[joshavant]

What Problem This Solves

The source-pinned action otherwise defaults to mutable latest, allowing historical cached scanner contents. Select the released TruffleHog3.99.4 scanner image whose actual payloads have incident-hardening evidence.

User Impact

CI secret scanning uses the selected qualified runtime. Product code/data and scan policy remain unchanged. This is a scanner-input change, not complete repository or fleet remediation; upstream image version tags remain mutable.

Why This Change Was Made

Use the pinned action's existing version input. Preserve its source reference, image namespace, scan ranges, --only-verified/--debug where already selected, --fail/--no-update, triggers, permissions and failure gate. All caller action references were source-verified to use identical action.yml bytes that run IMAGE:VERSION.

Evidence

• All workflows pass actionlint1.7.12. git diff --check passes. Fresh independent P0–P3 review is scoped-clean. Required AGENTS.md commands pass on isolated native Linux ARM64 with exact Go1.27.3: GOWORK=off go mod tidy, unchangedgo.mod/go.sum, go vet ./..., go test -count=1 ./... (19 packages). No exported API/TUI change; downstream compatibility is not triggered by this literal workflow input.
• Reuse exact canonical image qualification: captured Linux ARM64 image entrypoint and extracted AMD64 image executable match official release payloads and Go1.27.3 build metadata. Across68 component cases:14 original incident endpoints in each applicable default/image-CA/explicit old-CA mode, legitimate public/private HTTPS and hostname/untrusted controls, plus the preserved synthetic verified git-scan failure gate. This is reused exact-artifact evidence, not a new whole-action or product run for this repository. AMD64 execution was under full-system QEMU TCG, not native hardware or actual AMD64 OCI entrypoint proof.
• Actual GitHub AMD64 composite execution remains PR CI evidence. Every built-in detector, external Git/SSH/OpenSSL path, historical runner caches and deployed fleet remain outside this component proof. No release/deployment was run.

Exact source and artifact identities

Candidate e68a4fba5553267f7fdc1eedd9d33001beb0671b, base 78a2cb65e070ba1ae6065b76e009151b4a300ff0, tree 5f1c6fe7f55e0b8c40da940385db05c0c4b22953. Workflow SHA256 39b5e51c2fe7422b097c2a02bb4d672eb871ebc58b24d4e5354c9acd4db5c774.

Captured canonical3.99.4 image index SHA256 bf9238f5bdf26ac28230d4b0bae5162a752b151bf10bea612dad7a62da938731; ARM64 image payload b57ff51268b83496fd58889b252e61549cd1071467aed4f4706b1df53ec13150; AMD64 payload 70b9108715250b19518b03acea56b2f4907a36dcfaaf77693444bdc007a761b1. Action body SHA256 c3847cdbebcf469ef336c9b3f32dc6075ed65523e80e661cf404daebd57e5ba9. Qualification retains upstream +dirty/build-metadata limitations rather than claiming a reproducible source attestation.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR selects TruffleHog scanner image 3.99.4 through the pinned action’s existing version input.

Example: A secret-scanning runner has an older cached latest image.

• Before: The action requests ghcr.io/trufflesecurity/trufflehog:latest and can reuse that image.
• After: The action requests ghcr.io/trufflesecurity/trufflehog:3.99.4.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The patch is minimal and correct; successful production-workflow steps support execution, while detailed image qualification could not be independently inspected.
Proof confidence	🦐 gold shrimp (3/6)	The supplied maintainer-authored classification exempts ordinary contributor proof; exact-head GitHub push and pull-request jobs show successful execution of the changed scanner step, while linked component qualification remains a prose report and detailed workflow logs were inaccessible through the review proxy.
Patch quality	🦞 diamond lobster (5/6)	No actionable review findings were identified.

Product

Kind: Bug fix · Worth it: Yes · Fix scope: Complete
User problem: Security scans can run an older cached scanner even after the action source is updated.
Reason: The supplied maintainer-authored direction selects a released scanner through its existing input and explicitly accepts the unchanged mutable-tag boundary.

Merge readiness

✅ Ready for maintainer review

Keep open: this maintainer-directed scanner repair is absent from main, and the focused patch has no actionable correctness or security findings.

Priority: P2
Reviewed head: e68a4fba5553267f7fdc1eedd9d33001beb0671b

Before merge

None.

Findings

None.

Agent review details

How this fits together

GitHub push and pull-request events supply a commit range to the security workflow, which invokes TruffleHog and fails when verified credentials are detected.

flowchart TD
  A[Push or pull request] --> B[Resolve commit range]
  B --> C[Pinned TruffleHog action]
  C --> D[Scanner image 3.99.4]
  D --> E[Verified secret scan]
  E --> F[Workflow result]

Loading

Technical review

Best possible solution:

Use the existing version input to select 3.99.4 while preserving the established verified-secret gate.

Do we have a high-confidence way to reproduce the issue?

Main omits version, and the pinned action defaults to latest and invokes docker run without forcing a pull, establishing the cached-image reuse path from source.

Is this the best way to solve the issue?

The single existing input is the smallest complete change for explicit runtime selection, with no parallel mechanism or unsupported claim of immutable image identity.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 78a2cb65e070.

Provenance checked

• TruffleHog runtime image selection changes intended behavior with a stated reason (ae16f4d: chore(ci): add crawl security baseline #5 established a standalone verified-secret gate; subsequent source updates preserved the upstream runtime default.)

Testing

Proof path: shipped entry point.

Security

None.

Evidence

What I checked:

• Introduced change and current main: The pinned introduction adds only version: "3.99.4"; current main omits it. The source pin, image namespace, ranges, arguments, triggers, permissions, and failure handling remain unchanged. (.github/workflows/secret-scan.yml:57, e68a4fba5553)
• Authoritative action contract: The target workflow directly executes this dependency. Its pinned action defines version with default latest and passes IMAGE:VERSION to docker run without forcing a pull, preserving --fail and --no-update. (action.yml, e63326d6545d)
• Original gate purpose: The readable creation diff and chore(ci): add crawl security baseline #5 establish the standalone verified-secret gate; this PR retains that purpose. (.github/workflows/secret-scan.yml:50, ae16f4d2a0bd)
• Recent scanner maintenance: build(deps): refresh security analysis tooling #166 updated the action source while retaining its runtime default; this PR addresses that separate selection boundary and preserves the source pin. (.github/workflows/secret-scan.yml:52, eb1c04af4877)
• Exact-head production workflow execution: The push and pull-request scanner jobs succeeded, including their TruffleHog OSS steps: https://github.com/openclaw/crawlkit/actions/runs/40031629464/job/120681009792 and https://github.com/openclaw/crawlkit/actions/runs/40031638380/job/120681038663. Detailed log retrieval was blocked by the review environment’s storage-host allowlist. (.github/workflows/secret-scan.yml:50, e68a4fba5553)
• Credited component qualification: fix(ci): pin qualified TruffleHog runtime image gitcrawl#272 reports qualification of the same 3.99.4 image payloads, including incident-endpoint controls and synthetic verified-secret failure behavior; its body supplies a report rather than attached traces and explicitly retains mutable-tag and AMD64 emulation limitations. (477b32f8f036)

Likely related people:

• Vincent Koc: Raw commit ae16f4d adds .github/workflows/secret-scan.yml:54 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: ae16f4d2a0bd; files: .github/workflows/secret-scan.yml)
• Peter Steinberger: Raw commit eb1c04a adds .github/workflows/secret-scan.yml:52 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: eb1c04af4877; files: .github/workflows/secret-scan.yml)

Labels

Label changes:

• add P2: Explicit scanner-version selection repairs a narrow security-workflow boundary without evidence of an urgent outage or active compromise.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🦞 diamond lobster.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P2: Explicit scanner-version selection repairs a narrow security-workflow boundary without evidence of an urgent outage or active compromise.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🦞 diamond lobster.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 23, 2026, 6:21 PM ET / 22:21 UTC.