restricted to contents-read permission.
  • rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Not applicable: this bot-authored CI-only dependency update is exempt from the external-contributor real-behavior-proof gate.

Evidence

What I checked:

Likely related people:

  • Peter Steinberger: Introduced the secret-scan workflow and its initial TruffleHog reference in the v0.13.3 release commit. (role: workflow introducer; confidence: high; commits: 089c1f5b6ae4; files: .github/workflows/secret-scan.yml)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

  • Wait for the queued and in-progress GitHub checks to complete on the current head.

Rating scale

Score Internal tier Crab rank Meaning
6/6 S 🦀 challenger crab Exceptional readiness
5/6 A 🦞 diamond lobster Very strong readiness
4/6 B 🐚 platinum hermit Good normal PR; ordinary maintainer review
3/6 C 🦐 gold shrimp Useful, but confidence is limited
2/6 D 🦪 silver shellfish Proof or implementation needs work
1/6 F 🧂 unranked krab Not merge-ready
N/A NA 🌊 off-meta tidepool Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@steipete steipete mentioned this pull request Aug 23, 2026
Merged
@dependabot @github

dependabot Bot commented on behalf of github Aug 23, 2026

Copy link
Copy Markdown
Contributor Author

Looks like trufflesecurity/trufflehog is up-to-date now, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 23, 2026
@dependabot
dependabot Bot deleted the dependabot/github_actions/trufflesecurity/trufflehog-3.97.0 branch August 23, 2026 16:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code merge-risk: 🚨 automation 🚨 Merging this PR could break CI, automerge, proof capture, label sync, or automation. merge-risk: 🚨 security-boundary 🚨 Merging this PR could weaken sandboxing, authorization, credentials, or sensitive data. P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants