build(deps): bump the github-actions group with 3 updates

[dependabot]

Bumps the github-actions group with 3 updates: github/codeql-action/init, github/codeql-action/analyze and trufflesecurity/trufflehog.

Updates github/codeql-action/init from 4.38.0 to 4.38.1

Release notes

Sourced from github/codeql-action/init's releases.

v4.38.1

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.1 - 18 Sept 2026

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023

... (truncated)

Commits

• 1c5b675 Merge pull request #4152 from github/update-v4.38.1-a65b83a73
• a97cdca Add changelog entry for #4146
• cc6c691 Update changelog for v4.38.1
• a65b83a Merge pull request #4146 from github/henrymercer/per-language-bundles-pr
• 07fa87d Clarify the latest-nightly eligibility exception
• f18f353 Describe the bundle URL resolver
• ecec9b5 Share per-language telemetry fields without renaming
• 79fe3a1 Move download telemetry into the status-report directory
• ead1f7d Rename the platform module
• 549d498 Simplify per-language platform eligibility checks
• Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.38.0 to 4.38.1

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.38.1

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.1 - 18 Sept 2026

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023

... (truncated)

Commits

• 1c5b675 Merge pull request #4152 from github/update-v4.38.1-a65b83a73
• a97cdca Add changelog entry for #4146
• cc6c691 Update changelog for v4.38.1
• a65b83a Merge pull request #4146 from github/henrymercer/per-language-bundles-pr
• 07fa87d Clarify the latest-nightly eligibility exception
• f18f353 Describe the bundle URL resolver
• ecec9b5 Share per-language telemetry fields without renaming
• 79fe3a1 Move download telemetry into the status-report directory
• ead1f7d Rename the platform module
• 549d498 Simplify per-language platform eligibility checks
• Additional commits viewable in compare view

Updates trufflesecurity/trufflehog from 3.97.4 to 3.97.5

Release notes

Sourced from trufflesecurity/trufflehog's releases.

v3.97.5

What's Changed

• Update module github.com/rabbitmq/amqp091-go to v1.13.0 [SECURITY] by @​renovate[bot] in trufflesecurity/trufflehog#5274
• Update github-actions by @​renovate[bot] in trufflesecurity/trufflehog#5250
• Update dependency golangci/golangci-lint to v2.13.2 by @​renovate[bot] in trufflesecurity/trufflehog#5251
• Make GitHub App installationId optional when scanning all installations by @​kashifkhan0771 in trufflesecurity/trufflehog#5275
• [INT-942] Add HumioAPIToken detector by @​unsmith in trufflesecurity/trufflehog#5258
• Object filtering in S3 by @​shahzadhaider1 in trufflesecurity/trufflehog#5286
• feat(detectors): add Resend detector by @​mwoss in trufflesecurity/trufflehog#5103
• Clean up use of wasilibs/go-re2 by @​bradlarsen in trufflesecurity/trufflehog#5273
• Low-memory Git Scanning by @​mariduv in trufflesecurity/trufflehog#5257
• Adding no-ignore flag to allow reporting of "ignored" secrets by @​jordanTunstill in trufflesecurity/trufflehog#5297
• Postgres: drop non-connection URI params before verifying by @​jordanTunstill in trufflesecurity/trufflehog#5296
• fix(detectors/ngrok): broaden valid bearer tokens matching by @​mattbrady-1 in trufflesecurity/trufflehog#5152
• ci: avoid Node 20 BuildPulse action by @​dustin-decker in trufflesecurity/trufflehog#5266
• Introduce a new optional detector interface that will allow us to verify credentials not in the cache by @​kvnphvm in trufflesecurity/trufflehog#5298
• perf(engine): lowercase prefilter chunks as ASCII in a pooled buffer by @​kashifkhan0771 in trufflesecurity/trufflehog#5291
• Add documentation for CircleCI source by @​kashifkhan0771 in trufflesecurity/trufflehog#5268
• Add filesystem source documentation by @​kashifkhan0771 in trufflesecurity/trufflehog#5285
• Add elasticsearch source documentation by @​kashifkhan0771 in trufflesecurity/trufflehog#5284
• [SCAN-177] Purge secret parts from verification cache by @​casey-tran in trufflesecurity/trufflehog#5318

New Contributors

• @​mwoss made their first contribution in trufflesecurity/trufflehog#5103
• @​kvnphvm made their first contribution in trufflesecurity/trufflehog#5298

Full Changelog: trufflesecurity/trufflehog@v3.97.4...v3.97.5

Commits

• f714bf4 [SCAN-177] Purge secret parts from verification cache (#5318)
• 4ecb5c6 Add elasticsearch source documentation (#5284)
• 8d77a9d Add filesystem source documentation (#5285)
• b8a71ee Add documentation for CircleCI source (#5268)
• b1d7dae perf(engine): lowercase prefilter chunks as ASCII in a pooled buffer (#5291)
• 07e3ac7 Introduce a new optional detector interface that will allow us to verify cred...
• 5a6944e ci: avoid Node 20 BuildPulse action (#5266)
• ce7b2b8 fix(detectors/ngrok): broaden valid bearer tokens matching (#5152)
• 58bf481 Postgres: drop non-connection URI params before verifying (#5296)
• 82fd19c Adding no-ignore flag to allow reporting of "ignored" secrets (#5297)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[clawsweeper]

Codex review: needs changes before merge. Reviewed September 21, 2026, 12:15 PM ET / 16:15 UTC.

ClawSweeper review

What this changes

Updates the pinned CodeQL actions to 4.38.1 and the TruffleHog action to 3.97.5 in the security workflows.

Merge readiness

⛔ Needs changes before merge - 2 items remain

The update remains useful and is not implemented on main, but the TruffleHog runtime version must accompany its action-pin update.

Priority: P2
Reviewed head: 59a3de93bd880388b97d34fb76bb2597541ff5e8

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The patch is focused and uses verified release pins, but one dependency remains unchanged at runtime.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot-authored maintenance PR is exempt from contributor runtime proof; successful workflow checks are supplemental and do not prove TruffleHog 3.97.5 execution.
Patch quality	🦐 gold shrimp (3/6)	1 actionable review finding remain.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This Dependabot-authored maintenance PR is exempt from contributor runtime proof; successful workflow checks are supplemental and do not prove TruffleHog 3.97.5 execution.
Evidence reviewed	9 items	Introduced changes: The pinned base-to-head diff changes exactly three action references across two workflows; permissions, triggers, scan ranges, and scanner arguments remain unchanged. Runtime version remains unchanged: The updated action reference is followed by version: "3.97.4", so the requested TruffleHog release is not selected for execution. Dependency execution contract: The target workflow directly executes this composite action. Its version input becomes VERSION, and its final docker command runs ${IMAGE}:${VERSION}; the action commit does not select the scanner binary version. Both old and new action.yml files have blob SHA 1e2af3fbb9ef7eb5f19e21af9d0c6c3278de1a73.
Findings	1 actionable finding	[P2] Update the TruffleHog runtime version alongside its action pin
Security	None	None.

How this fits together

GitHub Actions runs CodeQL analysis and secret scanning on repository changes. These workflows select scanner versions and publish security results or failing checks.

flowchart TD
  A[Repository changes] --> B[Security workflows]
  B --> C[CodeQL action pins]
  B --> D[TruffleHog action and version input]
  C --> E[Code analysis]
  D --> F[Secret scanning]
  E --> G[Security results and checks]
  F --> G

Loading

Before merge

• Update the TruffleHog runtime version alongside its action pin (P2) - The new action still receives version: "3.97.4" on line 55. Its composite implementation executes ${IMAGE}:${VERSION}, and action.yml is identical between these two releases, so this change leaves every scan running 3.97.4 and delivers none of the advertised 3.97.5 scanner changes. Update the explicit version to 3.97.5 alongside this pin, preserving the existing fixed-version behavior.
• Complete next step (P2) - Update the TruffleHog version input to 3.97.5 and verify the secret-scan workflow runs that version.

Findings

• [P2] Update the TruffleHog runtime version alongside its action pin — .github/workflows/secret-scan.yml:50

Agent review details

Security

None.

Review metrics

None.

Technical review

Best possible solution:

Keep immutable action pins and align TruffleHog's explicit runtime version with the intended 3.97.5 release.

Do we have a high-confidence way to reproduce the issue?

Yes, from source: every secret-scan invocation passes 3.97.4 to an action that uses that value as its Docker image tag; no local execution was performed.

Is this the best way to solve the issue?

The pinned-action approach is appropriate, but incomplete: the unchanged TruffleHog version input prevents the scanner upgrade described in the PR.

Full review comments:

• [P2] Update the TruffleHog runtime version alongside its action pin — .github/workflows/secret-scan.yml:50
  The new action still receives version: "3.97.4" on line 55. Its composite implementation executes ${IMAGE}:${VERSION}, and action.yml is identical between these two releases, so this change leaves every scan running 3.97.4 and delivers none of the advertised 3.97.5 scanner changes. Update the explicit version to 3.97.5 alongside this pin, preserving the existing fixed-version behavior.
  Confidence: 0.99

Overall correctness: patch is incorrect
Overall confidence: 0.98

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 4d3dad28a600.

Labels

Label changes:

• add P2: This bounded security-tool maintenance update has an incomplete runtime-version bump, with no demonstrated urgent regression.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: This Dependabot-authored maintenance PR is exempt from contributor runtime proof; successful workflow checks are supplemental and do not prove TruffleHog 3.97.5 execution.

Label justifications:

• P2: This bounded security-tool maintenance update has an incomplete runtime-version bump, with no demonstrated urgent regression.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: This Dependabot-authored maintenance PR is exempt from contributor runtime proof; successful workflow checks are supplemental and do not prove TruffleHog 3.97.5 execution.

Evidence

Acceptance criteria:

• [P1] git diff --check.
• [P1] pnpm format:check.
• [P1] pnpm typecheck && pnpm lint && pnpm test && pnpm build.
• [P1] Inspect the resulting GitHub Actions secret-scan logs for TruffleHog image version 3.97.5 and successful completion.

What I checked:

• Introduced changes: The pinned base-to-head diff changes exactly three action references across two workflows; permissions, triggers, scan ranges, and scanner arguments remain unchanged. (.github/workflows/secret-scan.yml:50, 59a3de93bd88)
• Runtime version remains unchanged: The updated action reference is followed by version: "3.97.4", so the requested TruffleHog release is not selected for execution. (.github/workflows/secret-scan.yml:55, 59a3de93bd88)
• Dependency execution contract: The target workflow directly executes this composite action. Its version input becomes VERSION, and its final docker command runs ${IMAGE}:${VERSION}; the action commit does not select the scanner binary version. Both old and new action.yml files have blob SHA 1e2af3fbb9ef7eb5f19e21af9d0c6c3278de1a73. (action.yml, f714bf454f35)
• CodeQL release identity: The official v4.38.1 annotated tag resolves to the exact commit pinned by both updated CodeQL steps. (1c5b675653bb)
• TruffleHog release identity: The official v3.97.5 tag resolves to the newly pinned action commit. (f714bf454f35)
• Existing coordinated update pattern: The previous maintenance update changed the TruffleHog action SHA and version input together from 3.97.1 to 3.97.4; GitHub identifies steipete as that commit's author. (.github/workflows/secret-scan.yml:55, 089150abad84)

Likely related people:

• unknown: The claimed source-line change could not be verified from bounded local history. (role: source history unknown; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Set the TruffleHog version input to 3.97.5 and confirm the resulting secret-scan job selects that image version.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[steipete]

Included in merged #222, including the missing TruffleHog runtime version bump. The scanner log confirms 3.97.5 executed successfully, and CodeQL plus the full CI matrix passed. Closing this superseded update.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml