chore(deps): bump github/codeql-action/init from 4.37.6 to 4.37.7

[dependabot]

Bumps github/codeql-action/init from 4.37.6 to 4.37.7.

Release notes

Sourced from github/codeql-action/init's releases.

v4.37.7

• Update default CodeQL bundle version to 2.26.3. #4085

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

... (truncated)

Commits

• ff2f1c6 Merge pull request #4093 from github/update-v4.37.7-be7a3dbb8
• 951a133 Update changelog for v4.37.7
• be7a3db Merge pull request #4087 from github/dependabot/npm_and_yarn/npm-minor-0aa561...
• 9310334 Merge pull request #4086 from github/mbg/thread-action-state-to-codeql
• b4d8a54 Rebuild
• ab5db25 Bump the npm-minor group across 1 directory with 8 updates
• 38055a3 Drop logger from databaseInitCluster in interface
• 1f87aed Merge pull request #4085 from github/update-bundle/codeql-bundle-v2.26.3
• dc1b98a Make logger available to getCodeQLForCmd
• 6f0220e Merge pull request #4084 from github/navntoft/bump-undici
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs changes before merge. Reviewed August 16, 2026, 4:18 PM ET / 20:18 UTC.

ClawSweeper review

What this changes

The PR updates the CodeQL workflow’s initialization action pin from v4.37.6 to v4.37.7.

Merge readiness

⛔ Blocked by patch quality or review findings - 4 items remain

Keep open: this partial CodeQL action upgrade leaves the analysis phase on v4.37.6 while initialization moves to v4.37.7, and the current CodeQL analysis check has not succeeded.

Priority: P2
Reviewed head: 00dea7be2a2efb4412e6716e8e2d79475c1fad2b

Review scores

Measure	Result	What it means
Overall readiness	🦪 silver shellfish (2/6)	PR readiness rating was derived from proof quality, review findings, security review, and reviewer confidence.
Proof confidence	🌊 off-meta tidepool	Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.
Patch quality	🦪 silver shellfish (2/6)	1 actionable review finding remain.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.
Evidence reviewed	4 items	Current paired workflow pins: Current main deliberately uses the identical v4.37.6 commit pin for both CodeQL initialization and analysis; the PR changes only the initialization line. PR diff: The submitted head advances init to the v4.37.7 commit but leaves analyze at the v4.37.6 commit. Workflow history: The prior CodeQL upgrade was explicitly introduced as an update of init and analyze together, establishing the relevant repository convention.
Findings	1 actionable finding	[P2] Update the paired CodeQL analysis action
Security	None	None.

How this fits together

The CodeQL GitHub Actions workflow initializes the Go analysis environment and then runs the analysis phase to publish repository security results. Both phases consume the workflow configuration and produce the scheduled and pull-request security scan outcome.

flowchart TD
  A[Pull request or scheduled run] --> B[CodeQL workflow]
  B --> C[Initialize analysis environment]
  C --> D[Run CodeQL analysis]
  D --> E[Security scan results]

Loading

Before merge

• Update the paired CodeQL analysis action (P2) - The workflow currently keeps init and analyze on the same commit, and the prior upgrade intentionally moved both together. This changes only initialization, leaving the analysis phase on v4.37.6; update it to the v4.37.7 commit too so the workflow uses one CodeQL Action release end to end.
• Resolve merge risk (P1) - Merging with init at v4.37.7 and analyze at v4.37.6 leaves the two phases on different CodeQL Action releases; the failing analyze check means the exact combined workflow remains unproven.
• Complete next step (P2) - A narrow mechanical repair can align the paired action pins, while a successful CodeQL run remains required before merge.
• Improve patch quality - Address the highest-priority review finding and re-run the changed-surface validation.

Findings

• [P2] Update the paired CodeQL analysis action — .github/workflows/codeql.yml:33

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
CodeQL action pins	1 updated, 1 paired pin unchanged	The workflow’s setup and analysis phases would run different releases after this change.

Merge-risk options

Maintainer options:

1. Align both CodeQL action phases (recommended)
   Update the analyze action to the same v4.37.7 commit pin and rerun CodeQL before merging.
2. Accept the split versions
   Merge only if a maintainer confirms the mixed action releases are intentional and the exact-head CodeQL run succeeds.

Copy recommended automerge instruction

@clawsweeper automerge

Special instructions:
Update github/codeql-action/analyze to the matching v4.37.7 commit pin and validate a successful CodeQL analysis run on the exact head.

Technical review

Best possible solution:

Update both CodeQL phases to the same v4.37.7 commit pin, then retain a successful CodeQL run from the exact head as upgrade evidence.

Do we have a high-confidence way to reproduce the issue?

Yes—source inspection reproduces the version split: the PR changes the init pin while the subsequent analyze pin remains at v4.37.6. A successful exact-head CodeQL run is still needed to establish runtime recovery.

Is this the best way to solve the issue?

No—the proposed one-line change is incomplete for this workflow because its paired analysis action remains on the prior release; updating both pins together is the narrower consistent repair.

Full review comments:

• [P2] Update the paired CodeQL analysis action — .github/workflows/codeql.yml:33
  The workflow currently keeps init and analyze on the same commit, and the prior upgrade intentionally moved both together. This changes only initialization, leaving the analysis phase on v4.37.6; update it to the v4.37.7 commit too so the workflow uses one CodeQL Action release end to end.
  Confidence: 0.93

Overall correctness: patch is incorrect
Overall confidence: 0.93

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against b793612bfa8a.

Labels

Label changes:

• add P2: This is a bounded CI security-scan workflow maintenance issue with a concrete repair.
• add merge-risk: 🚨 automation: The PR changes CodeQL workflow behavior while leaving its paired analysis action on an older release and the analyze job currently fails.
• add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🌊 off-meta tidepool and patch quality is 🦪 silver shellfish.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.

Label justifications:

• P2: This is a bounded CI security-scan workflow maintenance issue with a concrete repair.
• merge-risk: 🚨 automation: The PR changes CodeQL workflow behavior while leaving its paired analysis action on an older release and the analyze job currently fails.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🌊 off-meta tidepool and patch quality is 🦪 silver shellfish.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.

Evidence

Acceptance criteria:

• [P1] Verify .github/workflows/codeql.yml pins both github/codeql-action/init and github/codeql-action/analyze to ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd.
• [P1] Rerun the CodeQL analyze workflow on the exact repaired head and capture the successful run output.

What I checked:

• Current paired workflow pins: Current main deliberately uses the identical v4.37.6 commit pin for both CodeQL initialization and analysis; the PR changes only the initialization line. (.github/workflows/codeql.yml:33, b793612bfa8a)
• PR diff: The submitted head advances init to the v4.37.7 commit but leaves analyze at the v4.37.6 commit. (.github/workflows/codeql.yml:33, 00dea7be2a2e)
• Workflow history: The prior CodeQL upgrade was explicitly introduced as an update of init and analyze together, establishing the relevant repository convention. (.github/workflows/codeql.yml:33, 559430cb73a8)
• Current validation state: The supplied PR check data reports the CodeQL analyze job as failed; that alone does not establish cause, but it does not provide after-fix workflow proof. (.github/workflows/codeql.yml:37, 00dea7be2a2e)

Likely related people:

• Peter Steinberger: Authored the current paired CodeQL upgrade and the release commit containing the current workflow. (role: recent workflow contributor; confidence: high; commits: 559430cb73a8, b793612bfa8a; files: .github/workflows/codeql.yml)
• Vincent Koc: Introduced the CodeQL workflow and later action-pinning work in its history. (role: original workflow contributor; confidence: medium; commits: 67657590d7d2, 0390dcc930f1; files: .github/workflows/codeql.yml)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[steipete]

Superseded by #157, which lands this together with the rest of the dependency refresh in one coherent branch.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.