[dependabot]

Refresh the pinned TruffleHog secret-scanning action from v3.99.2 to v3.99.3, following the repository's three-day dependency cooldown. Add an Unreleased entry crediting @dependabot.

The upstream composite action is identical at both revisions and retains its existing latest scanner-container selection. This updates the action reference; it does not newly pin or change the scanner binary.

Validation: make check passed on Linux with Go 1.27.3, Node 26.12.1, and GoReleaser 2.18.2. This includes module tidiness, formatting, vet, govulncheck ./... (no vulnerabilities), dead-code checking, tests (85.0% coverage), CLI smoke, release-script tests, documentation, and all six snapshot build targets. Actionlint and git diff --check passed. Independent Codex review found no actionable P0–P3 issues.

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR updates the secret-scanning action’s pinned revision from TruffleHog v3.99.2 to v3.99.3.

Example: GitHub runs secret scanning on a pull request.

• Before: The workflow resolves the action at e76dff8a7e57d6df0c60ad8cbf5d5cba505a8fc9.
• After: The workflow resolves the action at e63326d6545de8f425d93ce24078c6e68d83f70e; its identical action code still selects the latest scanner container.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, correct maintenance update supported by upstream source identity and successful current-head checks.
Proof confidence	🐚 platinum hermit (4/6)	This Dependabot maintenance PR is outside the ordinary contributor-proof gate; identical upstream action blobs establish no changed execution path, and successful scan jobs provide supporting CI validation.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Repository maintainers keep the secret-scanning action reference aligned with upstream releases.
Reason: This follows established dependency maintenance without changing outputs, defaults, permissions, or public interfaces; scanner-container version pinning remains outside this PR.

Merge readiness

✅ Ready for maintainer review

Keep open: main still uses the older action pin, and this narrowly scoped maintenance update introduces no identified defect.

Priority: P3
Reviewed head: c70e54c7b7357222d53ed3d48ee8e88a37ed27cc

Before merge

None.

Findings

None.

Agent review details

How this fits together

The GitHub Actions security workflow checks out repository history, resolves the commit range, and invokes TruffleHog to fail the job when verified secrets are found.

flowchart LR
  A[Push or pull request] --> B[Checkout repository]
  B --> C[Resolve commit range]
  C --> D[Pinned TruffleHog action]
  D --> E[Latest scanner container]
  E --> F[Security gate result]

Loading

Technical review

Best possible solution:

Land the focused action-pin refresh through the existing workflow ownership path.

Do we have a high-confidence way to reproduce the issue?

No application bug is claimed; the exact pin change and unchanged action implementation are directly verifiable in source.

Is this the best way to solve the issue?

The one-line update is the smallest complete maintenance change and preserves the established scan contract.

AGENTS.md: found but not applied because it conflicted with ClawSweeper's review contract.

Codex review notes: model internal, reasoning medium; reviewed against 38d6aee915a8.

Provenance checked

• Secret-scanning action reference keeps the original intent (cce0d48: build(deps): update Go modules and CI actions #252 consolidated compatible dependency updates, including the current TruffleHog pin.)

Testing

Proof path: none.

Security

None.

Evidence

What I checked:

• Exact introduced change: The complete introduced diff changes only the action SHA and version comment at line 52; permissions, triggers, scan range, and arguments remain unchanged. (.github/workflows/secret-scan.yml:52, c70e54c7b735)
• Current main still has the older pin: GitHub confirms main remains at the fetched revision, whose workflow pins v3.99.2; repository-wide TruffleHog search found no separate item owning this update. (.github/workflows/secret-scan.yml:52, 38d6aee915a8)
• Executed dependency contract: The target workflow directly executes this dependency. Both pinned revisions contain action.yml blob 1e2af3fbb9ef7eb5f19e21af9d0c6c3278de1a73. The composite action runs the configured Docker image with version defaulting to latest, so this pin refresh does not itself select scanner binary v3.99.3. The v3.99.3 tag resolves to the proposed commit. (action.yml, e63326d6545d)
• Current-head checks and discussion: The reviewed head has successful secret-scan checks and no failing check conclusions. The inspected scan job completed its TruffleHog step successfully. Comments contain only review-status messages; there are no submitted reviews or requested reviewers. GitHub reports a clean merge. (.github/workflows/secret-scan.yml:52, c70e54c7b735)
• Feature history and original intent: Vincent Koc introduced verified secret scanning and later hardened failure notification. Peter Steinberger repeatedly refreshed its dependencies and pinned tools; build(deps): update Go modules and CI actions #252 established the current v3.99.2 pin. Follow-history traversal reached the documented missing-object boundary, but the creation commit and relevant subsequent changes were independently readable. (.github/workflows/secret-scan.yml:52, cce0d486bea0)
• Repository policy and ownership: The complete root AGENTS.md was read; no nested workflow policy, maintainer notes directory, or pr-simplify skill exists. CODEOWNERS routes workflows to openclaw/openclaw-secops. The user's explicit single-reviewer prohibition overrides the helper instruction; no helper or second reviewer ran. The checkout remained clean and registered worktrees were inspected. (AGENTS.md:3, c70e54c7b735)

Likely related people:

• Vincent Koc: Raw commit a01a9da adds .github/workflows/secret-scan.yml:60 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: a01a9daaea08; files: .github/workflows/secret-scan.yml)

Labels

Label changes:

• add P3: Routine action-pin maintenance with identical executed action code and no demonstrated user-facing regression.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P3: Routine action-pin maintenance with identical executed action code and no demonstrated user-facing regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 22, 2026, 2:57 PM ET / 18:57 UTC.