build(deps): update and group security scanning actions

[steipete]

The separate CodeQL updates in #269 and #270 fail because initialization and analysis exchange configuration that requires an exact action-version match. Update both pins to CodeQL v4.38.2 in the same change, and group future CodeQL Dependabot updates so the steps stay together. This also incorporates the TruffleHog v3.97.9 update from #271.

The action SHAs match the upstream release tags. Scan inputs, permissions, triggers, and the Go runtime floor are unchanged. Both updates are patches; the repository has no additional release-age policy. Thanks @dependabot.

Validation on f68140c:

• Original failure: https://github.com/openclaw/discrawl/actions/runs/37124347776/job/111206530788 records the CodeQL configuration-version rejection.
• Repaired CodeQL analysis and result upload: https://github.com/openclaw/discrawl/actions/runs/37581493612 passed.
• Full CI, including native macOS/Windows smoke tests: https://github.com/openclaw/discrawl/actions/runs/37581493772 passed. Docker and both TruffleHog checks also passed.
• AWS remote make check passed with Go 1.27.1 and GoReleaser 2.18.2: formatting, analyzers, vulnerability check, full race suite, 86.0% coverage, CLI smoke, and all six snapshot artifacts with publishing disabled.
• node --test scripts/publish-cloud.test.mjs scripts/build-docs-site.test.mjs passed all 15 tests; node scripts/build-docs-site.mjs and go test -count=1 scripts/reconcile_cloud_source.go scripts/reconcile_cloud_source_test.go passed.
• Codex autoreview through P3: scoped-clean, no actionable findings.

The remote environment needed direct tool preparation after a hydration-adapter error, disk-backed compiler temporary storage, and swap after an out-of-memory kill on its small instance. The final full gate passed without changing repository checks.

Supersedes #269, #270, and #271.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed October 7, 2026, 2:28 AM ET / 06:28 UTC.

ClawSweeper review

What this changes

Updates both CodeQL scanning steps to v4.38.2, groups their future Dependabot updates, refreshes the TruffleHog action to v3.97.9, and records the changes in the changelog.

Merge readiness

✅ Ready for maintainer review

Keep open: the coordinated update remains absent from main and the latest release. No introduced defect or concrete supply-chain concern was found.

Priority: P3
Reviewed head: f68140c0cef2524e1f5de166b24825b9cab5592d

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused maintenance patch with verified upstream references, successful scanner execution, and no actionable correctness findings.
Proof confidence	🌊 off-meta tidepool	Not applicable: Repository State identifies a member-authored maintenance PR, so contributor runtime proof is exempt; successful pinned-head CodeQL and TruffleHog jobs additionally exercise the changed workflows. No stored-data contract changes.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: Repository State identifies a member-authored maintenance PR, so contributor runtime proof is exempt; successful pinned-head CodeQL and TruffleHog jobs additionally exercise the changed workflows. No stored-data contract changes.
Evidence reviewed	7 items	Pinned introduced change: The complete introduced diff updates three action references, adds the CodeQL dependency group, and adds one changelog entry. Scan inputs, permissions, triggers, and Go setup are unchanged. Still necessary on main and in the release: The pinned main diff establishes that the grouping and updated pins are absent from main. Release v0.15.6 also retains CodeQL v4.38.1 and TruffleHog v3.97.8. CodeQL dependency identity and contract: The target workflow directly executes this dependency. GitHub’s annotated v4.38.2 tag resolves to the exact proposed commit; both action manifests retain Node 24 entrypoints, and the upstream comparison does not change either manifest.
Findings	None	None.
Security	None	None.

How this fits together

Discrawl’s GitHub workflows scan repository changes for code vulnerabilities and verified secrets. Dependabot proposes updates to the actions that run those scans.

flowchart TD
  A[Repository changes] --> B[Security workflows]
  B --> C[CodeQL initialization and analysis]
  B --> D[Verified secret scan]
  C --> E[Scan results]
  D --> E
  F[Dependabot updates] --> G[Grouped CodeQL pins]
  G --> B

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Security action updates	3 pins updated across 2 workflows	Both CodeQL steps share one verified upstream revision, while existing scan permissions and inputs remain intact.

Root-cause cluster

Relationship: canonical
Canonical: #272
Summary: This PR consolidates the three explicitly linked dependency updates; this assessment does not close those branches.

Members:

• partial_overlap: build(deps): bump github/codeql-action/analyze from 4.38.1 to 4.38.2 #269 - Contains the same CodeQL analysis update without its matching initialization update.
• partial_overlap: build(deps): bump github/codeql-action/init from 4.38.1 to 4.38.2 #270 - Contains the same CodeQL initialization update without its matching analysis update.
• partial_overlap: build(deps): bump trufflesecurity/trufflehog from 3.97.8 to 3.97.9 #271 - Contains the same TruffleHog action update.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Technical review

Best possible solution:

Keep CodeQL initialization and analysis on matching immutable revisions and update them together through Dependabot grouping.

Do we have a high-confidence way to reproduce the issue?

Not applicable to this maintenance PR; the linked earlier analysis-only workflow failed, and the coordinated workflow succeeds on the pinned head.

Is this the best way to solve the issue?

Yes. Updating both CodeQL steps together and grouping subsequent updates is a focused way to prevent incompatible action versions.

AGENTS.md: found but not applied because it conflicted with ClawSweeper's review contract.

Codex review notes: model internal, reasoning medium; reviewed against 76618b71c379.

Labels

Label changes:

• add P3: This is a bounded maintenance update to security scanning actions and dependency grouping.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Repository State identifies a member-authored maintenance PR, so contributor runtime proof is exempt; successful pinned-head CodeQL and TruffleHog jobs additionally exercise the changed workflows. No stored-data contract changes.

Label justifications:

• P3: This is a bounded maintenance update to security scanning actions and dependency grouping.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Repository State identifies a member-authored maintenance PR, so contributor runtime proof is exempt; successful pinned-head CodeQL and TruffleHog jobs additionally exercise the changed workflows. No stored-data contract changes.

Evidence

What I checked:

• Pinned introduced change: The complete introduced diff updates three action references, adds the CodeQL dependency group, and adds one changelog entry. Scan inputs, permissions, triggers, and Go setup are unchanged. (.github/workflows/codeql.yml:32, f68140c0cef2)
• Still necessary on main and in the release: The pinned main diff establishes that the grouping and updated pins are absent from main. Release v0.15.6 also retains CodeQL v4.38.1 and TruffleHog v3.97.8. (.github/workflows/codeql.yml:32, cd7fa1ce5eb7)
• CodeQL dependency identity and contract: The target workflow directly executes this dependency. GitHub’s annotated v4.38.2 tag resolves to the exact proposed commit; both action manifests retain Node 24 entrypoints, and the upstream comparison does not change either manifest. (init/action.yml, 2892aa5e19bb)
• TruffleHog dependency identity and contract: The target secret workflow directly executes this dependency. The proposed commit matches upstream v3.97.9. The release comparison leaves action.yml unchanged, including its existing Docker image version default of latest; the action pin does not independently pin the scanner image. (action.yml, 4dd8831c5f12)
• Changed workflow execution: CodeQL job https://github.com/openclaw/discrawl/actions/runs/37581493612/job/112661966506 completed successfully on the exact pinned head, including initialization, analysis, and post steps. Both verified-secret scan checks also succeeded on that head. The related analysis-only update had failed during analysis. (.github/workflows/codeql.yml:37, f68140c0cef2)
• Area history and routing: Workflow history records repeated prior dependency and security-workflow work by Peter Steinberger. GitHub commit metadata maps the earlier coordinated CodeQL refresh and secret-scanner refresh to steipete. Some deeper local history inspection failed because required historical blobs were unavailable; GitHub commit patches supplied the relevant prior changes. (.github/workflows/codeql.yml, 936e3adff1f9)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• openclaw/openclaw-secops: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[steipete]

Merged as b30bf68. The separate CodeQL version-mismatch failures are resolved by updating initialization and analysis together; future updates are grouped.

Validation on the exact PR head f68140c:

• make check passed on Linux AWS with Go 1.27.1 and GoReleaser 2.18.2: full race suite, 86.0% coverage, static/security analysis, dependency checks, CLI smoke, and six snapshot artifacts with publication disabled.
• node --test scripts/publish-cloud.test.mjs scripts/build-docs-site.test.mjs passed all 15 tests; the docs build and go test -count=1 scripts/reconcile_cloud_source.go scripts/reconcile_cloud_source_test.go passed.
• Full CI, native macOS/Windows checks, CodeQL analysis/upload, Docker, and TruffleHog passed. Codex autoreview through P3 found no actionable findings.

The remote environment required direct tool preparation, disk-backed temporary storage, and swap after hydration, disk, and memory failures; the final full gate passed without changing repository checks. Verbose govulncheck's module-only advisory concerns unused openpgp, has no fixed version, and affects no imported packages or symbols.

Post-merge verification: the full default-branch CI run passed on b30bf68: https://github.com/openclaw/discrawl/actions/runs/37585930238. CodeQL, TruffleHog, Docker, and automatic docs publishing also passed on that commit. The visible main checkout is clean and synchronized; the remote validation lease has been released. #269, #270, and #271 are closed as incorporated.