chore(deps): bump the actions group with 3 updates (#17)

Bumps the actions group with 3 updates:
[actions/checkout](https://github.com/actions/checkout),
[erlef/setup-beam](https://github.com/erlef/setup-beam) and
[trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog).

Updates `actions/checkout` from 4 to 6
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/releases">actions/checkout's
releases</a>.</em></p>
<blockquote>
<h2>v6.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update README to include Node.js 24 support details and requirements
by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li>
<li>Persist creds to a separate file by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li>
<li>v6-beta by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2298">actions/checkout#2298</a></li>
<li>update readme/changelog for v6 by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2311">actions/checkout#2311</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v5.0.0...v6.0.0">https://github.com/actions/checkout/compare/v5.0.0...v6.0.0</a></p>
<h2>v6-beta</h2>
<h2>What's Changed</h2>
<p>Updated persist-credentials to store the credentials under
<code>$RUNNER_TEMP</code> instead of directly in the local git
config.</p>
<p>This requires a minimum Actions Runner version of <a
href="https://github.com/actions/runner/releases/tag/v2.329.0">v2.329.0</a>
to access the persisted credentials for <a
href="https://docs.github.com/en/actions/tutorials/use-containerized-services/create-a-docker-container-action">Docker
container action</a> scenarios.</p>
<h2>v5.0.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Port v6 cleanup to v5 by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v5...v5.0.1">https://github.com/actions/checkout/compare/v5...v5.0.1</a></p>
<h2>v5.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update actions checkout to use node 24 by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li>
<li>Prepare v5.0.0 release by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2238">actions/checkout#2238</a></li>
</ul>
<h2>⚠️ Minimum Compatible Runner Version</h2>
<p><strong>v2.327.1</strong><br />
<a
href="https://github.com/actions/runner/releases/tag/v2.327.1">Release
Notes</a></p>
<p>Make sure your runner is updated to this version or newer to use this
release.</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v4...v5.0.0">https://github.com/actions/checkout/compare/v4...v5.0.0</a></p>
<h2>v4.3.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Port v6 cleanup to v4 by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v4...v4.3.1">https://github.com/actions/checkout/compare/v4...v4.3.1</a></p>
<h2>v4.3.0</h2>
<h2>What's Changed</h2>
<ul>
<li>docs: update README.md by <a
href="https://github.com/motss"><code>@​motss</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li>
<li>Add internal repos for checking out multiple repositories by <a
href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li>
<li>Documentation update - add recommended permissions to Readme by <a
href="https://github.com/benwells"><code>@​benwells</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/checkout/commit/de0fac2e4500dabe0009e67214ff5f5447ce83dd"><code>de0fac2</code></a>
Fix tag handling: preserve annotations and explicit fetch-tags (<a
href="https://redirect.github.com/actions/checkout/issues/2356">#2356</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/064fe7f3312418007dea2b49a19844a9ee378f49"><code>064fe7f</code></a>
Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is
set (...</li>
<li><a
href="https://github.com/actions/checkout/commit/8e8c483db84b4bee98b60c0593521ed34d9990e8"><code>8e8c483</code></a>
Clarify v6 README (<a
href="https://redirect.github.com/actions/checkout/issues/2328">#2328</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/033fa0dc0b82693d8986f1016a0ec2c5e7d9cbb1"><code>033fa0d</code></a>
Add worktree support for persist-credentials includeIf (<a
href="https://redirect.github.com/actions/checkout/issues/2327">#2327</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/c2d88d3ecc89a9ef08eebf45d9637801dcee7eb5"><code>c2d88d3</code></a>
Update all references from v5 and v4 to v6 (<a
href="https://redirect.github.com/actions/checkout/issues/2314">#2314</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/1af3b93b6815bc44a9784bd300feb67ff0d1eeb3"><code>1af3b93</code></a>
update readme/changelog for v6 (<a
href="https://redirect.github.com/actions/checkout/issues/2311">#2311</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/71cf2267d89c5cb81562390fa70a37fa40b1305e"><code>71cf226</code></a>
v6-beta (<a
href="https://redirect.github.com/actions/checkout/issues/2298">#2298</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/069c6959146423d11cd0184e6accf28f9d45f06e"><code>069c695</code></a>
Persist creds to a separate file (<a
href="https://redirect.github.com/actions/checkout/issues/2286">#2286</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493"><code>ff7abcd</code></a>
Update README to include Node.js 24 support details and requirements (<a
href="https://redirect.github.com/actions/checkout/issues/2248">#2248</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/08c6903cd8c0fde910a37f88322edcfb5dd907a8"><code>08c6903</code></a>
Prepare v5.0.0 release (<a
href="https://redirect.github.com/actions/checkout/issues/2238">#2238</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/checkout/compare/v4...v6">compare
view</a></li>
</ul>
</details>
<br />

Updates `erlef/setup-beam` from 1.22.0 to 1.23.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/erlef/setup-beam/releases">erlef/setup-beam's
releases</a>.</em></p>
<blockquote>
<h2>v1.23.0</h2>
<h2>What's Changed</h2>
<h3>Features</h3>
<ul>
<li>feat: add macOS-26 to supported ImageOS mappings by <a
href="https://github.com/petermm"><code>@​petermm</code></a> in <a
href="https://redirect.github.com/erlef/setup-beam/pull/430">erlef/setup-beam#430</a></li>
<li>feat: add Erlang problem matchers by <a
href="https://github.com/Taure"><code>@​Taure</code></a> in <a
href="https://redirect.github.com/erlef/setup-beam/pull/433">erlef/setup-beam#433</a></li>
</ul>
<h3>Fixes</h3>
<ul>
<li>fix: use dynamic import in tests to prevent ESM hoisting race by <a
href="https://github.com/petermm"><code>@​petermm</code></a> in <a
href="https://redirect.github.com/erlef/setup-beam/pull/429">erlef/setup-beam#429</a></li>
<li>fix: download correct Gleam binary for macOS and Linux ARM64 by <a
href="https://github.com/petermm"><code>@​petermm</code></a> in <a
href="https://redirect.github.com/erlef/setup-beam/pull/428">erlef/setup-beam#428</a></li>
<li>Run ARM-specific tests consistently by <a
href="https://github.com/paulo-ferraz-oliveira"><code>@​paulo-ferraz-oliveira</code></a>
in <a
href="https://redirect.github.com/erlef/setup-beam/pull/434">erlef/setup-beam#434</a></li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Compatibility matrix strategy by <a
href="https://github.com/sebastiw"><code>@​sebastiw</code></a> in <a
href="https://redirect.github.com/erlef/setup-beam/pull/389">erlef/setup-beam#389</a></li>
</ul>
<h3>Version updates</h3>
<ul>
<li>Update 3rd party licenses (automation) by <a
href="https://github.com/github-actions"><code>@​github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/erlef/setup-beam/pull/425">erlef/setup-beam#425</a></li>
<li>Bump undici from 6.23.0 to 6.24.0 in the npm_and_yarn group across 1
directory by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/erlef/setup-beam/pull/432">erlef/setup-beam#432</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/petermm"><code>@​petermm</code></a> made
their first contribution in <a
href="https://redirect.github.com/erlef/setup-beam/pull/429">erlef/setup-beam#429</a></li>
<li><a href="https://github.com/Taure"><code>@​Taure</code></a> made
their first contribution in <a
href="https://redirect.github.com/erlef/setup-beam/pull/433">erlef/setup-beam#433</a></li>
<li><a href="https://github.com/sebastiw"><code>@​sebastiw</code></a>
made their first contribution in <a
href="https://redirect.github.com/erlef/setup-beam/pull/389">erlef/setup-beam#389</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/erlef/setup-beam/compare/v1...v1.23.0">https://github.com/erlef/setup-beam/compare/v1...v1.23.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/erlef/setup-beam/commit/ee09b1e59bb240681c382eb1f0abc6a04af72764"><code>ee09b1e</code></a>
Automation: update setup-beam version output to f8b54b5</li>
<li><a
href="https://github.com/erlef/setup-beam/commit/f8b54b559e6123caaab7f1aa113f60a5fad786e6"><code>f8b54b5</code></a>
Run ARM-specific tests consistently (<a
href="https://redirect.github.com/erlef/setup-beam/issues/434">#434</a>)</li>
<li><a
href="https://github.com/erlef/setup-beam/commit/bf1ce7403467d283c9c2f605633ef849ed3781c8"><code>bf1ce74</code></a>
Automation: update setup-beam version output to 559a930</li>
<li><a
href="https://github.com/erlef/setup-beam/commit/559a93075107e8996bed015071364d5b82de6c9a"><code>559a930</code></a>
Bump undici from 6.23.0 to 6.24.0 in the npm_and_yarn group across 1
director...</li>
<li><a
href="https://github.com/erlef/setup-beam/commit/1380ebe712baba142b98b84cf8d62c5235dfafc3"><code>1380ebe</code></a>
Automation: update setup-beam version output to 0a54959</li>
<li><a
href="https://github.com/erlef/setup-beam/commit/0a549596b00a62e47fdaf801584216a26b1831e8"><code>0a54959</code></a>
Compatibility matrix strategy (<a
href="https://redirect.github.com/erlef/setup-beam/issues/389">#389</a>)</li>
<li><a
href="https://github.com/erlef/setup-beam/commit/3a3c94fd9e9380e45cecff3ab9f5b6b9e0d2f6da"><code>3a3c94f</code></a>
Automation: update setup-beam version output to cfafb69</li>
<li><a
href="https://github.com/erlef/setup-beam/commit/cfafb69dddf4265d6e7aa5232514b85b3f829076"><code>cfafb69</code></a>
feat: add Erlang problem matchers (<a
href="https://redirect.github.com/erlef/setup-beam/issues/433">#433</a>)</li>
<li><a
href="https://github.com/erlef/setup-beam/commit/b3cbb6afbf19923100205a2cc9ac78dbc5d87113"><code>b3cbb6a</code></a>
Automation: update setup-beam version output to 2abe6cd</li>
<li><a
href="https://github.com/erlef/setup-beam/commit/2abe6cda7aebef61794fefb3fb28ad5bab8bb158"><code>2abe6cd</code></a>
fix: download correct Gleam binary for macOS and Linux ARM64 (<a
href="https://redirect.github.com/erlef/setup-beam/issues/428">#428</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/erlef/setup-beam/compare/9d5b75ddfda22fb979d2270283237aef8aa68d6b...ee09b1e59bb240681c382eb1f0abc6a04af72764">compare
view</a></li>
</ul>
</details>
<br />

Updates `trufflesecurity/trufflehog` from 3.93.8 to 3.94.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/trufflesecurity/trufflehog/releases">trufflesecurity/trufflehog's
releases</a>.</em></p>
<blockquote>
<h2>v3.94.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Use trContext instead of context throughout Filesystem source by <a
href="https://github.com/camgunz"><code>@​camgunz</code></a> in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4804">trufflesecurity/trufflehog#4804</a></li>
<li>Make naming more consistent in the Filesystem source by <a
href="https://github.com/camgunz"><code>@​camgunz</code></a> in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4805">trufflesecurity/trufflehog#4805</a></li>
<li>Rearrange some method parameters in the Filesystem source by <a
href="https://github.com/camgunz"><code>@​camgunz</code></a> in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4806">trufflesecurity/trufflehog#4806</a></li>
<li>[INS-254] Datadog detector verification fix and endpoint
configuration by <a
href="https://github.com/MuneebUllahKhan222"><code>@​MuneebUllahKhan222</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4616">trufflesecurity/trufflehog#4616</a></li>
<li>[INS-241] Datadogapikey detector by <a
href="https://github.com/MuneebUllahKhan222"><code>@​MuneebUllahKhan222</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4627">trufflesecurity/trufflehog#4627</a></li>
<li>Analysis info now uses snake case by <a
href="https://github.com/MuneebUllahKhan222"><code>@​MuneebUllahKhan222</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4765">trufflesecurity/trufflehog#4765</a></li>
<li>Add anypoint oauth2 detector to defaults.go by <a
href="https://github.com/mustansir14"><code>@​mustansir14</code></a> in
<a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4722">trufflesecurity/trufflehog#4722</a></li>
<li>Update README formatting and CLI help output by <a
href="https://github.com/bryanbeverly"><code>@​bryanbeverly</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4758">trufflesecurity/trufflehog#4758</a></li>
<li>Add test cases for escaped unicode by <a
href="https://github.com/casey-tran"><code>@​casey-tran</code></a> in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4812">trufflesecurity/trufflehog#4812</a></li>
<li>Confine symlink state handling to scanSymlink in Filesystem source
by <a href="https://github.com/camgunz"><code>@​camgunz</code></a> in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4807">trufflesecurity/trufflehog#4807</a></li>
<li>Expand tilde manually in TUI by <a
href="https://github.com/mcastorina"><code>@​mcastorina</code></a> in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4827">trufflesecurity/trufflehog#4827</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/bryanbeverly"><code>@​bryanbeverly</code></a>
made their first contribution in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4758">trufflesecurity/trufflehog#4758</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/trufflesecurity/trufflehog/compare/v3.93.8...v3.94.0">https://github.com/trufflesecurity/trufflehog/compare/v3.93.8...v3.94.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/trufflesecurity/trufflehog/commit/6c64db94d5b2e09d7e0948fb6bd3166cc6fffbc7"><code>6c64db9</code></a>
Expand tilde manually in TUI (<a
href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4827">#4827</a>)</li>
<li><a
href="https://github.com/trufflesecurity/trufflehog/commit/afd5336caad0f61da51750ffe39869974b27b0db"><code>afd5336</code></a>
Confine symlink state handling to scanSymlink in Filesystem source (<a
href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4807">#4807</a>)</li>
<li><a
href="https://github.com/trufflesecurity/trufflehog/commit/d17df4845197a68cbc37d33ad0e7f325b45c0033"><code>d17df48</code></a>
Add test cases for escaped unicode (<a
href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4812">#4812</a>)</li>
<li><a
href="https://github.com/trufflesecurity/trufflehog/commit/aeb12782f0d33a6fea85467d617ad37ea205154b"><code>aeb1278</code></a>
Update README formatting and CLI help output (<a
href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4758">#4758</a>)</li>
<li><a
href="https://github.com/trufflesecurity/trufflehog/commit/42b02effea51fe010d760597336cb42cf58a8daa"><code>42b02ef</code></a>
Add anypoint oauth2 detector to defaults.go (<a
href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4722">#4722</a>)</li>
<li><a
href="https://github.com/trufflesecurity/trufflehog/commit/4860052fc923ce00536db0f7b257092794dbb750"><code>4860052</code></a>
Analysis info now uses snake case (<a
href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4765">#4765</a>)</li>
<li><a
href="https://github.com/trufflesecurity/trufflehog/commit/f9d1850dad54461ed13e442bd4089bd01f04857b"><code>f9d1850</code></a>
[INS-241] Datadogapikey detector (<a
href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4627">#4627</a>)</li>
<li><a
href="https://github.com/trufflesecurity/trufflehog/commit/16d6dcf0006f63105058bd878608005f3e9fc71c"><code>16d6dcf</code></a>
[INS-254] Datadog detector verification fix and endpoint configuration
(<a
href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4616">#4616</a>)</li>
<li><a
href="https://github.com/trufflesecurity/trufflehog/commit/bc31aa9770aede25373edf1ba2f952fed5211866"><code>bc31aa9</code></a>
Rearrange some method parameters in the Filesystem source (<a
href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4806">#4806</a>)</li>
<li><a
href="https://github.com/trufflesecurity/trufflehog/commit/5fb6dfd56a56b19b63d17eeade6ba64ae4eb8d7f"><code>5fb6dfd</code></a>
Make naming more consistent in the Filesystem source (<a
href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4805">#4805</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/trufflesecurity/trufflehog/compare/6c05c4a00b91aa542267d8e32a8254774799d68d...6c64db94d5b2e09d7e0948fb6bd3166cc6fffbc7">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Author: hyperpolymath

.github/workflows/boj-build.yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Trigger BoJ Server (Casket/ssg-mcp)
         run: |

.github/workflows/hypatia-scan.yml

@@ -25,7 +25,7 @@ jobs:
           fetch-depth: 0  # Full history for better pattern analysis
 
       - name: Setup Elixir for Hypatia scanner
-        uses: erlef/setup-beam@9d5b75ddfda22fb979d2270283237aef8aa68d6b # v1.18.2
+        uses: erlef/setup-beam@ee09b1e59bb240681c382eb1f0abc6a04af72764 # v1.18.2
         with:
           elixir-version: '1.19.4'
           otp-version: '28.3'

.github/workflows/quality.yml

@@ -18,7 +18,7 @@ jobs:
           find . -type f -perm /111 -name "*.sh" | head -10 || true
       
       - name: Check for secrets
-        uses: trufflesecurity/trufflehog@6c05c4a00b91aa542267d8e32a8254774799d68d # v3.93.8
+        uses: trufflesecurity/trufflehog@6c64db94d5b2e09d7e0948fb6bd3166cc6fffbc7 # v3.94.0
         with:
           path: ./
           base: ${{ github.event.pull_request.base.sha || github.event.before }}

.github/workflows/secret-scanner.yml

@@ -18,7 +18,7 @@ jobs:
           fetch-depth: 0  # Full history for scanning
 
       - name: TruffleHog Secret Scan
-        uses: trufflesecurity/trufflehog@6c05c4a00b91aa542267d8e32a8254774799d68d # v3
+        uses: trufflesecurity/trufflehog@6c64db94d5b2e09d7e0948fb6bd3166cc6fffbc7 # v3
         with:
           extra_args: --only-verified --fail