chore(deps): Bump devantler-tech/reusable-workflows/.github/workflows/scan-for-todo-comments.yaml from 5.5.5 to 5.5.8

[dependabot]

Bumps devantler-tech/reusable-workflows/.github/workflows/scan-for-todo-comments.yaml from 5.5.5 to 5.5.8.

Release notes

Sourced from devantler-tech/reusable-workflows/.github/workflows/scan-for-todo-comments.yaml's releases.

v5.5.8

5.5.8 (2026-06-07)

Bug Fixes

• validate-go-project: only auto-commit linter fixes on pull_request events (#306) (e5d0f20)

v5.5.7

5.5.7 (2026-06-06)

v5.5.6

5.5.6 (2026-06-05)

Commits

• e5d0f20 fix(validate-go-project): only auto-commit linter fixes on pull_request event...
• 538049f docs: align AGENTS.md trust gate with canonical contract (drop Copilot) (#304)
• 7f039c9 docs(create-release): document required APP_CLIENT_ID variable (#302)
• 3173756 chore(deps): bump devantler-tech/actions from 5.0.0 to 5.1.0 (#291)
• 6b44cfb ci(template-sync): add harden-runner egress audit as first step (#301)
• 0b00f17 docs(agents): document the govulncheck allowlist as a tested invariant (#300)
• e67eb6e ci(dependency-review): pin composite to released v5.4.0 SHA (#298)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

✅MegaLinter analysis: Success

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ ACTION	actionlint	6		0	0	0.32s
✅ ACTION	zizmor	6	0	0	0	2.15s
✅ BASH	bash-exec	1		0	0	0.01s
✅ BASH	shellcheck	1		0	0	0.02s
✅ BASH	shfmt	1	0	0	0	0.01s
✅ COPYPASTE	jscpd	yes		no	no	1.01s
✅ EDITORCONFIG	editorconfig-checker	29		0	0	0.06s
✅ GO	golangci-lint	yes	yes	no	no	19.57s
✅ JSON	jsonlint	1		0	0	0.55s
✅ JSON	prettier	1	0	0	0	0.64s
✅ JSON	v8r	1		0	0	2.03s
✅ MARKDOWN	markdownlint	5	0	0	0	1.21s
✅ MARKDOWN	markdown-table-formatter	5	0	0	0	0.22s
✅ REPOSITORY	checkov	yes		no	no	27.64s
✅ REPOSITORY	gitleaks	yes		no	no	0.21s
✅ REPOSITORY	git_diff	yes		no	no	0.01s
✅ REPOSITORY	grype	yes		no	no	57.77s
✅ REPOSITORY	osv-scanner	yes		no	no	1.89s
✅ REPOSITORY	secretlint	yes		no	no	1.04s
✅ REPOSITORY	syft	yes		no	no	2.1s
✅ REPOSITORY	trivy	yes		no	no	12.06s
✅ REPOSITORY	trivy-sbom	yes		no	no	0.18s
✅ REPOSITORY	trufflehog	yes		no	no	3.4s
✅ SPELL	lychee	16		0	0	0.86s
✅ YAML	prettier	10	0	0	0	0.66s
✅ YAML	v8r	10		0	0	11.9s
✅ YAML	yamllint	10		0	0	0.84s

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository