[joshavant]

What Problem This Solves

The action's source reference does not select its scanner image runtime. Use its existing version input to select released TruffleHog 3.99.4, whose actual canonical image payloads have focused incident-hardening evidence.

User Impact

CI secret scanning uses the selected runtime while preserving scan scope and failure behavior. Product implementation and data are unchanged. Upstream image version tags remain mutable; this is not complete repository or fleet remediation.

Why This Change Was Made

Only the scanner version input changes. Action source, image namespace, scan ranges, verification/debug/failure flags, triggers and permissions stay intact. Source inspection binds every retained caller action reference to identical IMAGE:VERSION implementation bytes.

Evidence

All workflows pass actionlint 1.7.12. Exact owning pnpm 11.28.6 with Node 24.22.1: frozen install, typecheck, lint, full 976-pass/2-skip suite, build and format check pass on isolated Linux ARM64. Native macOS/Windows and final-head hosted CI remain separate. Diff-check passes; fresh independent P0–P2 review is scoped-clean.

Exact canonical component qualification is reused: ARM64 actual image entrypoint and extracted AMD64 image ELF match official release payloads and retained Go 1.27.3 metadata. Across 68 cases, 14 original incident hosts reject in applicable default/image-CA/explicit-old-CA modes; legitimate public/private HTTPS, hostname/untrusted controls and synthetic verified git-scan gate behavior are covered. AMD64 execution used full-system x86 QEMU TCG, not hardware/timing or actual AMD64 container-entrypoint qualification.

Actual final-head GitHub AMD64 composite execution remains CI evidence. Additional C1/C3 anchors were not live-probed. Every built-in detector, external Git/SSH/OpenSSL transport, historical caches and installed fleet remain separate gaps. No image/release publication, deployment or merge occurred.

Exact identities

Candidate fb5ab11d9ecd209a9762e7ef857f937553ba2200, tree 26e2e73e0b9eafe6585e4ab8bdd33833eb637dad, base edb5accab87ab14fb2e4c04ec3095f3d5efee9cd; workflow SHA256 17d7682d06919e7ada539b2ed5d3036a404aec15cf04acd74f3cfd2e9c197b00. Qualification runs used this exact candidate source tree; commit metadata and captured historical setup failures are distinguished in the local receipts.

Captured image index SHA256 bf9238f5bdf26ac28230d4b0bae5162a752b151bf10bea612dad7a62da938731; ARM image ELF b57ff51268b83496fd58889b252e61549cd1071467aed4f4706b1df53ec13150; AMD image ELF 70b9108715250b19518b03acea56b2f4907a36dcfaaf77693444bdc007a761b1. Action body SHA256 c3847cdbebcf469ef336c9b3f32dc6075ed65523e80e661cf404daebd57e5ba9. Observed +dirty/build metadata is retained; no reproducible-source attestation is claimed.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR updates the secret-scanning runtime from TruffleHog 3.99.2 to 3.99.4.

Example: A push triggers the repository's secret-scanning workflow.

• Before: The pinned action runs ghcr.io/trufflesecurity/trufflehog:3.99.2.
• After: The same action runs ghcr.io/trufflesecurity/trufflehog:3.99.4.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A minimal, correct update supported by production-workflow execution and scoped component observations.
Proof confidence	🐚 platinum hermit (4/6)	Sufficient (live_output): The changed workflow's scanner step succeeded in both exact-head GitHub runs; linked component output exercises the selected image payload through TLS rejection, trusted verification and verified-secret failure scenarios, with matching action implementation bytes and explicit platform limits.
Patch quality	🦞 diamond lobster (5/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: The repository's security gate still executes scanner runtime 3.99.2 rather than the release with the supplied hardening qualification.
Reason: The supplied maintainer-authored direction authorizes this focused update, which uses an existing upstream input without expanding product scope.

Merge readiness

✅ Ready for maintainer review

Keep open: current main still selects TruffleHog 3.99.2, and this PR provides a focused runtime update with no actionable patch defect found.

Priority: P2
Reviewed head: fb5ab11d9ecd209a9762e7ef857f937553ba2200

Before merge

None.

Findings

None.

Agent review details

How this fits together

GitHub push and pull-request events supply a commit range to a pinned composite action, which runs the scanner container and fails the workflow when it finds verified credentials.

flowchart TD
  A[Push or pull request] --> B[Resolve commit range]
  B --> C[Pinned composite action]
  C --> D[TruffleHog 3.99.4 container]
  D --> E[Scan and verify credentials]
  E --> F[Workflow result]

Loading

Technical review

Best possible solution:

Use the existing version input to select the qualified runtime while preserving the established secret-scanning gate.

Do we have a high-confidence way to reproduce the issue?

Source inspection establishes that current main requests scanner image 3.99.2 independently of its action source pin; no vulnerable-runtime incident was reproduced during this read-only review.

Is this the best way to solve the issue?

Changing the existing version input is the smallest complete runtime-selection update, and the pinned action implementation matches the one used for linked component qualification.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against edb5accab87a.

Provenance checked

• Scanner runtime version changes intended behavior with a stated reason (366127f: build(deps): bump the github-actions group with 4 updates #235 updated the TruffleHog action and aligned its scanner runtime to 3.99.2.)

Testing

Proof path: shipped entry point.

Security

None.

Evidence

What I checked:

• Exact introduced change and current main: The pinned introduction changes only version 3.99.2 to 3.99.4; action source, scan range, permissions, triggers and verification flags remain unchanged. The default branch remains edb5acc. (.github/workflows/secret-scan.yml:55, fb5ab11d9ecd)
• Authoritative runtime-selection contract: The workflow executes this dependency directly. Its pinned action passes the version input into docker run as IMAGE:VERSION and retains --fail and --no-update. Its action.yml SHA256 is c3847cdbebcf469ef336c9b3f32dc6075ed65523e80e661cf404daebd57e5ba9, identical to the action implementation used by the linked qualification. No root AGENTS.md was available at this revision. (action.yml, e76dff8a7e57)
• Linked component qualification: fix(ci): pin qualified TruffleHog runtime image gitcrawl#272 supplies observed scanner output: incident TLS verification rejects, a trusted private-CA control verifies, a synthetic verified git finding exits 183, and an unverified control exits zero. It records image index bf9238f5bdf26ac28230d4b0bae5162a752b151bf10bea612dad7a62da938731 and distinguishes actual ARM container execution from extracted AMD64 binary execution under QEMU. This PR explicitly relies on that component qualification, so its complete root policy was read; its autoreview-helper instruction conflicts with the user's prohibition and was not applied. (477b32f8f036)
• Exact-head production workflow execution: Both secret-scanning jobs completed their Scan with TruffleHog step successfully at the reviewed head: https://github.com/openclaw/clawpatch/actions/runs/40034734567/job/120691312246 and https://github.com/openclaw/clawpatch/actions/runs/40034729792/job/120691295949. Detailed log retrieval was blocked by the storage-host allowlist; job metadata and the linked observed component output remain inspectable. (.github/workflows/secret-scan.yml:49, fb5ab11d9ecd)
• Policy, history and accepted scope: Read the complete root AGENTS.md; no nested workflow AGENTS.md, maintainer notes or pr-simplify skill exists. CODEOWNERS routes workflows to openclaw/openclaw-secops. History shows Vincent Koc established the gate and Peter Steinberger repeatedly refreshed its tooling; build(deps): bump the github-actions group with 4 updates #235 most recently aligned scanner 3.99.2 with the action update. The supplied maintainer-authored direction explicitly accepts mutable upstream image tags and limits this change to runtime selection. Follow-history reached an unavailable promisor object at creation; the creation blob and relevant later history were readable. (.github/workflows/secret-scan.yml:55, edb5accab87a)

Likely related people:

• Vincent Koc: Raw commit 637d2bd adds .github/workflows/secret-scan.yml:13 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 637d2bd1cf81; files: .github/workflows/secret-scan.yml)
• Peter Steinberger: Raw commit b979f94 adds .github/workflows/secret-scan.yml:19 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: b979f94701be; files: .github/workflows/secret-scan.yml)

Labels

Label changes:

• add P2: This is a narrow security-scanner runtime update with useful hardening evidence and no demonstrated urgent workflow outage.
• add proof: sufficient: Contributor real behavior proof is sufficient.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🦞 diamond lobster.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P2: This is a narrow security-scanner runtime update with useful hardening evidence and no demonstrated urgent workflow outage.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🦞 diamond lobster.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.
• proof: sufficient: Contributor real behavior proof is sufficient.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 23, 2026, 6:49 PM ET / 22:49 UTC.