build(deps): Bump google/osv-scanner-action/osv-scanner-action from a82132c0bd6c7261ffcb78e754c46c70ab57ad9a to 9fd1bcce27f67e3bd819a0a7620e332803dc43bc

[dependabot]

Bumps google/osv-scanner-action/osv-scanner-action from a82132c0bd6c7261ffcb78e754c46c70ab57ad9a to 9fd1bcce27f67e3bd819a0a7620e332803dc43bc.

Commits

• 9fd1bcc Merge pull request #138 from google/fix/gotoolchain-auto
• 01a87d5 fix: add GOTOOLCHAIN=auto env to osv-scanner calls
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[hermes-exosphere]

Automated code review started - full review. Results will be posted here.

[hermes-exosphere]

✅ Auto-approved: all 10 CI checks passing. Ready to merge.

[hermes-exosphere]

⏳ [progress] Build & test phase complete. Running 2357 tests across 131 test files...

[hermes-exosphere]

✅ Build & test complete. Results:

• Build: N/A (workflow pin update only, no code changes)
• Tests: 2357 passed / 0 failed across 131 test files
• All CI checks: green (OSV-Scanner ✓, Socket Security ✓, build ✓, docs ✓, quality ✓, test (3 variants) ✓, test-e2e ✓)

[hermes-exosphere]

🔍 Automated Code Review

📋 Executive Summary

This is a routine Dependabot version bump for the google/osv-scanner-action GitHub Action used in the supply-chain security workflow. The pin moves from a82132c to 9fd1bcc — 2 commits forward, both within the v2.3.8 lineage. The only upstream change is adding GOTOOLCHAIN=auto to the osv-scanner action internal Docker environment, fixing Go toolchain resolution. No breaking changes, no code modifications to the failproofai project itself.

---

📊 Change Architecture

graph TD
    A["osv-scanner.yml workflow"] -->|"pin: a82132c → 9fd1bcc"| B["google/osv-scanner-action@v2.3.8"]
    B --> C["Internal: GOTOOLCHAIN=auto env added"]
    C --> D["Fixes Go toolchain resolution in Docker"]
    D --> E["Same scan behavior, no user-visible change"]

    style C fill:#90EE90
    style B fill:#87CEEB
    style A fill:#87CEEB

Loading

Legend: 🟢 New | 🔵 Modified | 🟡 Breaking Change Risk

---

🔴 Breaking Changes

✅ No breaking changes detected. The pin is a forward move within the same v2.3.8 release. The action inputs (scan-args) are unchanged. The workflow file is otherwise identical.

---

⚠️ Issues Found

No issues found. This is a clean, minimal pin update.

---

🔬 Logical / Bug Analysis

Dependency legitimacy verified:

• Both old SHA (a82132c) and new SHA (9fd1bcc) exist on the upstream repo
• New SHA has old SHA as its direct parent — this is a fast-forward, not a branch hop
• Comparison: 0 behind, 2 ahead — clean linear history
• Upstream change: PR [CLAUDE ROUTINE]: Enhancement — add trust-on-first-use for convention-discovered policy files #138 — adds GOTOOLCHAIN: auto env var to the Docker-based action to handle Go 1.21+ toolchain auto-download. No logic changes to scanning behavior.

Workflow integrity:

• Action reference format: google/osv-scanner-action/osv-scanner-action@<full-40-char-sha> ✓
• Version comment # v2.3.8 remains correct (both commits are within v2.3.8 ancestry)
• SHA is a full 40-char commit hash (not a short SHA or tag) — best practice for supply-chain security
• persist-credentials: false on checkout step still present ✓
• permissions: contents: read still at job level ✓

---

🧪 Evidence — Build & Test Results

Test Results (full suite)

✓ 131 test files passed
✓ 2357 tests passed
✓ 0 failures
✓ Duration: 136.30s

All CI workflows green:
- OSV-Scanner: pass (23s)
- Socket Security (Project Report + PR Alerts): pass
- build: pass (1m10s)
- docs: pass (1m41s)
- quality: pass (1m3s)
- test (default): pass (1m17s)
- test (hook-log-file, 1): pass (1m20s)
- test (log-debug, debug): pass (1m24s)
- test-e2e: pass (1m2s)

---

🔗 Issue Linkage

⚠️ No issue linked. This is a standard Dependabot dependency bump — no issue required for this category of PR.

---

👥 Human Review Feedback

No human review comments on this PR. The only existing comment is a prior bot (hermes-exosphere) progress marker.

---

💡 Suggestions

1. 🔵 Info — The pinned SHA is 11 commits behind the v2.3.8 tag head (9a49870). A future bump could consider catching up to the tag tip, which includes the same GOTOOLCHAIN=auto fix plus 9 additional commits. Not blocking — the current pin already includes the critical fix from PR [CLAUDE ROUTINE]: Enhancement — add trust-on-first-use for convention-discovered policy files #138.

---

🏆 Verdict

VERDICT: APPROVED

---

Automated code review · 2026-07-28 02:47 UTC

[hermes-exosphere]

Automated review: Approved. ✅