chore(deps): bump trufflesecurity/trufflehog from 3.93.4 to 3.93.5 in the actions group - #15
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the actions group with 1 update: [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog). Updates `trufflesecurity/trufflehog` from 3.93.4 to 3.93.5 - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@7c0734f...7cdc7ef) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.93.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
Contributor
Author
|
Looks like trufflesecurity/trufflehog is updatable in another way, so this is no longer needed. |
13 tasks
hyperpolymath
added a commit
that referenced
this pull request
Sep 17, 2026
…821) A caller writes `uses: hyperpolymath/standards/.github/workflows/x.yml@<sha>`. GitHub resolves that at workflow STARTUP and validates the callee against the CALLEE repo's own `.github/workflows/actions.lock` AS IT EXISTS AT THAT SHA. If a reusable here names an action ref the lock at that SHA does not key, every caller pinned there dies before a single job exists. That death is nearly invisible. The run's conclusion is `failure`, NOT `startup_failure`; it has ZERO jobs; its `name` equals its `path`; and neither REST nor GraphQL carries a reason -- only the run page states one. A required context whose workflow dies this way never reports at all, so the gate reads as ABSENT rather than failing and the branch looks clean. That is how this class stays unnoticed while it spreads. Capability is therefore NOT monotonic in time, and it OSCILLATES. Measured across the 84 commits da2c748..317101e: 43 POISON / 41 SELF-CONSISTENT, alternating, because Dependabot bumps a `uses:` inside a reusable without regenerating the lock in the same commit. "Pin to HEAD" is the wrong reflex -- the current tip is itself poison. This gate makes `main` safe to pin to by construction rather than by luck. Contents: scripts/lock-selfcheck.sh Answers one question: is a given commit safe to pin a caller to? Reads git objects only (`git show`), never checks out, fetches or writes, so it is safe against a checkout shared with a live writer. Exit 0 all examined SHAs self-validate, 1 any POISON, 2 misuse. It distinguishes three states that are easy to conflate: POISON (the workflow is keyed but this ref is not listed -- startup-fatal), ABSENT (the workflow has no lock entry at all -- untidy, not fatal), and NO-LOCK (the commit pre-dates the lock regime -- not a defect). Only POISON fails. It compares case-insensitively, because the lockfile lowercases the owner/repo it keys while workflows carry upstream casing, and it normalises subpaths, because `github/codeql-action/upload-sarif@SHA` is keyed as `github/codeql-action@SHA`. Both of those produced false verdicts before they were fixed. .github/workflows/lock-selfcheck.yml Runs it against the commit under test. Deliberately carries NO `paths:` filter: this check is meant to be REQUIRED, and a required check that filters itself off does not report as passing -- it does not report at all, leaving the PR blocked on a context that can never arrive. Also repins three stale lock entries this check flags. codeql-reusable.yml, hypatia-scan-reusable.yml and scorecard-reusable.yml all use github/codeql-action@b96794f0 (v4.38.0, 2026-09-09) while the lock still keyed @cdf488f5 (v4.37.9, 2026-08-26). The workflows are newer and the lock is stale, so the lock is what moves: @cdf488f5 appears 6 times in the lock and is used by ZERO workflow files. The three other stale entries are left untouched on purpose -- they belong to workflows that call no codeql, so widening the diff would buy nothing. KNOWN RED, AND CORRECTLY SO: this gate still fails on a fourth ref. governance-reusable.yml uses denoland/setup-deno@22d081ff, which is both unkeyed and a banned runtime. It is not keyed here deliberately -- keying it would make a banned runtime a required lock key for every caller in the estate. Nor is the job deleted: its name is a required context estate-wide. The step is load-bearing (line 383 runs `deno run` against scripts/check-ts-allowlist.deno.js, which is 360 lines of compiled output from an AffineScript source), so removing it is a compiler-target change, not a text edit. That is task #15. Until #15 lands, this gate reports the deno ref red, and that red is accurate: a caller pinned at such a commit really does die. Landing this advisory-first and marking it required after #15 is a reasonable sequence; so is fixing #15 first. That ordering is an owner call. Claude-Session: https://claude.ai/code/session_01WgqXnnNWBkiKMyUeLqzcuN <!-- SPDX-License-Identifier: CC-BY-SA-4.0 Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk> --> ## Summary <!-- What does this PR do, and why? --> Closes # ## Type of change - [ ] 🐛 Bug fix (non-breaking change that fixes an issue) - [ ] ✨ New feature (non-breaking change that adds functionality) - [ ] 💥 Breaking change (would change existing behaviour) - [ ] 🕳️ Soundness fix (fixes a checker/proof false-negative) - [ ] 📖 Documentation - [ ] 🧹 Refactor / tech debt (behaviour-preserving) - [ ] ⚡ Performance - [ ] 🔧 Build / CI / tooling ## How has this been verified? <!-- Establish ground truth: which tool did you RUN, and what did it report? Don't cite a status doc — cite the command and its output. --> ## Checklist - [ ] My commits are **signed** (`git commit -S`). - [ ] I ran the project's own checks/tests locally and they pass. - [ ] New files carry the correct `SPDX-License-Identifier` (code/config `MPL-2.0`, prose `CC-BY-SA-4.0`); I did not relicense existing files. - [ ] Docs are updated, and no public claim now overstates what the code does. - [ ] I have not introduced a soundness hole (or I have flagged where I might have). ## Notes for reviewers <!-- Anything that needs special attention, follow-up, or context. --> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the actions group with 1 update: trufflesecurity/trufflehog.
Updates
trufflesecurity/trufflehogfrom 3.93.4 to 3.93.5Release notes
Sourced from trufflesecurity/trufflehog's releases.
Commits
7cdc7efFix race condition in release process (#4766)4f1d07fFix typos in comments in json-enumerator source (#4764)4563dde[INS-283] Support following symlinks in filesystem source (#4742)be889faadded rotation on 403s access_refused, this detector considered them indeterm...e3cbb3afix(ftp): set read deadline on connection to prevent indefinite hang (#4759)0de5855[INS-309]updated google api version to v0.259.0 (#4736)ec1d9a6Refactor log package (#4734)7c84b27[INS-246] Add Google Gemini API key detector (#4649)952df70Base64 decoding depth assessment (#4744)3602bbefix(release): Disable docker provenance feature (#4752)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions