Repository navigation
fix(ci): select the qualified TruffleHog scanner image - #313
Conversation
|
🦞👀 Pull request received. I will update this pull request when review starts. ClawSweeper review completeClawSweeper finished reviewing this revision. The review result is being finalized. |
clawsweeper
Bot
added
clawsweeper:intake:bug
|
Codex review: needs maintainer review before merge. What this changesThis PR selects TruffleHog scanner image version 3.99.4 through the existing pinned action’s version input. Example: The verified-secret workflow runs for a pull request.
Review scores
ProductKind: Maintenance · Worth it: Yes · Fix scope: Complete Merge readiness✅ Ready for maintainer review Keep this PR open for landing: it makes a useful, minimal scanner-selection change that current main lacks, and this review found no concrete merge blocker. Priority: P2 Before mergeNone. FindingsNone. Agent review detailsHow this fits togetherGitHub Actions passes the checked-out repository and commit range to TruffleHog, which verifies detected credentials and returns the secret-scanning gate result. flowchart LR
A[Push or pull request] --> B[Checkout repository]
B --> C[Resolve commit range]
C --> D[Pinned TruffleHog action]
D --> E[Scanner image 3.99.4]
E --> F[Verified secret gate]
Technical reviewBest possible solution: Land the existing one-line scanner selection with the scan policy and action source preserved. Do we have a high-confidence way to reproduce the issue? Current main omits version, and the exact upstream action defaults it to latest; this establishes the runtime-selection problem without asserting that a particular runner currently holds an affected cached image. Is this the best way to solve the issue? The existing action input is the smallest complete way to select the qualified release while preserving the established gate; the body accurately acknowledges that version tags remain mutable. AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning medium; reviewed against 111e9326440d. Provenance checked
TestingProof path: shipped entry point. SecurityNone. EvidenceWhat I checked:
Likely related people:
LabelsLabel changes:
Label justifications:
Rating scale6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior. WorkflowClawSweeper edits this one comment on every review. Comment HistoryReview history (1 earlier review cycle)
Reviewed October 23, 2026, 10:23 PM ET / October 24, 2026, 02:23 UTC (Revision 2). |
|
@clawsweeper re-review The PR body now includes inspectable exact-artifact observations for the requested evidence gap, with platform and component-reuse limits stated. Product source is unchanged. |
|
🦞👀 Re-review progress:
|
clawsweeper
Bot
added
proof: sufficient
What Problem This Solves
The source-pinned action otherwise defaults to mutable latest, allowing historical cached scanner contents. Select the released TruffleHog3.99.4 scanner image whose actual payloads have incident-hardening evidence.
User Impact
CI secret scanning uses the selected qualified runtime. Product code/data and scan policy remain unchanged. This is a scanner-input change, not complete repository or fleet remediation; upstream image version tags remain mutable.
Why This Change Was Made
Use the pinned action's existing
versioninput. Preserve its source reference, image namespace, scan ranges, --only-verified/--debug where already selected, --fail/--no-update, triggers, permissions and failure gate. All caller action references were source-verified to use identical action.yml bytes that run IMAGE:VERSION.Evidence
git diff --checkpasses. Fresh independent P0–P3 review is scoped-clean.Exact source and artifact identities
Candidate
b1adfe7f97b2176f42f9862d0f0f0f865519aa6f, basec56030d8b6bf6314d1814cf840b3247df21a8800, treef2f7dde251d06f5aa068a12c3491d6dd27038226. Workflow SHA25604d4d25b521b994249132efad3792e34c07331e13656fd5fd150d93b511820ec.Captured canonical3.99.4 image index SHA256
bf9238f5bdf26ac28230d4b0bae5162a752b151bf10bea612dad7a62da938731; ARM64 image payloadb57ff51268b83496fd58889b252e61549cd1071467aed4f4706b1df53ec13150; AMD64 payload70b9108715250b19518b03acea56b2f4907a36dcfaaf77693444bdc007a761b1. Action body SHA256c3847cdbebcf469ef336c9b3f32dc6075ed65523e80e661cf404daebd57e5ba9. Qualification retains upstream +dirty/build-metadata limitations rather than claiming a reproducible source attestation.Inspectable additional validation evidence
Inspectable canonical scanner-image TLS observations
Exact consumer head
b1adfe7f97b2176f42f9862d0f0f0f865519aa6f;.github/workflows/secret-scan.ymlSHA25604d4d25b521b994249132efad3792e34c07331e13656fd5fd150d93b511820ecselects TruffleHog3.99.4 through the unchanged action. These are reused actual qualified component/image observations, not a newly executed whole consumer workflow.The consumer action bytes and version input match the canonical Gitcrawl qualification. Existing exact-head consumer CI separately exercises the hosted scanner step. The normal upstream version tag remains mutable; this evidence identifies the tested artifact, not every historical runner cache.
Linux ARM64 actual OCI entrypoint
Image/binary identity:
{ "imageReference": "ghcr.io/trufflesecurity/trufflehog@sha256:adb1cb57ef6196ea097e86c8fdb18f9df327f3865b0444c313d0303efcd9702d", "binarySHA256": "b57ff51268b83496fd58889b252e61549cd1071467aed4f4706b1df53ec13150", "privateRequests": [ { "case": "private-CA", "bodySHA256": "d39a20381bef4f59ed806646d146317f79fdd63468bfd1949c4e0b7a05ff201c", "tls": "TLSv1.3" }, { "case": "git-verified-gate", "bodySHA256": "d39a20381bef4f59ed806646d146317f79fdd63468bfd1949c4e0b7a05ff201c", "tls": "TLSv1.3" } ], "syntheticRepo": { "base": "8fedc5b6baba0d5f4e447318ba223947ea62a5a7", "head": "e45261687ca9acb003eddbff6a6b74098c721688" }, "verdict": "passed-focused-image-entrypoint-and-git-gate", "limits": "LinuxARM64 actualimageentrypoint/customverifier only, not everybuiltin/externalclient/nativeAMD64image/fleet. DefaultUnknownIssuer is rejection notkey-specific; explicitoldCA retains exactobservedx509error." }Per-case actual verifier output, projected from retained JSON stdout (all record hashes retained locally):
Actual stderr/stdout examples are bounded below. The synthetic custom detector exercises the selected verifier; it is not a claim that every built-in detector/external transport is covered.
incident-00-oldCA stdout SHA256
adaeeb1fa983bb7ee3dd80f3cbfc3f4fae4030bb23e33ebcb98bd41a9445ff4b:{ "Verified": false, "VerificationError": "x509: no valid chains built", "VerificationFromCache": false }Linux AMD64 image ELF under full-system emulation
Image/binary identity:
{ "imageReference": "ghcr.io/trufflesecurity/trufflehog@sha256:a3a8f49c82805a99bba4cec01c0cce2f3daeaeb59884eef70aafc88715003d1e", "binarySHA256": "70b9108715250b19518b03acea56b2f4907a36dcfaaf77693444bdc007a761b1", "privateRequests": [ { "case": "private-CA", "bodySHA256": "d39a20381bef4f59ed806646d146317f79fdd63468bfd1949c4e0b7a05ff201c", "tls": "TLSv1.3" }, { "case": "git-verified-gate", "bodySHA256": "d39a20381bef4f59ed806646d146317f79fdd63468bfd1949c4e0b7a05ff201c", "tls": "TLSv1.3" } ], "syntheticRepo": { "base": "79afa832b8811f4aafdf60f23ea6644be8d69a3e", "head": "ca06eab2acd67b386b3ce69b91313ce63776a595" }, "verdict": "passed-extracted-amd64-image-native-custom-verifier-and-git-gate", "limits": "ExtractedactualLinuxAMD64imageELF runs infullsystemx86_64QEMUTCGguest; imageCAbundleexplicitfile/emptydir ratherthanOCIentrypoint. Notnativehardware/timing,notactualAMD64containerorallbuiltins/externalclient/fleet. DefaultUnknownIssuer is rejection notkey-specific; explicitoldCA retains exactobservedx509error." }Per-case actual verifier output, projected from retained JSON stdout (all record hashes retained locally):
Actual stderr/stdout examples are bounded below. The synthetic custom detector exercises the selected verifier; it is not a claim that every built-in detector/external transport is covered.
incident-00-oldCA stdout SHA256
92923f530253b8b73a3f2eaf55a315211e756b519914247b687a1971c8aaa0a9:{ "Verified": false, "VerificationError": "x509: no valid chains built", "VerificationFromCache": false }Historical-root bundle SHA256
c3aa6ce83618c247fdeb0afad3a4eb1d01da2eb9035defe70f74c4bbaaca986f. Existing matched historical-store controls established the fixture chains were valid/accepted before remediation. Default UnknownIssuer alone is not key-specific proof; explicit old-root-store failures carry the stronger evidence. No timeout, DNS error or setup failure is counted as rejection.ARM archive SHA256
ce12d49b56d5cb1ec2a3d9c9ae2add6e7d39e5d7104f3e2bca75fa2614118381; AMD archive6310c1d1299ea1b05af4fe2558e4b4dbcf67018e0fb03c28170f18caab0bbe39. No native AMD64 OCI entrypoint, native macOS/Windows, all-detector or fleet-delivery claim.Only synthetic loopback/private fixtures were used; loopback addresses are redacted in the projected traces.