Repository navigation
fix(ci): pin qualified TruffleHog runtime image - #272
Conversation
|
🦞👀 Pull request received. I will update this pull request when review starts. ClawSweeper review completeClawSweeper finished reviewing this revision. The review result is being finalized. |
clawsweeper
Bot
added
clawsweeper:intake:bug
|
Codex review: needs maintainer review before merge. What this changesThis PR selects TruffleHog runtime image 3.99.4 through the pinned action’s existing version input. Example: The secret-scanning runner already has a locally cached latest image.
Review scores
ProductKind: Bug fix · Worth it: Yes · Fix scope: Complete Merge readiness✅ Ready for maintainer review Keep open: this PR makes a focused runtime-version repair that current main lacks, and no actionable patch defect was found. Priority: P2 Before mergeNone. FindingsNone. Agent review detailsHow this fits togetherGitHub push and pull-request events provide a commit range to the security workflow, which runs TruffleHog and fails when verified credentials are detected. flowchart TD
A[Push or pull request] --> B[Resolve commit range]
B --> C[Pinned TruffleHog action]
C --> D[Runtime image 3.99.4]
D --> E[Scan and verify credentials]
E --> F[Workflow result]
Technical reviewBest possible solution: Use the existing version input to select the qualified runtime while preserving the established scanning gate. Do we have a high-confidence way to reproduce the issue? The pinned upstream action defaults to latest and invokes docker run without forcing a pull, establishing the cached-image reuse path without executing target code. Is this the best way to solve the issue? The single existing input is the smallest complete fix for explicit runtime selection; it does not claim immutable image identity. AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning medium; reviewed against 440c46c04877. Provenance checked
TestingProof path: shipped entry point. SecurityNone. EvidenceWhat I checked:
Likely related people:
LabelsLabel changes:
Label justifications:
Rating scale6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior. WorkflowClawSweeper edits this one comment on every review. Comment Reviewed October 23, 2026, 5:47 PM ET / 21:47 UTC. |
The pinned TruffleHog action defaults to
latest, so an older cached scanner image can be reused. Select the qualified3.99.4runtime image through the action’s existingversioninput; retain its pinned source, scan range, verification flags and failure gate.Both canonical Linux image payloads match the official release binaries and retained Go1.27.3 build metadata. Focused isolated validation covers the ARM image’s actual entrypoint and extracted AMD64 image binary: 14 incident endpoints using ARM image defaults/explicit old CA and AMD64 explicit image CA/old CA, legitimate public/private HTTPS, hostname/untrusted controls, and the expected git-scan exit183 for a synthetic verified credential. The AMD64 binary runs in a full-system x86_64 guest under QEMU TCG; this is functional proof, not a hardware/timing claim.
All workflows pass actionlint1.7.12, diff-check passes, and independent P0–P3 review is scoped-clean. Actual GitHub AMD64 container execution remains PR-CI evidence. This does not qualify every built-in detector, external Git/SSH transport or installed fleet; the normal upstream version tag remains mutable. No release or deployment was run.
Retained product observations and actual hosted image selection
Field-preserving projections below omit only paths/addresses and synthetic marker contents. Default unknown-issuer is distinguished from explicit-old-store no-valid-chains. The actual hosted AMD64 composite pulled the same captured image index and completed normal secret scanning; it did not execute the incident fixture. Other transport/detector/platform limits above remain.
{ "imageIndexSHA256": "bf9238f5bdf26ac28230d4b0bae5162a752b151bf10bea612dad7a62da938731", "armActualImageEntryPointELF": "b57ff51268b83496fd58889b252e61549cd1071467aed4f4706b1df53ec13150", "observedOutputProjection": [ { "label": "incident-00-default", "exit": 0, "timeout": false, "elapsedSeconds": 1.7013239860534668, "findings": [ { "DetectorName": "CustomRegex", "Verified": false, "VerificationError": "x509: certificate signed by unknown authority", "VerificationFromCache": false } ], "rawStderrSHA256": "b7893489e08cd7e4f2a059f5797cbb2c3c7a42d41e3e9dbca0be84207896775e" }, { "label": "incident-00-oldCA", "exit": 0, "timeout": false, "elapsedSeconds": 1.6995091438293457, "findings": [ { "DetectorName": "CustomRegex", "Verified": false, "VerificationError": "x509: no valid chains built", "VerificationFromCache": false } ], "rawStderrSHA256": "7472876e613798eb505200da3102d2382afca8c8ff741caac675059f2c42abc2" }, { "label": "private-CA", "exit": 0, "timeout": false, "elapsedSeconds": 1.3892931938171387, "findings": [ { "DetectorName": "CustomRegex", "Verified": true, "VerificationFromCache": false } ], "rawStderrSHA256": "6cf40395b7f753746fb704d623733803afda264b460d034e7b741ba075b91fc5" }, { "label": "private-untrusted", "exit": 0, "timeout": false, "elapsedSeconds": 1.3877675533294678, "findings": [ { "DetectorName": "CustomRegex", "Verified": false, "VerificationError": "x509: certificate signed by unknown authority", "VerificationFromCache": false } ], "rawStderrSHA256": "36ea4d7ad2f44d2e1234452c35bac6d75d0001022ea82d1db30ac2950686dd51" }, { "label": "git-verified-gate", "exit": 183, "timeout": false, "elapsedSeconds": 1.4629900455474854, "findings": [ { "DetectorName": "CustomRegex", "Verified": true, "VerificationFromCache": false } ], "rawStderrSHA256": "948bcb0602fbdd61a2479d3653e9ab92da7e56b7b7f524548f5e22b0309ce422" }, { "label": "git-unverified-control", "exit": 0, "timeout": false, "elapsedSeconds": 1.459975004196167, "findings": [], "rawStderrSHA256": "91a3fbd4d0822a73e371daed85be27dec162faf0e918d872e8382df8d8579a82" } ], "hostedAMD64Composite": { "run": "https://github.com/openclaw/gitcrawl/actions/runs/40027780355/job/120668186343", "observedImageDigest": "sha256:bf9238f5bdf26ac28230d4b0bae5162a752b151bf10bea612dad7a62da938731", "version": "3.99.4", "verifiedSecrets": 0, "rawLogSHA256": "9f9cbed8aa241cd1817ef3dc7d647052bef7346a04ad492a752ed5612250ee82", "scope": "normal composite execution from the captured qualified image index; this job did not run the incident fixture" } }