[joshavant]

What Problem This Solves

The action's source reference does not select its scanner image runtime. Use its existing version input to select released TruffleHog 3.99.4, whose actual canonical image payloads have focused incident-hardening evidence.

User Impact

CI secret scanning uses the selected runtime while preserving scan scope and failure behavior. Product implementation and data are unchanged. Upstream image version tags remain mutable; this is not complete repository or fleet remediation.

Why This Change Was Made

Only the scanner version input changes. Action source, image namespace, scan ranges, verification/debug/failure flags, triggers and permissions stay intact. Source inspection binds every retained caller action reference to identical IMAGE:VERSION implementation bytes.

Evidence

All workflows pass actionlint 1.7.12. Required make check passes with isolated Go 1.27.3: module verification/tidiness, vulnerability/deadcode/vet/format checks, full tests, actual local CLI smoke and nonpublishing four-platform snapshot/package generation. Cross-built Darwin files are not native Darwin execution or signing proof. Diff-check passes; fresh independent P0–P2 review is scoped-clean.

Exact canonical component qualification is reused: ARM64 actual image entrypoint and extracted AMD64 image ELF match official release payloads and retained Go 1.27.3 metadata. Across 68 cases, 14 original incident hosts reject in applicable default/image-CA/explicit-old-CA modes; legitimate public/private HTTPS, hostname/untrusted controls and synthetic verified git-scan gate behavior are covered. AMD64 execution used full-system x86 QEMU TCG, not hardware/timing or actual AMD64 container-entrypoint qualification.

Actual final-head GitHub AMD64 composite execution remains CI evidence. Additional C1/C3 anchors were not live-probed. Every built-in detector, external Git/SSH/OpenSSL transport, historical caches and installed fleet remain separate gaps. No image/release publication, deployment or merge occurred.

Exact identities

Prior component-qualified candidate 895302075d9eac85a38019cda6e8546af9585698, tree 64c93d61537888cbf26d636ce211aeb6888dc516, base d27e8ef86b0444724d9920b6e511e27a360a52b6; workflow SHA256 369341df0358341e7dd52645037c8cc85282063df298ec7ba374e71edb845e69. Qualification runs used this exact candidate source tree; commit metadata and captured historical setup failures are distinguished in the local receipts.

Captured image index SHA256 bf9238f5bdf26ac28230d4b0bae5162a752b151bf10bea612dad7a62da938731; ARM image ELF b57ff51268b83496fd58889b252e61549cd1071467aed4f4706b1df53ec13150; AMD image ELF 70b9108715250b19518b03acea56b2f4907a36dcfaaf77693444bdc007a761b1. Action body SHA256 c3847cdbebcf469ef336c9b3f32dc6075ed65523e80e661cf404daebd57e5ba9. Observed +dirty/build metadata is retained; no reproducible-source attestation is claimed.

Strict-base integration validation

Integrated main 9078b970cd102d224cbf84437fc7c6c959ef6cfd without conflicts to address the strict branch-update gate. Current head 04650222df10c73f4f3fe6c54cd0b9c5c9e9517b, tree 350eb4a05ca8a99410ba64ffab9b0f86d8fee2ab. The complete remediation delta against this main is byte-identical to the previously reviewed one-line workflow change (patch SHA256 9a0a931bf12c85a3f08890e5f62ee32b0690d2182b4cf4666be87b4b3def772e); intervening crawlkit/dependency/changelog changes are inherited main.

On this exact current head, required make check passed in an isolated native Linux ARM64 guest using Go 1.27.3: module verification/tidiness, govulncheck, formatting, vet/deadcode, full tests, actual isolated CLI smoke, and nonpublishing Linux/Darwin AMD64/ARM64 snapshot archives plus Linux deb/rpm generation. Tracked files remained clean. No codesigning or publication was enabled. Cross-built macOS artifacts are not native macOS execution proof.

Retained current-head evidence archive SHA256 8d0ecdac25bfd6312b96f265fc8438c219021a388fb318a6d877a32ee8575c5a; snapshot artifact archive SHA256 6c947c6f724f753ec393ad21106cfa966d231c9b683303608b114c69424591e8, with individual payload hashes retained. The previously qualified TruffleHog action/runtime inputs are unchanged and their bounded component proof is reused, not presented as a newly executed detector/fleet qualification. New hosted CI was pending at this update; final-head results and owner approval remain to be checked before landing.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR selects TruffleHog scanner image 3.99.4 through the action’s existing version input.

Example: GitHub Actions runs the secret-scanning workflow.

• Before: The v3.99.2 action requests ghcr.io/trufflesecurity/trufflehog:latest.
• After: The same action requests ghcr.io/trufflesecurity/trufflehog:3.99.4.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A minimal, useful repair supported by observed component behavior and successful current-head workflow execution.
Proof confidence	🐚 platinum hermit (4/6)	Sufficient (live_output): The unchanged composite implementation maps version to the scanner image; linked component output demonstrates 3.99.4 certificate controls and verified-secret exit behavior, and both current-head GitHub jobs successfully execute the production scanner step. This proves the bounded runtime-selection change without claiming fleet remediation or coverage of every detector.
Patch quality	🦞 diamond lobster (5/6)	No actionable review findings were identified.

Product

Kind: Bug fix · Worth it: Yes · Fix scope: Complete
User problem: Updating the scanner action source does not ensure that CI runs the intended scanner image.
Reason: The supplied maintainer-authored direction selects a qualified runtime through an existing input and preserves the gate’s scope and failure contract.

Merge readiness

✅ Ready for maintainer review

Keep open: current main lacks explicit scanner-runtime selection, and this PR supplies a focused, correct repair with passing current-head checks.

Priority: P2
Reviewed head: 04650222df10c73f4f3fe6c54cd0b9c5c9e9517b

Before merge

None.

Findings

None.

Agent review details

How this fits together

Push and pull-request events supply a commit range to the security workflow, which runs the TruffleHog container and fails on verified secrets.

flowchart TD
  A[Push or pull request] --> B[Resolve commit range]
  B --> C[TruffleHog composite action]
  C --> D[Scanner image 3.99.4]
  D --> E[Scan and verify secrets]
  E --> F[Workflow result]

Loading

Technical review

Best possible solution:

Use the existing version input to select the qualified scanner runtime while preserving the established security gate.

Do we have a high-confidence way to reproduce the issue?

The upstream action source shows that omitting version selects latest regardless of the action source tag, and docker run can reuse a cached image.

Is this the best way to solve the issue?

The one-line use of the existing upstream input is the smallest complete repair for explicit scanner-version selection.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against 9078b970cd10.

Provenance checked

• TruffleHog runtime selection changes intended behavior with a stated reason (b5c5183: chore(ci): add security baseline #1 introduced a standalone verified-secret gate and left runtime selection to the upstream default.)

Testing

Proof path: shipped entry point.

Security

None.

Evidence

What I checked:

• Pinned introduced change: The introduced diff adds only version: "3.99.4"; action source, scan range, flags, permissions and failure handling remain intact. Current main still omits this input, and comparison with the previously reviewed head shows no workflow changes. (.github/workflows/secret-scan.yml:57, 04650222df10)
• Authoritative runtime-selection contract: The target workflow executes this dependency directly. Its action defines version with default latest and passes IMAGE:VERSION to docker run. The inspected action body matches the PR’s recorded SHA256 c3847cdbebcf469ef336c9b3f32dc6075ed65523e80e661cf404daebd57e5ba9; no root AGENTS.md exists at this revision. (action.yml:21, e76dff8a7e57)
• Current-head production workflow execution: Both exact-head secret-scanning jobs completed their TruffleHog OSS steps successfully: https://github.com/openclaw/graincrawl/actions/runs/40066743859/job/120791495701 and https://github.com/openclaw/graincrawl/actions/runs/40066740064/job/120791484517. Release-check and the other executed checks now pass; live mergeability is clean. Detailed log retrieval was blocked by the environment’s storage-host allowlist. (.github/workflows/secret-scan.yml:50, 04650222df10)
• Shared scanner component evidence: The linked qualification at fix(ci): pin qualified TruffleHog runtime image gitcrawl#272 supplies observed scanner output: incident certificate rejection, successful private-CA verification, rejection of an untrusted control, verified git-scan exit 183, and an unverified control exit 0. Its hosted composite observation identifies image index bf9238f5bdf26ac28230d4b0bae5162a752b151bf10bea612dad7a62da938731 and version 3.99.4. The stated detector, transport and fleet limits remain explicit. (477b32f8f036)
• Original gate purpose and feature history: chore(ci): add security baseline #1 established verified-secret scanning; subsequent history shows Vincent Koc’s failure-gate hardening and Peter Steinberger’s repeated workflow maintenance. The readable creation blob and current-main blame establish the relevant lines; follow-history traversal stops at an unavailable promisor object near creation. (.github/workflows/secret-scan.yml:50, 9078b970cd10)
• Policy, ownership and accepted scope: No root or workflow-ancestor AGENTS.md, maintainer-notes directory, or pr-simplify skill exists in this checkout. CODEOWNERS routes workflows to openclaw/openclaw-secops. The supplied maintainer-authored direction explicitly accepts a mutable upstream version tag and limits this change to runtime selection; fix: reject compromised eMudhra keys in future CLI builds #127 addresses the separate CLI compiler boundary. (.github/CODEOWNERS:5, 04650222df10)

Likely related people:

• Vincent Koc: Raw commit b5c5183 adds .github/workflows/secret-scan.yml:50 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: b5c5183d9848; files: .github/workflows/secret-scan.yml)
• Peter Steinberger: Raw commit 30407c0 adds .github/workflows/secret-scan.yml:19 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 30407c0c0ce9; files: .github/workflows/secret-scan.yml)

Labels

Label changes:

No label changes.

Label justifications:

• P2: Explicit runtime selection repairs a repository security workflow without evidence of an urgent outage.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🦞 diamond lobster.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.
• proof: sufficient: Contributor real behavior proof is sufficient.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

History

Review history (1 earlier review cycle)

• reviewed 2026-10-23T22:49:27.842Z sha 8953020 :: needs maintainer review before merge. :: none

Reviewed October 24, 2026, 1:36 AM ET / 05:36 UTC (Revision 2).

[joshavant]

@clawsweeper re-review

The strict branch-update gate is addressed by conflict-free integration of main 9078b970cd102d224cbf84437fc7c6c959ef6cfd; current head 04650222df10c73f4f3fe6c54cd0b9c5c9e9517b. The reviewed remediation patch is byte-identical. The body now records full required make check on this exact head, including real isolated CLI smoke and nonpublishing four-target snapshot/package generation, retained artifact hashes, and explicit native-platform/component/fleet limits. Final-head hosted CI is pending; no merge or publication occurred.

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/40067005859
• Updated: 2026-10-24T05:38:16.422Z