Skip to content

chore(deps): bump trufflesecurity/trufflehog from 3.96.0 to 3.97.0 - #153

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/trufflesecurity/trufflehog-3.97.0
Closed

chore(deps): bump trufflesecurity/trufflehog from 3.96.0 to 3.97.0#153
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/trufflesecurity/trufflehog-3.97.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 16, 2026

Copy link
Copy Markdown
Contributor

Bumps trufflesecurity/trufflehog from 3.96.0 to 3.97.0.

Release notes

Sourced from trufflesecurity/trufflehog's releases.

v3.97.0

What's Changed

New Contributors

Full Changelog: trufflesecurity/trufflehog@v3.96.0...v3.97.0

Commits
  • bcfcf73 fix(detectors/harness): allow underscore in PAT account segment (#5153)
  • f567838 Add AWS Secrets Manager metadata type (#5210)
  • ee476c7 update huggingface to fix unbounded resources bug (#5204)
  • 37ed218 fix blogger detector to use Google API prefix instead of generic hex string (...
  • 55db46b Add custom endpoint support to the S3 source (#5202)
  • 96b593f fix(jiratoken): stop 202 reverification retry loop (#5200)
  • f9daad8 Add SolarWinds Observability detector (#5199)
  • 8b5a47c Deprecated bingsubscriptionkey detector (#5179)
  • 3539500 Anthropic detector: surface API error detail on non-2xx verification (#5180)
  • 58cb799 Deprecate AppOptics detector (#5198)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
chore(deps): bump trufflesecurity/trufflehog from 3.96.0 to 3.97.0
195ab1e 
Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.96.0 to 3.97.0.
- [Release notes](https://github.com/trufflesecurity/trufflehog/releases)
- [Commits](trufflesecurity/trufflehog@6f3c981...bcfcf73)

---
updated-dependencies:
- dependency-name: trufflesecurity/trufflehog
  dependency-version: 3.97.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 16, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner August 16, 2026 20:13
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 16, 2026
@clawsweeper

clawsweeper Bot commented Aug 16, 2026

Copy link
Copy Markdown

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

@clawsweeper clawsweeper Bot added merge-risk: 🚨 automation 🚨 Merging this PR could break CI, automerge, proof capture, label sync, or automation. P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. rating: 🦞 diamond lobster Very strong PR readiness with only minor maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels Aug 16, 2026
@clawsweeper

clawsweeper Bot commented Aug 16, 2026

Copy link
Copy Markdown

Codex review: needs maintainer review before merge. Reviewed August 16, 2026, 4:15 PM ET / 20:15 UTC.

ClawSweeper review

What this changes

Updates the SHA-pinned TruffleHog GitHub Action in the secret-scanning workflow from v3.96.0 to v3.97.0.

Merge readiness

⚠️ Ready for maintainer review - 2 items remain

Keep open: current main and release v0.8.5 still pin TruffleHog v3.96.0, while this PR makes the intended one-line pinned-action update. The patch has no correctness finding, but its body provides only CI evidence rather than contributor-supplied real-behavior proof for the workflow change.

Priority: P3
Reviewed head: 195ab1e055a16b3a5228bc618f4290e5ecd0d4b9

Review scores

Measure Result What it means
Overall readiness 🦞 diamond lobster (5/6) PR readiness rating was derived from proof quality, review findings, security review, and reviewer confidence.
Proof confidence 🌊 off-meta tidepool Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.
Patch quality 🦞 diamond lobster (5/6) No actionable review findings were identified.

Verification

Check Result Evidence
Real behavior Not applicable Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.
Evidence reviewed 4 items Current workflow behavior: Current main invokes the SHA-pinned TruffleHog v3.96.0 action with read-only contents permission and passes the resolved base/head range.
Narrow proposed diff: The PR changes only the action commit pin and accompanying version comment from v3.96.0 to v3.97.0.
Workflow provenance: The current workflow, including the prior v3.96.0 pin, was introduced in the v0.8.5 release-preparation commit.
Findings None None.
Security None None.

How this fits together

The repository’s secret-scanning workflow runs on pushes and pull requests, resolves the commit range, and invokes TruffleHog to detect verified secrets. Its result is used as a merge-time security gate.

flowchart LR
A[Push or pull request] --> B[Secret scanning workflow]
B --> C[Resolve commit range]
C --> D[TruffleHog action]
D --> E[Verified-secret result]
E --> F[Merge gate]
Loading

Before merge

  • Resolve merge risk (P1) - Merging changes the external code executed by the repository-wide secret-scanning automation; the successful PR scan exercises this revision but does not establish detection coverage for representative inputs.
  • Complete next step (P2) - The remaining action is workflow-owner review and real-behavior evidence, not a safe automated code repair.
Agent review details

Security

None.

Review metrics

Metric Value Why it matters
Workflow surface 1 file changed; 1 SHA pin updated The entire patch is a version-pinned third-party action change in merge-time security automation.

Merge-risk options

Maintainer options:

  1. Capture live scanner proof (recommended)
    Before merge, attach a redacted post-update action transcript showing the v3.97.0 scan ran against a controlled range and produced the expected result.
  2. Accept the workflow-update risk
    A workflow owner may merge based on the pinned upstream release and current successful checks while accepting that representative detection coverage was not demonstrated.

Technical review

Best possible solution:

Land the reviewed full-SHA pin after a redacted controlled action run demonstrates the updated scanner’s expected range and result, with the workflow code owner approving the automation change.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a dependency-maintenance PR rather than a reported product failure; the relevant validation is an after-update workflow run.

Is this the best way to solve the issue?

Yes, conditionally: replacing only the existing full SHA pin is the narrowest maintainable update path, provided the updated action is demonstrated in a controlled run before merge.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning high; reviewed against b793612bfa8a.

Labels

Label changes:

  • add P3: This is a narrow dependency-maintenance update with no reported user-facing regression.
  • add merge-risk: 🚨 automation: The PR changes the external action implementation that runs the repository’s secret-scanning workflow.
  • add rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🌊 off-meta tidepool and patch quality is 🦞 diamond lobster.
  • add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.

Label justifications:

  • P3: This is a narrow dependency-maintenance update with no reported user-facing regression.
  • merge-risk: 🚨 automation: The PR changes the external action implementation that runs the repository’s secret-scanning workflow.
  • rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🌊 off-meta tidepool and patch quality is 🦞 diamond lobster.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.

Evidence

What I checked:

Likely related people:

  • Peter Steinberger: Current main attributes the secret-scanning workflow and its original action pin to the v0.8.5 preparation commit. (role: workflow introducer; confidence: high; commits: b793612bfa8a; files: .github/workflows/secret-scan.yml)
  • openclaw/openclaw-secops: Repository ownership assigns all GitHub workflow files to this security-operations team. (role: code owner; confidence: high; files: .github/CODEOWNERS, .github/workflows/secret-scan.yml)

Rating scale

Score Internal tier Crab rank Meaning
6/6 S 🦀 challenger crab Exceptional readiness
5/6 A 🦞 diamond lobster Very strong readiness
4/6 B 🐚 platinum hermit Good normal PR; ordinary maintainer review
3/6 C 🦐 gold shrimp Useful, but confidence is limited
2/6 D 🦪 silver shellfish Proof or implementation needs work
1/6 F 🧂 unranked krab Not merge-ready
N/A NA 🌊 off-meta tidepool Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@steipete steipete mentioned this pull request Aug 17, 2026
Merged
@steipete

steipete commented Aug 17, 2026

Copy link
Copy Markdown
Collaborator

Superseded by #157, which lands this together with the rest of the dependency refresh in one coherent branch.

@steipete steipete closed this Aug 17, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 17, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/github_actions/trufflesecurity/trufflehog-3.97.0 branch August 17, 2026 08:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@vincentkoc vincentkoc

Labels

chore dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code merge-risk: 🚨 automation 🚨 Merging this PR could break CI, automerge, proof capture, label sync, or automation. other P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. rating: 🦞 diamond lobster Very strong PR readiness with only minor maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@steipete @vincentkoc