Skip to content

build(deps): bump trufflesecurity/trufflehog from 3.99.2 to 3.99.7 - #132

Merged
vincentkoc merged 1 commit into
mainfrom
dependabot/github_actions/trufflesecurity/trufflehog-3.99.7
Oct 29, 2026
Merged

build(deps): bump trufflesecurity/trufflehog from 3.99.2 to 3.99.7#132
vincentkoc merged 1 commit into
mainfrom
dependabot/github_actions/trufflesecurity/trufflehog-3.99.7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 28, 2026

Copy link
Copy Markdown
Contributor

Bumps trufflesecurity/trufflehog from 3.99.2 to 3.99.7.

Release notes

Sourced from trufflesecurity/trufflehog's releases.

v3.99.7

What's Changed

New Contributors

Full Changelog: trufflesecurity/trufflehog@v3.99.6...v3.99.7

v3.99.6

v3.99.5 was tagged but never published because its release build failed. v3.99.6 supersedes it and includes all of the changes below.

What's Changed

Full Changelog: trufflesecurity/trufflehog@v3.99.4...v3.99.6

v3.99.4

What's Changed

Full Changelog: trufflesecurity/trufflehog@v3.99.3...v3.99.4

v3.99.3

What's Changed

... (truncated)

Commits
  • 31ce31e Fix 7z and rar panics in the archive handler and log recovered panic stacks (...
  • 50bc667 feat(detectors): add Infisical service token detector (#5445)
  • 4723140 feat(detectors): add Fireworks AI API key detector (#5447)
  • 8276bc4 ci(lint): pin the semgrep container image by digest (#5245)
  • f6984be Add xAI analyzer (#5456)
  • 282085c fix(detectors/anypointoauth2): stop treating HTTP 422 as verified (#5386)
  • b1bb823 Fix --include-wikis help typo and huggingface README description (#5471)
  • fd43a88 Keep GoReleaser temp files off the tmpfs /tmp in releases (#5473)
  • 3bd461f security: bump andybalholm/brotli to v1.2.7 (CVE-2026-111497) (#5472)
  • d6ea4a5 Clean up Filesystem source logging for per-source debug (#5465)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
build(deps): bump trufflesecurity/trufflehog from 3.99.2 to 3.99.7
a8315aa 
Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.99.2 to 3.99.7.
- [Release notes](https://github.com/trufflesecurity/trufflehog/releases)
- [Commits](trufflesecurity/trufflehog@v3.99.2...v3.99.7)

---
updated-dependencies:
- dependency-name: trufflesecurity/trufflehog
  dependency-version: 3.99.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 28, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner October 28, 2026 06:44
@clawsweeper

clawsweeper Bot commented Oct 28, 2026 •
edited
Loading

Copy link
Copy Markdown

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

@github-actions github-actions Bot added the build label Oct 28, 2026
@clawsweeper clawsweeper Bot added P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels Oct 28, 2026
@clawsweeper

clawsweeper Bot commented Oct 28, 2026

Copy link
Copy Markdown

Codex review: needs maintainer review before merge.

What this changes

Updates the TruffleHog GitHub Action reference from v3.99.2 to v3.99.7 while retaining scanner runtime 3.99.4.

Example: GitHub Actions scans a pull request for verified secrets.

  • Before: Action v3.99.2 launches scanner image 3.99.4.
  • After: Action v3.99.7 launches scanner image 3.99.4 through identical action implementation bytes.

Review scores

Measure Result What it means
Overall readiness 🦐 gold shrimp (3/6) The minimal patch is source-verified and has successful exact-head checks; independently inspected runtime output is unavailable.
Proof confidence 🦐 gold shrimp (3/6) This Dependabot maintenance PR is outside the ordinary contributor proof gate; exact-head scan success supports the source comparison, but detailed execution logs were unavailable through the allowed network.
Patch quality 🐚 platinum hermit (4/6) No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: The workflow's action source reference trails the upstream patch release.
Reason: A minimal automated dependency refresh preserves the existing scanning contract and qualified runtime without introducing another path.

Merge readiness

✅ Ready for maintainer review

This PR is a safe, narrowly scoped action-reference update that is absent from main; no introduced defects were found.

Priority: P3
Reviewed head: a8315aa35b0cecefbc83f9adc7ef8624ff6f7f62

Before merge

None.

Findings

None.

Agent review details

How this fits together

The secret-scanning workflow passes the checked-out repository and commit range to TruffleHog, which fails the job when verified credentials are found.

flowchart LR
  A[Push or pull request] --> B[Checkout repository]
  B --> C[Resolve commit range]
  C --> D[TruffleHog composite action]
  D --> E[Scanner image 3.99.4]
  E --> F[Secret scan result]
Loading

Technical review

Best possible solution:

Land the focused action-reference update while preserving the independently qualified scanner runtime.

Do we have a high-confidence way to reproduce the issue?

This is dependency maintenance rather than a bug report; source comparison verifies identical action implementation and unchanged runtime selection.

Is this the best way to solve the issue?

The one-line update is the smallest complete change and respects the separate scanner-image qualification boundary.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against 24f174ca7d5a.

Provenance checked

  • TruffleHog action reference keeps the original intent (f7fc593: The previous merged dependency update selected action v3.99.2; the later runtime repair intentionally selected scanner image 3.99.4 separately.)

Testing

Proof path: none.

Security

None.

Evidence

What I checked:

Likely related people:

  • Vincent Koc: Raw commit b5c5183 adds .github/workflows/secret-scan.yml:13 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: b5c5183d9848; files: .github/workflows/secret-scan.yml)
  • Josh Avant: Raw commit 3812d20 adds .github/workflows/secret-scan.yml:57 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 3812d20e6462; files: .github/workflows/secret-scan.yml)
  • Peter Steinberger: Raw commit 30407c0 adds .github/workflows/secret-scan.yml:19 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 30407c0c0ce9; files: .github/workflows/secret-scan.yml)

Labels

Label changes:

  • add P3: Routine dependency maintenance with identical executed action bytes and no application behavior change.
  • add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
  • add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

  • P3: Routine dependency maintenance with identical executed action bytes and no application behavior change.
  • rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 28, 2026, 2:57 AM ET / 06:57 UTC.

@vincentkoc
vincentkoc merged commit a4271ef into main Oct 29, 2026
19 checks passed
@vincentkoc
vincentkoc deleted the dependabot/github_actions/trufflesecurity/trufflehog-3.99.7 branch October 29, 2026 01:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@vincentkoc vincentkoc

Labels

build dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@vincentkoc