From 477b32f8f03608d354ed38917c46d7fde9d9f3ec Mon Sep 17 00:00:00 2001
From: joshavant <830519+joshavant@users.noreply.github.com>
Date: Fri, 23 Oct 2026 15:56:22 -0500
Subject: [PATCH] fix(ci): pin qualified TruffleHog runtime image

---
 .github/workflows/secret-scan.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index 28ed69b1..5df3f753 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -51,6 +51,7 @@ jobs:
         id: trufflehog
         uses: trufflesecurity/trufflehog@e63326d6545de8f425d93ce24078c6e68d83f70e # v3.99.3
         with:
+          version: "3.99.4"
           path: ./
           base: ${{ steps.scan_range.outputs.base }}
           head: ${{ steps.scan_range.outputs.head }}