build(deps): bump trufflesecurity/trufflehog from 3.97.8 to 3.97.9

[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Bumps trufflesecurity/trufflehog from 3.97.8 to 3.97.9.

Release notes

Sourced from trufflesecurity/trufflehog's releases.

v3.97.9

What's Changed

• [SCAN-162] Add Err() to JobProgress and JobProgressRef by @​dipto-truffle in trufflesecurity/trufflehog#5346
• ci: scope Smoke timeouts to trufflehog runs, not the build by @​bryanbeverly in trufflesecurity/trufflehog#5317
• Update module github.com/aymanbagabas/go-osc52 to v1.2.2 by @​renovate[bot] in trufflesecurity/trufflehog#5252
• Update module github.com/gabriel-vasile/mimetype to v1.4.15 by @​renovate[bot] in trufflesecurity/trufflehog#5283
• make 401s for Basic auth verified false. by @​jordanTunstill in trufflesecurity/trufflehog#5290
• [INT-1088] Add version and comment_number lines to SharePoint source metadata by @​camgunz in trufflesecurity/trufflehog#5348
• Int 595 auth errors by @​shahzadhaider1 in trufflesecurity/trufflehog#5259
• Spruce up Makefile a little by @​camgunz in trufflesecurity/trufflehog#5347

Full Changelog: trufflesecurity/trufflehog@v3.97.8...v3.97.9

Commits

• 4dd8831 Spruce up Makefile a little (#5347)
• 449d8a3 Int 595 auth errors (#5259)
• bad9901 Add version and comment_number lines to SharePoint source metadata (#5348)
• 4b8eb0e make 401s for Basic auth verified false. (#5290)
• bbf9447 Update module github.com/gabriel-vasile/mimetype to v1.4.15 (#5283)
• 16b566b Update module github.com/aymanbagabas/go-osc52 to v1.2.2 (#5252)
• a25ff85 ci: scope Smoke timeouts to trufflehog runs, not the build (#5317)
• ca9d3b3 [SCAN-162] Add Err() to JobProgress and JobProgressRef (#5346)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed October 6, 2026, 6:29 PM ET / 22:29 UTC (Revision 4).

ClawSweeper review

What this changes

Updates Discrawl’s secret-scanning GitHub Action pin from TruffleHog v3.97.8 to v3.97.9.

Merge readiness

✅ Ready for maintainer review

The update remains useful: current main and v0.15.6 retain the older action pin. The published tag matches the proposed SHA, and no introduced correctness or security defect was found.

Priority: P3
Reviewed head: 648cbe54c3c3dab8b5889960753165d395f7651c

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, verified dependency update with no actionable defect found.
Proof confidence	🌊 off-meta tidepool	Not applicable: Dependabot’s routine action-pin update is exempt from contributor runtime proof; the unchanged upstream action contract and successful supplied scan checks are supplemental validation. No stored-data contract changes.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: Dependabot’s routine action-pin update is exempt from contributor runtime proof; the unchanged upstream action contract and successful supplied scan checks are supplemental validation. No stored-data contract changes.
Evidence reviewed	6 items	Exact introduced change: The pinned introduction delta changes only the TruffleHog action SHA and version comment at line 62; scan ranges, arguments, permissions, and failure handling are unchanged. Still needed on main: Fetched main still pins TruffleHog v3.97.8. The same older pin is present in v0.15.6, checked with git show v0.15.6:.github/workflows/secret-scan.yml. Verified dependency identity: GitHub’s v3.97.9 tag resolves directly to the proposed full commit SHA. Dependency inspection applies because the changed workflow directly executes this action.
Findings	None	None.
Security	None	None.

How this fits together

Discrawl’s secret-scanning workflow receives push and pull-request commit ranges and checks them for verified credentials. Its result feeds the repository’s security checks before merging.

flowchart TD
  A[Push or pull request] --> B[Checkout repository history]
  B --> C[Resolve commit range]
  C --> D[TruffleHog action]
  D --> E{Verified secrets found}
  E -->|Yes| F[Fail security check]
  E -->|No| G[Pass security check]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

None.

Technical review

Best possible solution:

Keep the verified SHA-pinned action update while preserving the existing scan contract and restricted permissions.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR updates a dependency reference rather than reporting a reproducible product defect.

Is this the best way to solve the issue?

Yes: changing the existing SHA pin is a focused maintenance path, and the published tag and unchanged action contract support it.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against 76618b71c379.

Labels

Label changes:

No label changes.

Label justifications:

• P3: This is routine maintenance of an existing CI action pin with no demonstrated urgent regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Dependabot’s routine action-pin update is exempt from contributor runtime proof; the unchanged upstream action contract and successful supplied scan checks are supplemental validation. No stored-data contract changes.

Evidence

What I checked:

• Exact introduced change: The pinned introduction delta changes only the TruffleHog action SHA and version comment at line 62; scan ranges, arguments, permissions, and failure handling are unchanged. (.github/workflows/secret-scan.yml:62, 648cbe54c3c3)
• Still needed on main: Fetched main still pins TruffleHog v3.97.8. The same older pin is present in v0.15.6, checked with git show v0.15.6:.github/workflows/secret-scan.yml. (.github/workflows/secret-scan.yml:62, 76618b71c379)
• Verified dependency identity: GitHub’s v3.97.9 tag resolves directly to the proposed full commit SHA. Dependency inspection applies because the changed workflow directly executes this action. (action.yml, 4dd8831c5f12)
• Action contract preserved: The comparison contains no action.yml change, and both revisions report the identical action blob 1e2af3fbb9ef7eb5f19e21af9d0c6c3278de1a73. The inspected composite action accepts Discrawl’s existing inputs and launches the scanner image with version defaulting to latest; this PR updates the action reference without newly introducing that floating image behavior. (action.yml, 4dd8831c5f12)
• Prior merged work and routing: Workflow history shows repeated tooling updates by Peter Steinberger and scan-range work by Vincent Koc. GitHub commit metadata verifies handles steipete and vincentkoc. The related merged updates ci: refresh secret scanning and restore Crabbox provisioning #255 and build(deps): bump trufflesecurity/trufflehog from 3.97.6 to 3.97.8 #259 installed earlier versions and do not supersede this update. Local history listing succeeded, but full blame and some historical patches encountered unavailable promisor objects; GitHub commit patches supplied the focused routing evidence. (.github/workflows/secret-scan.yml, 927244b0f8c8)
• Review continuity and checks: The supplied completed review projection covers the same head with no prior findings or published rank-up moves. Supplied checks include successful secret scans. Live REST inspection confirms this PR remains open and unmerged; an open-PR search found no other TruffleHog update. (648cbe54c3c3)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• vincentkoc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (3 earlier review cycles)

• reviewed 2026-10-03T12:57:05.295Z sha 648cbe5 :: needs maintainer review before merge. :: none
• reviewed 2026-10-05T04:41:49.175Z sha 648cbe5 :: needs maintainer review before merge. :: none
• reviewed 2026-10-06T05:50:19.610Z sha 648cbe5 :: needs maintainer review before merge. :: none

[steipete]

Incorporated into #272, now merged. CodeQL initialization and analysis were updated together to v4.38.2 so their configuration versions match; the same PR includes TruffleHog v3.97.9 and groups future CodeQL updates. The combined head passed CodeQL, secret scans, full CI, and the remote make check gate (86.0% coverage). Thanks for the update.

Closing this separate update as superseded by the verified combined change.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.