trufflehog/3.88.13 package update

[octo-sts]

[octo-sts]

⚠️ EXPERIMENTAL

Please use 👍 or 👎 on this comment to indicate if you agree or disagree with the recommendation.

To provide more detailed feedback please comment on the recommendation prefixed with /ai-verify:

e.g. /ai-verify partially helpful but I also added bash to the build environment

Gen AI suggestions to solve the build error:

Based on the error output, I can provide a specific analysis and solution:

• Detected Error:

warning: Could not find remote branch v3.88.13 to clone.
fatal: Remote branch v3.88.13 not found in upstream origin

• Error Category: Version/Git Tag

• Failure Point:
The git-checkout step failed when attempting to clone the specific version tag

• Root Cause Analysis:
The error occurs because the git-checkout step is trying to use v3.88.13 as a branch name instead of a tag. Based on the repository's tag naming convention, there might be a mismatch between the actual tag in the repository and what we're trying to checkout.

• Suggested Fix:
Modify the git-checkout step in the melange YAML to use either:

  - uses: git-checkout
    with:
      repository: https://github.com/trufflesecurity/trufflehog
      tag: v3.88.13
      expected-commit: 03e8af1075a7f7410664de9f6a1101268c9c8c92

Or verify the correct tag exists in the repository and update to match the actual tag name.

• Explanation:
The issue appears to be a tag naming convention mismatch. The git-checkout action is looking for the exact tag name, and if the repository uses a different format (like without the 'v' prefix or a different version number), the checkout will fail.

• Additional Notes:

1. You can verify the correct tag by checking:
   • The releases page: https://github.com/trufflesecurity/trufflehog/releases
   • Using git ls-remote --tags https://github.com/trufflesecurity/trufflehog
2. The expected-commit hash should match the commit that the tag points to

• References:

• TruffleHog Releases: https://github.com/trufflesecurity/trufflehog/releases
• Melange Git Checkout Documentation: https://github.com/chainguard-dev/melange/blob/main/pkg/build/pipelines/git.go