build(deps): bump TruffleHog action to v3.97.4

[dependabot]

Refresh the commit-pinned TruffleHog action from v3.97.1 to v3.97.4, extending Dependabot's original v3.97.2 update. Add the maintenance entry under Unreleased and retain the original Dependabot commit.

The upstream v3.97.4 tag resolves to 363923b901c911a9164f50b6c423f47c15372b1c. Its action wrapper is byte-identical to v3.97.2. The existing scan range, permissions and arguments remain compatible. The action still uses its existing latest scanner-image default; this updates the action revision, not an immutable scanner image.

Upstream: v3.97.4 release, pinned action source.

Validation on macOS arm64 with Go 1.27.0:

• make check passed: module tidiness, formatting, vet, deadcode, govulncheck, full tests, race tests, and all 25 release guard tests.
• GOWORK=off go test -count=1 ./... and GOWORK=off go build ./cmd/crawlctl passed.
• Built crawlctl passed help/version and a real temporary-config job: run, status JSON, logs, persisted history, and lock cleanup. No live archives were accessed.
• Independent Codex autoreview of the full candidate against c778575cf46a7389b17e97b65441daad0cf261b2 reported no actionable P0–P2 findings.

Credit: @dependabot initiated this dependency update. Prepared for maintainer review; no release was dispatched.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: blocked before merge. Reviewed September 4, 2026, 4:52 AM ET / 08:52 UTC.

ClawSweeper review

What this changes

Updates the commit-pinned TruffleHog secret-scanning action to v3.97.4 and records the maintenance change under Unreleased.

Merge readiness

⛔ Blocked before merge - 1 item remains

This update remains useful: current main and v0.14.8 still use TruffleHog v3.97.1. No actionable defect was found in the introduced diff.

Priority: P3
Reviewed head: ac8a505a0ac3776de9935d10bda675f16a80ebbc

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused maintenance patch with no actionable findings and successful supplied checks; the reviewer’s upstream-access limitation is disclosed separately.
Proof confidence	🌊 off-meta tidepool	Not applicable: The bot-authored dependency update is exempt from contributor runtime proof; supplied scan checks are supplemental, and the crawlctl smoke does not validate the changed action.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The bot-authored dependency update is exempt from contributor runtime proof; supplied scan checks are supplemental, and the crawlctl smoke does not validate the changed action.
Evidence reviewed	7 items	Verified introduced scope: The pinned base-to-head diff contains one action-reference replacement and two added changelog lines; scan arguments, triggers, permissions, and failure handling are unchanged. Current main still needs the update: Fetched main retains the v3.97.1 reference at the same workflow step. Latest release comparison: The workflow recorded in the supplied latest release, v0.14.8, also references v3.97.1.
Findings	None	None.
Security	None	None.

How this fits together

Crawlkit’s secret-scanning workflow checks repository changes on pushes and pull requests. It passes a commit range to TruffleHog and reports failure when verified credentials are detected.

flowchart TD
  A[Push or pull request] --> B[Read repository checkout]
  B --> C[Resolve commit range]
  C --> D[Pinned TruffleHog action]
  D --> E{Verified secrets found?}
  E -->|Yes| F[Fail security check]
  E -->|No| G[Pass security check]

Loading

Before merge

• Resolve merge risk (P1) - Independent upstream inspection was unavailable; the action-wrapper compatibility assessment relies on the updated PR body.

Agent review details

Security

None.

Review metrics

None.

Merge-risk options

Maintainer options:

1. Decide the mitigation before merge
   Retain the narrow action refresh with the existing scan contract and accurately distinguish the pinned wrapper from its mutable scanner-image default.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Technical review

Best possible solution:

Retain the narrow action refresh with the existing scan contract and accurately distinguish the pinned wrapper from its mutable scanner-image default.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR updates an automation dependency rather than reporting broken product behavior.

Is this the best way to solve the issue?

Yes: replacing the existing commit pin is the narrow maintenance path, and the diff preserves the workflow’s inputs and permissions; independent upstream verification was unavailable.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against c778575cf46a.

Labels

Label justifications:

• P3: This is a bounded dependency-maintenance update with no demonstrated user-facing regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The bot-authored dependency update is exempt from contributor runtime proof; supplied scan checks are supplemental, and the crawlctl smoke does not validate the changed action.

Evidence

What I checked:

• Verified introduced scope: The pinned base-to-head diff contains one action-reference replacement and two added changelog lines; scan arguments, triggers, permissions, and failure handling are unchanged. (.github/workflows/secret-scan.yml:52, ac8a505a0ac3)
• Current main still needs the update: Fetched main retains the v3.97.1 reference at the same workflow step. (.github/workflows/secret-scan.yml:52, c778575cf46a)
• Latest release comparison: The workflow recorded in the supplied latest release, v0.14.8, also references v3.97.1. (.github/workflows/secret-scan.yml:52, 5cdee495743f)
• Repository policy and routing: The full root AGENTS.md and publishing guide were read. No additional ancestor policy or maintainer-notes directory applies; CODEOWNERS routes workflow changes to openclaw/openclaw-secops. (.github/CODEOWNERS:4, ac8a505a0ac3)
• Re-review context and supplied validation: The captured updated PR body explicitly reports the v3.97.4 tag mapping, wrapper equivalence with v3.97.2, and the unchanged latest-image default. The previous review retained no findings or rank-up moves. Supplied checks include successful secret-scan runs; the reported crawlctl smoke does not exercise the changed action. (ac8a505a0ac3)
• Dependency inspection boundary: The workflow directly executes trufflesecurity/trufflehog, making its action contract relevant. GitHub API, raw-source, and browser access failed, so upstream tag mapping and wrapper equivalence remain PR-body assertions rather than independently inspected dependency facts. (.github/workflows/secret-scan.yml:52, ac8a505a0ac3)

Likely related people:

• openclaw/openclaw-secops: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• Vincent Koc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (1 earlier review cycle)

• reviewed 2026-09-04T07:29:11.649Z sha 3ebed25 :: blocked before merge. :: none