From 8c6ee4505d215e4c40c8dff9893102ba633ac351 Mon Sep 17 00:00:00 2001 From: Lakshman Patel Date: Mon, 13 Jul 2026 19:14:26 +0530 Subject: [PATCH] fix(ci): repin trufflehog to a real release tag MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The shared workflow template pinned trufflesecurity/trufflehog to a commit SHA labeled "main 2026-05-18" — a floating branch reference disguised as a pin, not an actual release. Repins to v3.95.9, the current real trufflehog release. Companion fix to GrayCodeAI/hawk#96, which fixes the same issue at the template source. --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index cca718c..11f1e4e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -149,7 +149,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - uses: trufflesecurity/trufflehog@0fa069c12f0c7baf431041cd1e564a9c5058846c # main 2026-05-18 + - uses: trufflesecurity/trufflehog@27b0417c16317ca9a472a9a8092acce143b49c55 # v3.95.9 with: extra_args: --only-verified