build(deps): bump the github-actions group with 2 updates

[dependabot]

Bumps the github-actions group with 2 updates: actions/checkout and trufflesecurity/trufflehog.

Updates actions/checkout from 6 to 7

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

• block checking out fork pr for pull_request_target and workflow_run by @​aiqiaoy in actions/checkout#2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in actions/checkout#2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in actions/checkout#2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in actions/checkout#2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in actions/checkout#2459
• upgrade module to esm and update dependencies by @​aiqiaoy in actions/checkout#2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in actions/checkout#2462
• getting ready for checkout v7 release by @​aiqiaoy in actions/checkout#2464
• update error wording by @​aiqiaoy in actions/checkout#2467

New Contributors

• @​aiqiaoy made their first contribution in actions/checkout#2454

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.0.3

What's Changed

• Update changelog by @​ericsciple in actions/checkout#2357
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in actions/checkout#2414
• Fix checkout init for SHA-256 repositories by @​yaananth in actions/checkout#2439
• Update changelog for v6.0.3 by @​yaananth in actions/checkout#2446

New Contributors

• @​yaananth made their first contribution in actions/checkout#2414

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

• Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by @​TingluoHuang in actions/checkout#2355
• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in actions/checkout#2356

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

• Update all references from v5 and v4 to v6 by @​ericsciple in actions/checkout#2314
• Add worktree support for persist-credentials includeIf by @​ericsciple in actions/checkout#2327
• Clarify v6 README by @​ericsciple in actions/checkout#2328

Full Changelog: actions/checkout@v6...v6.0.1

Commits

• 9c091bb update error wording (#2467)
• 1044a6d getting ready for checkout v7 release (#2464)
• f028218 Bump the minor-npm-dependencies group across 1 directory with 3 updates (#2462)
• d914b26 upgrade module to esm and update dependencies (#2463)
• 537c7ef Bump @​actions/core and @​actions/tool-cache and Remove uuid (#2459)
• 130a169 Bump js-yaml from 4.1.0 to 4.2.0 (#2461)
• 7d09575 Bump flatted from 3.3.1 to 3.4.2 (#2460)
• 0f9f3aa Bump actions/publish-immutable-action (#2458)
• f9e715a block checking out fork pr for pull_request_target and workflow_run (#2454)
• See full diff in compare view

Updates trufflesecurity/trufflehog from 3.95.5 to 3.95.6

Release notes

Sourced from trufflesecurity/trufflehog's releases.

v3.95.6

What's Changed

• Enigma detector enhance verification to prevent false verified findings by @​shahzadhaider1 in trufflesecurity/trufflehog#5011
• fix: scan files with lines exceeding bufio's default 64 KB token limit by @​MuneebUllahKhan222 in trufflesecurity/trufflehog#5022
• fix(postgres): honor ignore tags for default port URLs by @​Dawn-Fighter in trufflesecurity/trufflehog#4968
• Move to github.com/moby/moby/client from docker/docker by @​trufflesteeeve in trufflesecurity/trufflehog#4987
• fix: avoid terminal probes before CLI output by @​Hackerchen716 in trufflesecurity/trufflehog#4994
• Update test containers dependency by @​trufflesteeeve in trufflesecurity/trufflehog#4978
• Re-host pkg/handlers JSON test fixtures under the org by @​amanfcp in trufflesecurity/trufflehog#5023
• [INS-465] Add datadogapikey detector to defaults.go by @​mustansir14 in trufflesecurity/trufflehog#4969
• [INS-470] Add Tly detector to defaults.go, gate it behind feat flag and update its verification logic by @​MuneebUllahKhan222 in trufflesecurity/trufflehog#5006
• [INS-473] Add wit detector to defaults.go, gate it behind feat flag and update verification logic by @​MuneebUllahKhan222 in trufflesecurity/trufflehog#5008
• Updating Klaviyo PK new format by @​breetan in trufflesecurity/trufflehog#5009
• Restructure Klaviyo detector pattern tests by @​martinlocklear in trufflesecurity/trufflehog#5026
• Replace Renovate config with shared preset (high-risk tier) by @​bryanbeverly in trufflesecurity/trufflehog#4992
• set redacted value to last 4 characters of secret, to match how the secret type admin interface displays it by @​jordanTunstill in trufflesecurity/trufflehog#5027
• GitHub finegrained analyzer was improperly handling errors by @​dustin-decker in trufflesecurity/trufflehog#4498
• [INS-469] Added Rev detectors to defaults.go and gated it behind feature flag by @​MuneebUllahKhan222 in trufflesecurity/trufflehog#5005
• Fix Renovate lookup: update setup-captain version comment by @​bryanbeverly in trufflesecurity/trufflehog#4999
• [INS-472] [INS-515] Add user detector to defaults.go, gate it behind feat flag, update verification logic and add custom ep configuration by @​MuneebUllahKhan222 in trufflesecurity/trufflehog#5007
• Fix: Resolve known dedup issues in notifierWorker by @​MuneebUllahKhan222 in trufflesecurity/trufflehog#5028
• fix(dropbox): prevent long sl.u. tokens from being truncated by @​lukem-ts in trufflesecurity/trufflehog#5012
• fix: add filetype=sdist param to pypi detector by @​lukem-ts in trufflesecurity/trufflehog#4988
• Handlers - Embed small HTTP test fixtures by @​amanfcp in trufflesecurity/trufflehog#5001
• S3: surface bucket listing failures and fix multi-role object count by @​shahzadhaider1 in trufflesecurity/trufflehog#5035

New Contributors

• @​Dawn-Fighter made their first contribution in trufflesecurity/trufflehog#4968
• @​Hackerchen716 made their first contribution in trufflesecurity/trufflehog#4994
• @​breetan made their first contribution in trufflesecurity/trufflehog#5009
• @​lukem-ts made their first contribution in trufflesecurity/trufflehog#5012

Full Changelog: trufflesecurity/trufflehog@v3.95.4...v3.95.6

Commits

• 30d5bb9 S3: surface bucket listing failures and fix multi-role object count (#5035)
• f0739f1 close todo - embed small HTTP test fixtures (#5001)
• 36d680a add filetype=sdist param so we get the correct response code (#4988)
• 248ffd5 fix(dropbox): prevent long sl.u. tokens from being truncated before verificat...
• afbdaa8 Fix: Resolve known dedup issues in notifierWorker (#5028)
• 7bcf376 [INS-472] [INS-515] Add user detector to defaults.go, gate it behind feat fla...
• 84a2b33 Fix Renovate lookup: update setup-captain version comment (#4999)
• ac0805e [INS-469] Added Rev detectors to defaults.go and gated it behind feature flag...
• d03d087 GitHub finegrain analyzer was improperly handling errors (#4498)
• b64cefe set redacted value to last 4 characters of secret, to match how the secret ty...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[clawsweeper]

Codex review: needs changes before merge. Reviewed June 29, 2026, 12:15 PM ET / 16:15 UTC.

Summary
The PR updates seven GitHub Actions workflow files from actions/checkout v6 to v7 and trufflesecurity/trufflehog from v3.95.5 to v3.95.6.

Reproducibility: not applicable. This PR is dependency maintenance rather than a bug report with runtime reproduction steps. Review used the diff, current main workflow references, upstream tag checks, and GitHub status rollup.

Review metrics: 2 noteworthy metrics.

• Workflow files changed: 7 modified. The update reaches CI, CodeQL, dependency review, release, Pages, Crabbox hydration, and secret scanning workflows.
• Observed checks: 7 successful check runs. The visible rollup covers several changed workflows but not every manual, tag, or Pages path touched by the diff.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• Update the two SHA-pinned checkout comments from # v6 to # v7.
• Maintainers should accept or separately verify the release, Pages, and Crabbox workflow paths that did not run in the PR rollup.

Risk before merge

• [P1] The actions/checkout semver-major bump reaches release, Pages, and Crabbox workflow paths that are not exercised by the visible PR check rollup.
• [P1] The two stale # v6 comments on SHA-pinned checkout refs can mislead future workflow audits until repaired.

Maintainer options:

1. Fix the pinned comments first (recommended)
   Update the CodeQL and dependency-review checkout comments so the pinned v7 SHA has a matching # v7 audit hint before merge.
2. Accept the unexercised workflow risk
   Maintainers may merge after the comment fix based on the passing exercised checks while owning the release, Pages, and Crabbox paths that did not run in the PR rollup.

Copy recommended automerge instruction

@clawsweeper automerge

Special instructions:
Update `.github/workflows/codeql.yml` and `.github/workflows/dependency-review.yml` so the trailing comment on `actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0` says `# v7`, with no other workflow or dependency changes.

Next step before merge

• [P2] A repair worker can safely update the two stale trailing comments; maintainers still own accepting the unexercised workflow paths.

Security
Cleared: No concrete supply-chain regression was found in the narrow action-version update after checking changed workflow permissions, upstream tag targets, and PR checks.

Review findings

• [P3] Update the CodeQL checkout comment to v7 — .github/workflows/codeql.yml:65
• [P3] Update the dependency-review checkout comment to v7 — .github/workflows/dependency-review.yml:21

Review details

Best possible solution:

Keep the dependency bump, update the two SHA-pinned checkout comments to # v7, then merge once maintainers accept or separately verify the unexercised workflow paths.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR is dependency maintenance rather than a bug report with runtime reproduction steps. Review used the diff, current main workflow references, upstream tag checks, and GitHub status rollup.

Is this the best way to solve the issue?

Mostly yes: Dependabot is the normal maintainable path for this dependency group, and the narrow repair is to make the pinned SHA comments match v7 rather than changing workflow structure.

Full review comments:

• [P3] Update the CodeQL checkout comment to v7 — .github/workflows/codeql.yml:65
  This line now pins actions/checkout to the upstream v7 tag SHA, but the trailing comment still says # v6. That mismatch makes pinned workflow audits misleading; update the comment to # v7.
  Confidence: 0.95
• [P3] Update the dependency-review checkout comment to v7 — .github/workflows/dependency-review.yml:21
  This line now pins actions/checkout to the upstream v7 tag SHA, but the trailing comment still says # v6. That mismatch makes pinned workflow audits misleading; update the comment to # v7.
  Confidence: 0.95

Overall correctness: patch is correct
Overall confidence: 0.92

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 24763d26cdff.

Label changes

Label justifications:

• P3: This is routine dependency maintenance with a narrow auditability repair and limited user-facing blast radius.
• merge-risk: 🚨 automation: The diff changes GitHub Actions behavior, including release, Pages, and Crabbox paths that passing PR checks do not fully settle.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Dependabot bot dependency PRs are not subject to contributor real-behavior proof gating; GitHub workflow checks are supplemental validation here.

Evidence reviewed

Acceptance criteria:

• [P1] rg -n "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7" .github/workflows/codeql.yml .github/workflows/dependency-review.yml.
• [P1] git diff --check.

What I checked:

• Repository policy read: AGENTS.md was present and read fully; its workflow and security guidance informed the review of this GitHub Actions dependency update. (AGENTS.md:1, 24763d26cdff)
• Current main is not already updated: Current main still references actions/checkout@v6, the v6 checkout SHA comment, and trufflesecurity/trufflehog@v3.95.5 in the affected workflows. (.github/workflows/secret-scan.yml:49, 24763d26cdff)
• PR diff scope: The PR modifies 7 workflow files with 8 additions and 8 deletions, limited to checkout and TruffleHog action references. (b7d552052958)
• CodeQL pinned comment mismatch: The proposed CodeQL workflow pins actions/checkout to 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 but leaves the trailing comment as # v6. (.github/workflows/codeql.yml:65, b7d552052958)
• Dependency-review pinned comment mismatch: The proposed dependency-review workflow pins actions/checkout to 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 but leaves the trailing comment as # v6. (.github/workflows/dependency-review.yml:21, b7d552052958)
• Upstream tag check: The upstream actions/checkout v7 and v7.0.0 tags both resolve to 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0, matching the PR's pinned SHA references.

Likely related people:

• steipete: The affected workflow lines blame to the v0.7.0 release commit authored by Peter Steinberger, and GitHub PR history shows steipete merged prior workflow dependency bumps touching CodeQL, dependency review, and TruffleHog. (role: workflow area contributor and merger; confidence: high; commits: 0cd24d07a262, 2876b8b683ad; files: .github/workflows/codeql.yml, .github/workflows/dependency-review.yml, .github/workflows/secret-scan.yml)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.