build(deps): patch gRPC and refresh workflow actions

[steipete]

Refresh setup-node to v7.1.0 across CI, docs, and the existing publisher, and TruffleHog to v3.99.0. This consolidates the compatible minor updates from #274 and #275 while retaining the existing Node versions, scan options, and workflow triggers.

Also update transitive gRPC from v1.83.1 to v1.83.2, the patched version for GHSA-2v4p-qf9q-27wj (xDS server denial of service). Preserve the existing Go minimum and Go 1.27.2 toolchain. Add Unreleased entries and retain Dependabot credit.

Validation: independent Codex review is clean through P3 for the complete diff. AWS validation passed make check (race tests, 85.5% coverage, analyzers, zero reachable vulnerabilities, CLI smoke, six-platform unpublished snapshots), all 15 Node tests, docs generation, and source-reconciliation tests. Exact-head CI: https://github.com/openclaw/discrawl/actions/runs/38127024605. No release, version bump, or manual deployment.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR updates gRPC to v1.83.2, setup-node to v7.1.0, and the TruffleHog action reference to v3.99.0.

Example: Documentation CI prepares Node 26.

• Before: setup-node v7.0.0 installs the requested runtime.
• After: setup-node v7.1.0 also verifies the installed Node version.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	Useful, narrowly scoped maintenance with verified release identities, compatible caller contracts, and no actionable finding.
Proof confidence	🌊 off-meta tidepool	Not applicable: Under the supplied maintainer-authored classification, ordinary contributor proof is not required; hosted checks support validation but do not establish a live gRPC advisory reproduction.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Builds retain a dependency version covered by a security advisory, while workflow actions trail compatible upstream maintenance releases.
Reason: The supplied maintainer-authored classification establishes direction, and the narrow updates preserve existing runtime choices and publication controls.

Merge readiness

✅ Ready for maintainer review

Keep this PR open: main still lacks these useful dependency updates, and the reviewed diff introduces no actionable correctness or security defect.

Priority: P3
Reviewed head: d21d999f3d4edc258b2407c33293cd0111991cee

Before merge

None.

Findings

None.

Agent review details

How this fits together

GitHub workflows consume pinned actions to build documentation, prepare cloud publication, and scan secrets; the Go module graph supplies dependencies to the Discrawl CLI.

flowchart TD
  A[Workflow events] --> B[Pinned actions]
  B --> C[Documentation builds]
  B --> D[Conditional cloud publication]
  B --> E[Secret scan results]
  F[Go module graph] --> G[Discrawl CLI]

Loading

Technical review

Best possible solution:

Land the verified dependency updates while preserving the existing runtime selections and workflow boundaries.

Do we have a high-confidence way to reproduce the issue?

The outdated references are directly verified on main; the upstream advisory establishes the affected dependency version without establishing an exploitable Discrawl server path.

Is this the best way to solve the issue?

Updating the existing pinned references is a narrow solution that preserves prior maintenance intent and avoids introducing another dependency-management path.

AGENTS.md: found but not applied because it conflicted with ClawSweeper's review contract.

Codex review notes: model internal, reasoning medium; reviewed against ee0683bcfda6.

Provenance checked

• Go dependency selection keeps the original intent (ee0683b: build(deps): refresh Go dependencies and patched toolchains #273 refreshed dependencies and patched toolchains while preserving Go minimums and analyzer checks.)
• CI documentation Node setup keeps the original intent (0cd8e98: fix: keep documentation identity stable across checkouts #231 added documentation regression checks and a real documentation build.)
• Pages Node setup keeps the original intent (530fae9: build(deps): bump actions/setup-node to v7 #144 adopted an immutable setup-node v7 reference.)
• Cloud-publication Node setup keeps the original intent (f37a0ff: feat: publish D1 and R2 from the backup workflow #241 prepared Node 24 for enabled publication after Git publication and cache persistence.)
• Secret-scanning action keeps the original intent (b30bf68: build(deps): update and group security scanning actions #272 refreshed scanning actions while preserving scan inputs, permissions, and triggers.)

Testing

Proof path: unit tests only.

Security

None.

Evidence

What I checked:

• Verified introduced scope: The pinned diff changes four action references, the gRPC requirement and checksums, and Unreleased notes; workflow inputs, permissions, triggers, publication conditions, and Go versions are preserved. (go.mod:90, d21d999f3d4e)
• Default branch still needs the change: The default branch remains main at the fetched revision, with gRPC v1.83.1, setup-node v7.0.0, and the TruffleHog v3.97.9 action reference. (go.mod:90, ee0683bcfda6)
• Upstream identity and execution contract: The v7.1.0 tag resolves to the proposed SHA. The action retains its node24 runtime and adds installed-version validation and manifest retries; version-file changes do not affect these explicit-version callers. Dependency inspection applies because the workflows execute this action. (action.yml, 949feb2413d6)
• Upstream identity and unchanged wrapper: The v3.99.0 tag resolves to the proposed SHA, and action.yml is unchanged between the pins. Its existing version input still defaults to latest, so this updates the action reference without pinning the scanner container to v3.99.0. Dependency inspection applies because the workflow executes this wrapper. (action.yml, b2b0a92070f2)
• Security patch matches the advisory: GHSA-2v4p-qf9q-27wj identifies v1.83.2 as patched. The upstream transport rejects requests missing both authority and Host headers before routing. Discrawl's existing x/net, x/sys, x/sync, x/text, and x/crypto requirements already exceed the patch's updated requirements. Dependency inspection applies because go.mod selects this module. (internal/transport/http2_server.go, 030ee8becb20)
• Consolidated Dependabot contributions: The file patches in build(deps): bump trufflesecurity/trufflehog from 3.97.9 to 3.99.0 #274 and build(deps): bump actions/setup-node from 7.0.0 to 7.1.0 #275 exactly match the four action-reference changes here; this PR retains Dependabot credit. (CHANGELOG.md:5, d21d999f3d4e)

Likely related people:

• Peter Steinberger: Raw commit ee0683b adds go.mod:5 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: ee0683bcfda6; files: go.mod)
• Vincent Koc: Raw commit 0da02de adds .github/workflows/secret-scan.yml:16 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: medium; commits: 0da02de393a7; files: .github/workflows/secret-scan.yml)
• Ayaan Zaidi: Raw commit f37a0ff adds .github/workflows/publish-discord-backup.yml:132 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: medium; commits: f37a0ff38b4e; files: .github/workflows/publish-discord-backup.yml)

Root-cause cluster

Relationship: canonical
Canonical: #276
Summary: This PR consolidates both pending action updates and adds the gRPC security patch.

Members:

• superseded: build(deps): bump trufflesecurity/trufflehog from 3.97.9 to 3.99.0 #274 - Its complete TruffleHog action-reference update is included here.
• superseded: build(deps): bump actions/setup-node from 7.0.0 to 7.1.0 #275 - Its complete three-workflow setup-node update is included here.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Labels

Label changes:

No label changes.

Label justifications:

• P3: Focused dependency maintenance and preventive hardening; the advisory affects xDS servers, and no reachable Discrawl xDS-server failure is established.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only; repair and merge need explicit maintainer commands such as @clawsweeper autofix or @clawsweeper automerge.

History

Review history (1 earlier review cycle)

• reviewed 2026-10-11T09:01:38.377Z sha 2dd5ff6 :: needs maintainer review before merge. :: none

Reviewed October 11, 2026, 5:08 AM ET / 09:08 UTC (Revision 2).