build(deps): bump github/codeql-action from 4.37.6 to 4.37.7

[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Bumps github/codeql-action from 4.37.6 to 4.37.7.

Release notes

Sourced from github/codeql-action's releases.

v4.37.7

• Update default CodeQL bundle version to 2.26.3. #4085

Changelog

Sourced from github/codeql-action's changelog.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

Commits

• ff2f1c6 Merge pull request #4093 from github/update-v4.37.7-be7a3dbb8
• 951a133 Update changelog for v4.37.7
• be7a3db Merge pull request #4087 from github/dependabot/npm_and_yarn/npm-minor-0aa561...
• 9310334 Merge pull request #4086 from github/mbg/thread-action-state-to-codeql
• b4d8a54 Rebuild
• ab5db25 Bump the npm-minor group across 1 directory with 8 updates
• 38055a3 Drop logger from databaseInitCluster in interface
• 1f87aed Merge pull request #4085 from github/update-bundle/codeql-bundle-v2.26.3
• dc1b98a Make logger available to getCodeQLForCmd
• 6f0220e Merge pull request #4084 from github/navntoft/bump-undici
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 22, 2026, 8:56 AM ET / 12:56 UTC.

ClawSweeper review

What this changes

The PR updates the CodeQL workflow’s initialization and analysis actions from v4.37.6 to v4.37.7.

Merge readiness

⚠️ Ready for maintainer review - 2 items remain

Keep open: current main still pins CodeQL v4.37.6, while this PR narrowly upgrades both action invocations to v4.37.7. No correctness finding was identified; likely routing is Peter Steinberger from the current workflow history.

Priority: P3
Reviewed head: 41cf8ac25cf0e966ba3864e36ee40e6a47129d84

Review scores

Measure	Result	What it means
Overall readiness	🦞 diamond lobster (5/6)	PR readiness rating was derived from proof quality, review findings, security review, and reviewer confidence.
Proof confidence	🌊 off-meta tidepool	Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.
Patch quality	🦞 diamond lobster (5/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.
Evidence reviewed	4 items	Current main workflow: The default-branch workflow still uses github/codeql-action v4.37.6 for initialization and analysis. PR-head change: The proposed commit changes only the two CodeQL action references to v4.37.7; workflow triggers, permissions, and language configuration are unchanged. Workflow provenance: Blame attributes the current CodeQL action references to the v0.13.3 release-preparation commit.
Findings	None	None.
Security	None	None.

Live Verification

Command: git show HEAD:.github/workflows/codeql.yml

Result: FAIL (failed) — execution before step 1 run: sh -lc pnpm install --ignore-scripts --frozen-lockfile failed: ! Corepack is about to download https://registry.npmjs.org/pnpm/-/pnpm-11.22.0.tgz

sh -lc pnpm install --ignore-scripts --frozen-lockfile failed: ! Corepack is about to download https://registry.npmjs.org/pnpm/-/pnpm-11.22.0.tgz

Assertions:

• FAIL expect_output: github/codeql-action/init@v4.37.7
• FAIL expect_output: github/codeql-action/analyze@v4.37.7

How this fits together

The CodeQL GitHub Actions workflow scans the repository’s Go source on pull requests, main pushes, and a weekly schedule. It sends static-analysis results to GitHub code scanning.

flowchart LR
  A[Go source] --> B[CodeQL workflow]
  B --> C[Initialize CodeQL]
  C --> D[Analyze source]
  D --> E[GitHub security results]

Loading

Before merge

• Resolve merge risk (P1) - The upstream patch changes the CodeQL bundle used by CI, so maintainers should wait for the current head’s analyze check to complete successfully before merging.
• Complete next step (P2) - No repair lane is needed; wait for the normal CodeQL analysis result before merging.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Workflow references	2 changed, 0 added, 0 removed	Both CodeQL action entry points move together, without altering workflow permissions or triggers.

Merge-risk options

Maintainer options:

1. Verify the updated CodeQL scan (recommended)
   Wait for the current head’s CodeQL analysis to pass before merging the two-reference update.

Copy recommended automerge instruction

@clawsweeper automerge

Special instructions:
Require the CodeQL analyze check to pass on the current head.

Technical review

Best possible solution:

Merge the narrow update once the completed CodeQL analysis confirms the updated action works, while retaining the current workflow permissions and triggers.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this updates CI action pins rather than repairing a reported runtime defect.

Is this the best way to solve the issue?

Yes: updating both CodeQL entry points together is the narrowest consistent way to adopt the upstream patch release.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning high; reviewed against 938b6b279dfc.

Labels

Label changes:

• add P3: This is a routine patch-level CI dependency update.
• add merge-risk: 🚨 automation: The changed references control the CodeQL action executed by repository CI.
• add rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🌊 off-meta tidepool and patch quality is 🦞 diamond lobster.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.

Label justifications:

• P3: This is a routine patch-level CI dependency update.
• merge-risk: 🚨 automation: The changed references control the CodeQL action executed by repository CI.
• rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🌊 off-meta tidepool and patch quality is 🦞 diamond lobster.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.

Evidence

What I checked:

• Current main workflow: The default-branch workflow still uses github/codeql-action v4.37.6 for initialization and analysis. (.github/workflows/codeql.yml:32, 938b6b279dfc)
• PR-head change: The proposed commit changes only the two CodeQL action references to v4.37.7; workflow triggers, permissions, and language configuration are unchanged. (.github/workflows/codeql.yml:32, 41cf8ac25cf0)
• Workflow provenance: Blame attributes the current CodeQL action references to the v0.13.3 release-preparation commit. (.github/workflows/codeql.yml:32, 089c1f5b6ae4)
• Autoreview limitation: The structured review helper could not review the commit because its commit-diff resolver reported unrelated binary additions, despite the direct base-to-head workflow diff being limited to this one file. (.github/workflows/codeql.yml:32, 41cf8ac25cf0)

Likely related people:

• Peter Steinberger: Blame assigns the currently pinned CodeQL references to the v0.13.3 release-preparation commit. (role: current workflow-line introducer; confidence: high; commits: 089c1f5b6ae4; files: .github/workflows/codeql.yml)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[steipete]

Superseded by #189, which lands the dependency refresh as one coherent branch (avoids lockfile cascades) with build + smoke proof.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.