Skip to content

build(deps): bump the github-actions group with 2 updates#142

Merged
steipete-oai merged 1 commit into
mainfrom
dependabot/github_actions/github-actions-a7975e041c
Jun 30, 2026
Merged

build(deps): bump the github-actions group with 2 updates#142
steipete-oai merged 1 commit into
mainfrom
dependabot/github_actions/github-actions-a7975e041c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 2 updates: actions/checkout and trufflesecurity/trufflehog.

Updates actions/checkout from 6 to 7

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

Full Changelog: actions/checkout@v6...v6.0.1

Commits

Updates trufflesecurity/trufflehog from 3.95.5 to 3.95.6

Release notes

Sourced from trufflesecurity/trufflehog's releases.

v3.95.6

What's Changed

New Contributors

Full Changelog: trufflesecurity/trufflehog@v3.95.4...v3.95.6

Commits
  • 30d5bb9 S3: surface bucket listing failures and fix multi-role object count (#5035)
  • f0739f1 close todo - embed small HTTP test fixtures (#5001)
  • 36d680a add filetype=sdist param so we get the correct response code (#4988)
  • 248ffd5 fix(dropbox): prevent long sl.u. tokens from being truncated before verificat...
  • afbdaa8 Fix: Resolve known dedup issues in notifierWorker (#5028)
  • 7bcf376 [INS-472] [INS-515] Add user detector to defaults.go, gate it behind feat fla...
  • 84a2b33 Fix Renovate lookup: update setup-captain version comment (#4999)
  • ac0805e [INS-469] Added Rev detectors to defaults.go and gated it behind feature flag...
  • d03d087 GitHub finegrain analyzer was improperly handling errors (#4498)
  • b64cefe set redacted value to last 4 characters of secret, to match how the secret ty...
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the github-actions group with 2 updates
b7d5520 
Bumps the github-actions group with 2 updates: [actions/checkout](https://github.com/actions/checkout) and [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog).


Updates `actions/checkout` from 6 to 7
- [Release notes](https://github.com/actions/checkout/releases)
- [Commits](actions/checkout@v6...v7)

Updates `trufflesecurity/trufflehog` from 3.95.5 to 3.95.6
- [Release notes](https://github.com/trufflesecurity/trufflehog/releases)
- [Commits](trufflesecurity/trufflehog@v3.95.5...v3.95.6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: trufflesecurity/trufflehog
  dependency-version: 3.95.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jun 22, 2026
@dependabot dependabot Bot requested a review from a team as a code owner June 22, 2026 16:08
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jun 22, 2026
@clawsweeper

clawsweeper Bot commented Jun 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs changes before merge. Reviewed June 29, 2026, 12:15 PM ET / 16:15 UTC.

Summary
The PR updates seven GitHub Actions workflow files from actions/checkout v6 to v7 and trufflesecurity/trufflehog from v3.95.5 to v3.95.6.

Reproducibility: not applicable. This PR is dependency maintenance rather than a bug report with runtime reproduction steps. Review used the diff, current main workflow references, upstream tag checks, and GitHub status rollup.

Review metrics: 2 noteworthy metrics.

  • Workflow files changed: 7 modified. The update reaches CI, CodeQL, dependency review, release, Pages, Crabbox hydration, and secret scanning workflows.
  • Observed checks: 7 successful check runs. The visible rollup covers several changed workflows but not every manual, tag, or Pages path touched by the diff.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • Update the two SHA-pinned checkout comments from # v6 to # v7.
  • Maintainers should accept or separately verify the release, Pages, and Crabbox workflow paths that did not run in the PR rollup.

Risk before merge

  • [P1] The actions/checkout semver-major bump reaches release, Pages, and Crabbox workflow paths that are not exercised by the visible PR check rollup.
  • [P1] The two stale # v6 comments on SHA-pinned checkout refs can mislead future workflow audits until repaired.

Maintainer options:

  1. Fix the pinned comments first (recommended)
    Update the CodeQL and dependency-review checkout comments so the pinned v7 SHA has a matching # v7 audit hint before merge.
  2. Accept the unexercised workflow risk
    Maintainers may merge after the comment fix based on the passing exercised checks while owning the release, Pages, and Crabbox paths that did not run in the PR rollup.
Copy recommended automerge instruction 
@clawsweeper automerge

Special instructions:
Update `.github/workflows/codeql.yml` and `.github/workflows/dependency-review.yml` so the trailing comment on `actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0` says `# v7`, with no other workflow or dependency changes.

Next step before merge

  • [P2] A repair worker can safely update the two stale trailing comments; maintainers still own accepting the unexercised workflow paths.

Security
Cleared: No concrete supply-chain regression was found in the narrow action-version update after checking changed workflow permissions, upstream tag targets, and PR checks.

Review findings

  • [P3] Update the CodeQL checkout comment to v7 — .github/workflows/codeql.yml:65
  • [P3] Update the dependency-review checkout comment to v7 — .github/workflows/dependency-review.yml:21
Review details

Best possible solution:

Keep the dependency bump, update the two SHA-pinned checkout comments to # v7, then merge once maintainers accept or separately verify the unexercised workflow paths.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR is dependency maintenance rather than a bug report with runtime reproduction steps. Review used the diff, current main workflow references, upstream tag checks, and GitHub status rollup.

Is this the best way to solve the issue?

Mostly yes: Dependabot is the normal maintainable path for this dependency group, and the narrow repair is to make the pinned SHA comments match v7 rather than changing workflow structure.

Full review comments:

  • [P3] Update the CodeQL checkout comment to v7 — .github/workflows/codeql.yml:65
    This line now pins actions/checkout to the upstream v7 tag SHA, but the trailing comment still says # v6. That mismatch makes pinned workflow audits misleading; update the comment to # v7.
    Confidence: 0.95
  • [P3] Update the dependency-review checkout comment to v7 — .github/workflows/dependency-review.yml:21
    This line now pins actions/checkout to the upstream v7 tag SHA, but the trailing comment still says # v6. That mismatch makes pinned workflow audits misleading; update the comment to # v7.
    Confidence: 0.95

Overall correctness: patch is correct
Overall confidence: 0.92

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 24763d26cdff.

Label changes

Label justifications:

  • P3: This is routine dependency maintenance with a narrow auditability repair and limited user-facing blast radius.
  • merge-risk: 🚨 automation: The diff changes GitHub Actions behavior, including release, Pages, and Crabbox paths that passing PR checks do not fully settle.
  • rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Dependabot bot dependency PRs are not subject to contributor real-behavior proof gating; GitHub workflow checks are supplemental validation here.
Evidence reviewed

Acceptance criteria:

  • [P1] rg -n "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7" .github/workflows/codeql.yml .github/workflows/dependency-review.yml.
  • [P1] git diff --check.

What I checked:

  • Repository policy read: AGENTS.md was present and read fully; its workflow and security guidance informed the review of this GitHub Actions dependency update. (AGENTS.md:1, 24763d26cdff)
  • Current main is not already updated: Current main still references actions/checkout@v6, the v6 checkout SHA comment, and trufflesecurity/trufflehog@v3.95.5 in the affected workflows. (.github/workflows/secret-scan.yml:49, 24763d26cdff)
  • PR diff scope: The PR modifies 7 workflow files with 8 additions and 8 deletions, limited to checkout and TruffleHog action references. (b7d552052958)
  • CodeQL pinned comment mismatch: The proposed CodeQL workflow pins actions/checkout to 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 but leaves the trailing comment as # v6. (.github/workflows/codeql.yml:65, b7d552052958)
  • Dependency-review pinned comment mismatch: The proposed dependency-review workflow pins actions/checkout to 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 but leaves the trailing comment as # v6. (.github/workflows/dependency-review.yml:21, b7d552052958)
  • Upstream tag check: The upstream actions/checkout v7 and v7.0.0 tags both resolve to 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0, matching the PR's pinned SHA references.

Likely related people:

  • steipete: The affected workflow lines blame to the v0.7.0 release commit authored by Peter Steinberger, and GitHub PR history shows steipete merged prior workflow dependency bumps touching CodeQL, dependency review, and TruffleHog. (role: workflow area contributor and merger; confidence: high; commits: 0cd24d07a262, 2876b8b683ad; files: .github/workflows/codeql.yml, .github/workflows/dependency-review.yml, .github/workflows/secret-scan.yml)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@clawsweeper clawsweeper Bot added rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. merge-risk: 🚨 automation 🚨 Merging this PR could break CI, automerge, proof capture, label sync, or automation. labels Jun 22, 2026
@steipete-oai steipete-oai merged commit 2ee188e into main Jun 30, 2026
7 checks passed
@dependabot dependabot Bot deleted the dependabot/github_actions/github-actions-a7975e041c branch June 30, 2026 23:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code merge-risk: 🚨 automation 🚨 Merging this PR could break CI, automerge, proof capture, label sync, or automation. P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@steipete-oai