build(deps): bump trufflesecurity/trufflehog from 3.97.6 to 3.97.8

[dependabot]

Update the SHA-pinned TruffleHog secret-scanning action from v3.97.6 to v3.97.8 (a5f3de55cc2065ae4dde8fee24076f137fd62fcf, verified against the published tag). Keep the existing scan ranges, inputs, and permissions, and add the maintainer changelog entry. Thanks @dependabot.

No Go dependency versions change. Build, module verification/tidiness, formatting, golangci-lint, vet, staticcheck, gosec, govulncheck, deadcode, smoke, and six-platform snapshot builds passed. Full Linux tests and race coverage passed with 45-minute timeouts (85.9% coverage). Local and final-branch Codex reviews were scoped-clean at P0/P1.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 29, 2026, 9:50 PM ET / September 30, 2026, 01:50 UTC (Revision 3).

ClawSweeper review

What this changes

Updates the SHA-pinned TruffleHog action used by secret-scanning CI from v3.97.6 to v3.97.8 and adds an unreleased changelog entry.

Merge readiness

✅ Ready for maintainer review

Current main still uses TruffleHog v3.97.6. The proposed v3.97.8 action pin matches the published upstream tag, preserves the workflow’s scan settings, and has no supported blocking finding. The earlier review reported no findings.

Priority: P3
Reviewed head: aadd6d415ddece66f5701f437a63585af43f6fb7

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A small, verified action update is supported by successful secret-scan checks and has no identified patch defect.
Proof confidence	🐚 platinum hermit (4/6)	Not applicable: The bot-authored PR is exempt from contributor-run proof; successful secret-scan checks nonetheless exercise the changed CI action. No stored-data contract changes.
Patch quality	🦞 diamond lobster (5/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The bot-authored PR is exempt from contributor-run proof; successful secret-scan checks nonetheless exercise the changed CI action. No stored-data contract changes.
Evidence reviewed	6 items	Introduced change: The pinned merge-base-to-head diff changes only the TruffleHog action SHA and one changelog line. Current main: Current main still pins v3.97.6; the proposed version is therefore not implemented there. Upstream pin: The published v3.97.8 tag resolves to the exact commit pinned by this PR.
Findings	None	None.
Security	None	None.

How this fits together

The secret-scanning workflow receives push and pull request revisions, selects a commit range, and runs TruffleHog against it. Its result determines whether the verified-secret check passes.

flowchart LR
  A[Push or pull request] --> B[Select commit range]
  B --> C[TruffleHog action]
  C --> D[Scan for verified secrets]
  D --> E[CI check result]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Change size	2 files affected; 2 lines added, 1 removed	The change is limited to the action pin and its changelog entry.

Technical review

Best possible solution:

Keep the verified SHA pin and existing scan-range settings, then land the update through normal CI and maintainer review.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a dependency update, not a bug report. The changed secret-scan check completed successfully in the provided check snapshot.

Is this the best way to solve the issue?

Yes. A verified, SHA-pinned action update preserves the workflow’s existing inputs and permissions.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against 4792f2b98465.

Labels

Label changes:

No label changes.

Label justifications:

• P3: This is a narrow CI dependency update with no demonstrated urgent user-facing failure.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🦞 diamond lobster.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The bot-authored PR is exempt from contributor-run proof; successful secret-scan checks nonetheless exercise the changed CI action. No stored-data contract changes.

Evidence

What I checked:

• Introduced change: The pinned merge-base-to-head diff changes only the TruffleHog action SHA and one changelog line. (.github/workflows/secret-scan.yml:62, aadd6d415dde)
• Current main: Current main still pins v3.97.6; the proposed version is therefore not implemented there. (.github/workflows/secret-scan.yml:62, 4792f2b98465)
• Upstream pin: The published v3.97.8 tag resolves to the exact commit pinned by this PR. (a5f3de55cc20)
• Action contract: The v3.97.6 and v3.97.8 action definitions expose the same path, base, head, and extra_args inputs used by this workflow. (action.yml, a5f3de55cc20)
• Workflow history: A prior merged workflow update established the v3.97.6 pin that this PR advances. (.github/workflows/secret-scan.yml:62, 927244b0f8c8)
• Review and checks: The provided earlier ClawSweeper review records no findings; the provided check snapshot shows successful secret-scan runs, with one unrelated test check still in progress. (aadd6d415dde)

Likely related people:

• Peter Steinberger: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (2 earlier review cycles)

• reviewed 2026-09-26T12:55:08.761Z sha 802696f :: needs maintainer review before merge. :: none
• reviewed 2026-09-30T01:18:53.218Z sha 0b5cd10 :: needs maintainer review before merge. :: none

[steipete]

@dependabot rebase