From 15c40117ee63c4b1034700c8c8160c58a0ae0a2e Mon Sep 17 00:00:00 2001 From: Rob Sherman Date: Thu, 30 Jul 2026 14:01:21 -0700 Subject: [PATCH] ci: bump pinned cfdude/.github security workflows to 5646bebe Picks up the checksum-pinned TruffleHog secret scan added to the shared workflow. Stays SHA-pinned per the convention documented in this file. Why it matters here: neither Semgrep (OSS p/secrets) nor Trivy detects Anthropic sk-ant keys -- measured against a fixture of format-valid fake credentials. TruffleHog is the only scanner in this stack that does, so without this bump CI has no coverage for that credential type. The job scans the checked-out tree (not git history, and not via the upstream action, which scans ALL history on schedule events and would resurface long-rotated secrets as recurring noise). Only a VERIFIED secret fails the build; full-recall findings are reported without gating. Scan behaviour for Trivy and Semgrep is unchanged. --- .github/workflows/security.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 169c612..ad32860 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -19,14 +19,14 @@ jobs: # Pinned to a commit SHA (not @main) per the org's own pinGitHubActionDigests convention — # a moving branch ref would let a compromised or unexpectedly-changed org workflow silently # run in this repo's CI. Bump deliberately: re-check cfdude/.github before updating the SHA. - uses: cfdude/.github/.github/workflows/security-semgrep.yml@8931286eb4057e4a2829325c1e04e6071ebf3ff4 # main @ 2026-07-30 + uses: cfdude/.github/.github/workflows/security-semgrep.yml@5646bebe649298cdf4c1b1a4aa1ad3e9e1c8b9b1 # main @ 2026-07-30 (trufflehog) permissions: contents: read security-events: write trivy: name: Trivy filesystem scan - uses: cfdude/.github/.github/workflows/security-trivy.yml@8931286eb4057e4a2829325c1e04e6071ebf3ff4 # main @ 2026-07-30 + uses: cfdude/.github/.github/workflows/security-trivy.yml@5646bebe649298cdf4c1b1a4aa1ad3e9e1c8b9b1 # main @ 2026-07-30 (trufflehog) permissions: contents: read security-events: write