chore(deps): bump the actions group with 4 updates

[dependabot]

Bumps the actions group with 4 updates: github/codeql-action, actions/deploy-pages, trufflesecurity/trufflehog and editorconfig-checker/action-editorconfig-checker.

Updates github/codeql-action from 4.37.9 to 4.38.0

Release notes

Sourced from github/codeql-action's releases.

v4.38.0

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

Changelog

Sourced from github/codeql-action's changelog.

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

Commits

• b96794f Merge pull request #4131 from github/update-v4.38.0-7e08580a9
• 02d5093 Update changelog for v4.38.0
• 7e08580 Merge pull request #4130 from github/henrymercer/workflow-runner-sizing
• bfcc52b Run slow macOS checks on larger runners
• 8c251e7 Merge pull request #4129 from github/update-bundle/codeql-bundle-v2.27.0
• 0b7ca40 Add changelog note
• 40484b3 Update default bundle to codeql-bundle-v2.27.0
• 977e6ce Merge pull request #4124 from github/henrymercer/toolcache-bundle-cleanup
• 40a6b38 Address toolcache cleanup review feedback
• deece8f Apply suggestion from @​henrymercer
• Additional commits viewable in compare view

Updates actions/deploy-pages from 5.0.0 to 5.0.1

Release notes

Sourced from actions/deploy-pages's releases.

v5.0.1

Changelog

• Add backoff and jitter to deployment polling @​yoannchaudet (#444)
• Improve deployment request test coverage @​adwitiyagoyal (#440)

---

See details of all code changes since previous release.

⚠️ For use with products other than GitHub.com, such as GitHub Enterprise Server, please consult the compatibility table.

Commits

• 368f825 Merge pull request #444 from actions/yoannchaudet-deployment-polling-backoff
• 7e97763 Validate deployment polling intervals
• 0143e11 Add backoff and jitter to deployment polling
• 5e98f10 Merge pull request #440 from actions/user/adwitiya
• 8b0625a Improve deployment request test coverage
• See full diff in compare view

Updates trufflesecurity/trufflehog from 3.97.1 to 3.97.4

Release notes

Sourced from trufflesecurity/trufflehog's releases.

v3.97.4

What's Changed

• Make Transport Errors indeterminate for Twilio secrets and twilioapikeys by @​jordanTunstill in trufflesecurity/trufflehog#5267
• Improve the json-enumerator source by @​bradlarsen in trufflesecurity/trufflehog#5265
• added tests for twilio detector fixes by @​jordanTunstill in trufflesecurity/trufflehog#5271

Full Changelog: trufflesecurity/trufflehog@v3.97.3...v3.97.4

v3.97.3

What's Changed

• fix(s3): cut a child context per object so key/size log values don't pile up by @​mariduv in trufflesecurity/trufflehog#5236
• Revert "[INT-933] De-base64 SourceUnit.UnitData in the GitHub Source" by @​trufflesteeeve in trufflesecurity/trufflehog#5269

Full Changelog: trufflesecurity/trufflehog@v3.97.2...v3.97.3

v3.97.2

What's Changed

• detectors/github/v2: differentiate token type in ExtraData by @​hartsock in trufflesecurity/trufflehog#5223
• Update dependency trufflesecurity/.github to v1.0.4 by @​renovate[bot] in trufflesecurity/trufflehog#5228
• ci: let Renovate bump the golangci-lint pin in scripts/lint.sh by @​bryanbeverly in trufflesecurity/trufflehog#5231
• Update github.com/trufflesecurity/ldap-verify digest to aa52b46 by @​renovate[bot] in trufflesecurity/trufflehog#5172
• Update github-actions by @​renovate[bot] in trufflesecurity/trufflehog#5197
• Update aws-sdk-go-v2 monorepo by @​renovate[bot] in trufflesecurity/trufflehog#5173
• Update module github.com/aws/smithy-go to v1.27.9 by @​renovate[bot] in trufflesecurity/trufflehog#5174
• [SCAN-18] Add SOURCE_TYPE_AWS_SECRETS_MANAGER source type by @​dipto-truffle in trufflesecurity/trufflehog#5234
• [INS-377] Add V2 for weights and biases detector by @​mustansir14 in trufflesecurity/trufflehog#4951
• Fix PagerDuty detector: treat 403 and 402 as verified credentials by @​unsmith in trufflesecurity/trufflehog#5230
• [INT-933] De-base64 SourceUnit.UnitData in the GitHub Source by @​camgunz in trufflesecurity/trufflehog#5248
• Implement Enumerate for the Jenkins source by @​Ahsan-Sarbaz in trufflesecurity/trufflehog#5229
• Update link to Truffle Security documentation by @​shahzadhaider1 in trufflesecurity/trufflehog#5256
• Retry git clone on secondary rate limit (bare 403/429) by @​kashifkhan0771 in trufflesecurity/trufflehog#5260

New Contributors

• @​hartsock made their first contribution in trufflesecurity/trufflehog#5223

Full Changelog: trufflesecurity/trufflehog@v3.97.1...v3.97.2

Commits

• 363923b added tests for twilio detector fixes (#5271)
• f537081 Improve the json-enumerator source (#5265)
• 8a9a4c6 Made retry exaustion indeterminate for Twilio secrets and twilioapikeys (#5267)
• 8947a7f Revert "De-base64 SourceUnit.UnitData in the GitHub Source (#5248)" (#5269)
• ea33cd0 fix(s3): cut a child context per object so key/size log values don't pile up ...
• cc1fe98 Retry git clone on secondary rate limit (bare 403/429) (#5260)
• 74dcf3f Update link to Truffle Security documentation (#5256)
• 2b75fd2 Implement Enumerate for the Jenkins source (#5229)
• 0c952ac De-base64 SourceUnit.UnitData in the GitHub Source (#5248)
• 1ea7fc1 expand result code in pagerduty detector (#5230)
• Additional commits viewable in compare view

Updates editorconfig-checker/action-editorconfig-checker from 2.2.0 to 3.0.0

Release notes

Sourced from editorconfig-checker/action-editorconfig-checker's releases.

editorconfig-checker v4

What's Changed

• feat: support editorconfig-checker binary name for v4 with legacy ec fallback by @​theoludwig in editorconfig-checker/action-editorconfig-checker#278
• minor workflow improvements by @​klaernie in editorconfig-checker/action-editorconfig-checker#279

Full Changelog: editorconfig-checker/action-editorconfig-checker@v2.2.0...v3.0.0

last v2 release

This release is the last release of this action, that fixes the editorconfig-checker core version to v3.11.3 - which is the last release that still uses the ec binary name.

Full Changelog: editorconfig-checker/action-editorconfig-checker@v2.2.0...v2.3.0

Commits

• 51f6331 Merge pull request #279 from editorconfig-checker/wf
• c70f28e also run regen-dist workflow, when the workflow itself changes
• d98bed8 prevent CI from running twice for dependabot PRs
• f2fa590 Merge pull request #278 from editorconfig-checker/feat/ec-binary-name-rename
• 19c56ad feat: support renamed editorconfig-checker release assets while keeping legac...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 9bd12510-783e-4d84-a30d-639d05c3dc6b

📥 Commits

Reviewing files that changed from the base of the PR and between 53d997e and f19061f.

📒 Files selected for processing (3)

• .github/workflows/codeql.yml
• .github/workflows/pages.yml
• .github/workflows/quality.yml

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated automated security analysis, deployment, secrets scanning, and formatting checks to newer action versions.
  • No changes to application functionality, workflow permissions, or deployment configuration.

Walkthrough

Three GitHub Actions workflows update pinned action versions for CodeQL, Pages deployment, secrets scanning, and EditorConfig checks. Workflow logic, permissions, matrices, and action inputs remain unchanged.

Changes

GitHub Actions version updates

Layer / File(s)	Summary
Pinned action version updates .github/workflows/codeql.yml, .github/workflows/pages.yml, .github/workflows/quality.yml	The workflows update the CodeQL, Pages deployment, TruffleHog, and EditorConfig checker action versions and commit pins. No workflow logic changes.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Suggested reviewers: hyperpolymath

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the workflow trail
Fresh action pins now mark the rail
CodeQL hops to newer ground
Pages deploys with a safer sound
Scans and style checks leap ahead}

_{Comment @coderabbitai help to get the list of available commands.}