build(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.38.0

[dependabot]

Bumps github/codeql-action/upload-sarif from 4.37.0 to 4.38.0.

Release notes

Sourced from github/codeql-action/upload-sarif's releases.

v4.38.0

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

v4.37.9

• Update default CodeQL bundle version to 2.26.4. #4106

v4.37.8

No user facing changes.

v4.37.7

• Update default CodeQL bundle version to 2.26.3. #4085

v4.37.6

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

v4.37.5

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

v4.37.4

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

v4.37.3

No user facing changes.

v4.37.2

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

v4.37.1

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

Changelog

Sourced from github/codeql-action/upload-sarif's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

... (truncated)

Commits

• b96794f Merge pull request #4131 from github/update-v4.38.0-7e08580a9
• 02d5093 Update changelog for v4.38.0
• 7e08580 Merge pull request #4130 from github/henrymercer/workflow-runner-sizing
• bfcc52b Run slow macOS checks on larger runners
• 8c251e7 Merge pull request #4129 from github/update-bundle/codeql-bundle-v2.27.0
• 0b7ca40 Add changelog note
• 40484b3 Update default bundle to codeql-bundle-v2.27.0
• 977e6ce Merge pull request #4124 from github/henrymercer/toolcache-bundle-cleanup
• 40a6b38 Address toolcache cleanup review feedback
• deece8f Apply suggestion from @​henrymercer
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: github-actions. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 834fd50c-722e-4296-a79e-0565adad17e9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cwl-noema-review]

Noema LLM review

The PR updates github/codeql-action/upload-sarif from v4.37.0 to v4.38.0 in both .github/workflows/ossf-scorecard.yml and .github/workflows/security-audit.yml. The new pinned SHA b96794f015dfd88f77b49b1c93e0fa7110f94c63 matches the official v4.38.0 release, and the action invocation parameters are unchanged, so no behavioral regression is expected. One non-blocking issue: the comment in ossf-scorecard.yml still references v4.37.0 and should be updated for consistency.

Reviewed changed lines

• .github/workflows/ossf-scorecard.yml:86 (RIGHT): The version bump updates the pinned SHA to b96794f015dfd88f77b49b1c93e0fa7110f94c63 (v4.38.0). The with block (sarif_file) is unchanged, so no behavioral impact is expected. Note: the trailing comment still says '# v4.37.0 peeled commit' and should be updated.
• .github/workflows/security-audit.yml:95 (RIGHT): The version bump updates the pinned SHA to b96794f015dfd88f77b49b1c93e0fa7110f94c63 (v4.38.0). The with block (sarif_file) and the if: always() condition are unchanged, so no behavioral impact is expected.

Adversarial validation

• .github/workflows/security-audit.yml:95 (RIGHT) falsified: The new SHA b96794f015dfd88f77b49b1c93e0fa7110f94c63 does not match the official v4.38.0 release of github/codeql-action/upload-sarif. — The SHA is confirmed as the official v4.38.0 release SHA for the action.
• .github/workflows/ossf-scorecard.yml:86 (RIGHT) falsified: The version bump changes the action's behavior because the with inputs are interpreted differently in v4.38.0 compared to v4.37.0. — The invocation parameters are identical; only the action version is updated. No behavioral regression is plausible.
• Residual risk: Low. The SHA corresponds to the official v4.38.0 release and the action inputs are unchanged. The only minor issue is a stale comment in ossf-scorecard.yml that does not affect runtime behavior.

Findings

• [low] .github/workflows/ossf-scorecard.yml:86 (RIGHT): Stale comment: still says '# v4.37.0 peeled commit' but the pinned SHA is for v4.38.0. Update the comment to reflect the actual version to avoid confusion for future maintainers.

• Result: APPROVE
• Head SHA: 44da3c6ef8cd136f1a7cfaff39597004008851c2
• Reviewer credential: noema-review-github-app-refresh
• Actor: cwl-noema-review[bot]

[seonghobae]

Fresh review on the existing canonical dependency PR found two repository-owned admission/traceability defects, both repaired without changing the upstream CodeQL Action pin beyond the intended 4.38.0 bump.

First lineage:

• RED 26d303c106a405a84001abb0e283c66c48835bd4: require every active github/codeql-action/upload-sarif@<sha> use to carry a semantic-version annotation and require all repository upload-sarif workflows to agree on one (SHA, version) identity. The parent deterministically rejected mixed b96794f@v4.37.0 / b96794f@v4.38.0 source.
• GREEN 353ed079212fbc019df9886452d4cea90e455cc0: correct the Scorecard annotation to v4.38.0 without changing the pinned SHA or workflow behavior.
• Format 13ddc9cad0cb4687aa03c12f1c4615df78129c64 and edge verification 9df8e042948a9a2909283caece2d8c877cbff085: keep the regression Ruff-clean and cover both .yml and .yaml workflows.

Second live RED came from Dependabot itself on this PR: the GitHub Actions update configuration requested a github-actions label that does not exist, so Dependabot emitted The following labels could not be found: github-actions and could not apply the configured label set. This is hosted automation evidence, not a synthetic fixture. Minimal causal repair 1f4c500e11f821f640cb3ed4f80f737d1091c861 removes only that nonexistent optional label from the GitHub Actions Dependabot entry while retaining the existing dependencies label and all schedules/limits/target-branch settings. No label is invented through source, and npm/pip/cargo label policy is unchanged.

The upload-sarif regression does not validate upstream tag-to-SHA mapping; dependency-review/supply-chain evidence remains authoritative for that. The Dependabot repair proves only that repository configuration no longer asks the service for the known-missing github-actions label; future label taxonomy is a separate repository-governance decision.

Current head is now 1f4c500e11f821f640cb3ed4f80f737d1091c861. All predecessor checks/reviews are stale for merge admission. Keep unmerged until this exact head has applicable protected/central checks terminal-success and a qualifying independent current-head review; no synthetic status, self-approval, bypass, or no-op retrigger.

[seonghobae]

@cwl-noema-review current exact 1f4c500e11f821f640cb3ed4f80f737d1091c861를 protected develop@314ddeae7b775a4957594b599358c8255617eb2e 기준으로 review해 주세요. Review-only 요청입니다. 기존 44da3c6... approval은 stale입니다. 이번 descendant는 upload-sarif SHA/version annotation regression과 Dependabot의 실제 github-actions label-not-found RED를 수리했습니다. Source mutation, branch update, auto-merge는 요청하지 않습니다.

[cwl-noema-review]

Noema LLM review

The PR updates github/codeql-action/upload-sarif from v4.37.0 (SHA 99df26d4…) to v4.38.0 (SHA b96794f0…) in both ossf-scorecard.yml and security-audit.yml, with the new SHA and version annotation consistent across the two workflows. A new regression test (test_workflow_action_annotation_policy.py) enforces that every upload-sarif reference carries a 40‑character SHA and a semantic-version annotation, and that all such references share one identity. The dependabot label removal (github-actions) is an unrelated cosmetic change that does not affect dependency bump correctness or automation behavior; it is not a blocking issue. All changes are safe to merge.

Reviewed changed lines

• .github/workflows/ossf-scorecard.yml:86 (RIGHT): SHA pin updated from 99df26d4f13ea111d4ec1a7dddef6063f76b97e9 to b96794f015dfd88f77b49b1c93e0fa7110f94c63 with v4.38.0 annotation, matching the other workflow and the new test's single-identity requirement.
• .github/workflows/security-audit.yml:95 (RIGHT): SHA pin updated to the same b96794f0… v4.38.0 identity as ossf-scorecard.yml; the regression test verifies this consistency.
• services/analysis-engine/tests/test_workflow_action_annotation_policy.py:1 (RIGHT): New regression test robustly enforces that all upload-sarif references contain a 40-char SHA and semantic version (lines 12‑16) and that all references share one identity (lines 49‑54). The test passes with the current updated workflows.
• .github/dependabot.yml:41 (LEFT): Removal of the 'github-actions' label is an unrelated cosmetic change; no automation or consistency requirement depends on this label, and the change does not affect the upload-sarif pin update.

Adversarial validation

• .github/workflows/ossf-scorecard.yml:86 (RIGHT) falsified: The upload-sarif update could introduce an inconsistency between the two workflow files that the regression test would not catch. — Both files now use b96794f015dfd88f77b49b1c93e0fa7110f94c63 with v4.38.0, so the single-identity assertion holds.
• services/analysis-engine/tests/test_workflow_action_annotation_policy.py:1 (RIGHT) falsified: The new test could be bypassed by a malformed upload-sarif line that the regex misses, allowing annotation drift. — The regex requires exactly a 40-hex SHA and a semantic version (lines 12‑16); the test asserts no incomplete lines and only one identity, and current workflows satisfy these conditions.
• Residual risk: Low. The new test strengthens protection against upload-sarif annotation drift, but it does not cover dependabot label configuration; the label removal is non-blocking and does not affect the updated pin identity.

Findings

• No blocking findings.

• Result: APPROVE
• Head SHA: 1f4c500e11f821f640cb3ed4f80f737d1091c861
• Reviewer credential: noema-review-github-app-refresh
• Actor: cwl-noema-review[bot]

[seonghobae]

Current-head repair note (2026-09-17): the predecessor 1f4c500e11f821f640cb3ed4f80f737d1091c861 failed hosted ci / build-and-test in run 35077652840, job 104799140134, after checkout, npm/runtime validation, dependency sync, PyO3/maturin build, documentation/security/supply-chain/bootstrap checks and JS lint had succeeded. The first source-backed failure was Ruff 0.15.5 I001 on services/analysis-engine/tests/test_workflow_action_annotation_policy.py:3: the newly added action-pin regression's import block was not accepted by the repository's canonical Ruff gate.

I moved the PR back to Draft and repaired the PR-owned test on ordinary descendant 46afa8cbba955c758ecd3e80010a4e9d91a5e07d by removing the unnecessary postponed-annotations future import; this test only uses Python 3.12-native built-in generic annotations and has no forward-reference/runtime annotation dependency. The security/action-pin assertion semantics are unchanged. New exact-head CI/build/security/SBOM/Semgrep/CodeQL runs were generated naturally; predecessor results do not transfer. Keep Draft until 46afa8cb... has its own terminal applicable gates and current-head review evidence. No force-push, no no-op retrigger, no gate weakening.