chore(deps): bump github/codeql-action/init from 4.37.0 to 4.37.7

[dependabot]

Bumps github/codeql-action/init from 4.37.0 to 4.37.7.

Release notes

Sourced from github/codeql-action/init's releases.

v4.37.7

• Update default CodeQL bundle version to 2.26.3. #4085

v4.37.6

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

v4.37.5

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

v4.37.4

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

v4.37.3

No user facing changes.

v4.37.2

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

v4.37.1

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

... (truncated)

Commits

• ff2f1c6 Merge pull request #4093 from github/update-v4.37.7-be7a3dbb8
• 951a133 Update changelog for v4.37.7
• be7a3db Merge pull request #4087 from github/dependabot/npm_and_yarn/npm-minor-0aa561...
• 9310334 Merge pull request #4086 from github/mbg/thread-action-state-to-codeql
• b4d8a54 Rebuild
• ab5db25 Bump the npm-minor group across 1 directory with 8 updates
• 38055a3 Drop logger from databaseInitCluster in interface
• 1f87aed Merge pull request #4085 from github/update-bundle/codeql-bundle-v2.26.3
• dc1b98a Make logger available to getCodeQLForCmd
• 6f0220e Merge pull request #4084 from github/navntoft/bump-undici
• Additional commits viewable in compare view

---

[opencode-agent]

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for d03fa6ebf0f877cbcbea870ec4f81a34e551ba5a.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• CodeQL PR/CodeQL compatibility analysis (actions): FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32171546362/job/95824863748)
• CodeQL PR/CodeQL compatibility analysis (python): FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32171546362/job/95824863632)
• CodeQL PR/CodeQL merge preview (actions): FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32171546362/job/95824863678)
• CodeQL PR/CodeQL merge preview (python): FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32171546362/job/95824863626)
• CodeQL compatibility analysis (actions) check run: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32171546362/job/95824863748)
• CodeQL compatibility analysis (python) check run: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32171546362/job/95824863632)
• CodeQL merge preview (actions) check run: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32171546362/job/95824863678)
• CodeQL merge preview (python) check run: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32171546362/job/95824863626)
• Hourly NVIDIA NIM Review Repair/Hourly cadence, immutable source, NIM credential, and conflict scope: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32171543825/job/95823632068)
• Hourly cadence, immutable source, NIM credential, and conflict scope check run: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32171543825/job/95823632068)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow (2 files)"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow (2 files)"]
  R1 --> V1["actionlint plus required checks"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: cf87c5389ad776c5f03b92226a3307bd7e759fe7
• Workflow run: 32635523666
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for cf87c5389ad776c5f03b92226a3307bd7e759fe7.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32634912565/job/97183098656)
• Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32634912565/job/97183098656)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow (2 files)"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow (2 files)"]
  R1 --> V1["actionlint plus required checks"]

Loading

[seonghobae]

Exact-current-head review request for 31f579a4ec8059056be3d4a203abd5565c24d337 against protected main@eb0ee5c68c9e807644a920c1a5fb4caa1cf2fe97. The Dependabot CodeQL update was rebased onto current main; both changed workflows pass actionlint. Prior failed checks/review were on stale head d03fa6ebf0f877cbcbea870ec4f81a34e551ba5a; review this exact head only, with no bypass merge.

[seonghobae]

Current-head repair on 87c8f9d60f72781a02d3c81a5a38dc3a0b42ba51: the Hourly NVIDIA NIM contract exposed mixed CodeQL action versions (init 4.37.7 versus analyze 4.37.0/4.37.5). All init, analyze, and upload-sarif refs in both affected workflows now use the pinned 4.37.7 SHA. Targeted contract/actionlint validation: 43 passed. Please review this exact head; prior failure was on 31f579a4ec8059056be3d4a203abd5565c24d337.

[seonghobae]

Current head is c84e02535ab5fbddca197a84a9985efa96b0f13b on current base bbedc1a51ec1a2421f129955c629b3cd0507a4ec. The OpenCode CHANGES_REQUESTED review is bound to superseded head d03fa6ebf0f877cbcbea870ec4f81a34e551ba5a; its CodeQL/hourly failures are not current-head evidence. No source change was made because this is a Dependabot action-version update; current protected checks are queued for c84e025. No bypass or self-approval used.

[seonghobae]

Rebased Dependabot update onto current main@c47bee59. Exact head: 2a98202. Current diff was checked for path integrity; required workflow YAML updates were actionlint-validated where applicable, and hash-lock changes retain explicit package/file digests.

[seonghobae]

@OpenCode Please review exact current head 2a98202 against base main@c47bee591c3d95bd305f2130833ed3a4780d2d1d.

[seonghobae]

@opencode-agent review exact current head 3728920010416c2ddbc20c19f8233db8889f3b69 against protected base 2cce96f8671bfde7e354effef931c14a5928c23b. Rebased the Dependabot-only CodeQL action update onto current main; changed workflows pass actionlint and diff --check. The prior CHANGES_REQUESTED verdict is bound to predecessor head d03fa6ebf...; do not treat its failures as current-head evidence.

Dismiss stale review: review commit d03fa6e is not current PR head 705b854; current-head review is required.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[seonghobae]

@opencode-agent Please review exact current HEAD a9399af51efc03479472e4aa066bac24e2fd329b only. Earlier CodeQL failures were on stale heads; current Checks are queued. Report actionable findings or approve only this exact commit, without bypass.

[seonghobae]

The failed Strix attempt was reviewed against exact head 3ef0265. The source/test step did not run: repository visibility lookup returned GitHub API HTTP 403 installation rate-limit. This is infrastructure-only evidence; the security gate was not weakened and a failed-only rerun is queued.

[opencode-agent]

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for affb6787066e83cd06f2f78574f01c364ca24e13.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32590780856/job/97074167582)
• Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32590780856/job/97074167582)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow (2 files)"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow (2 files)"]
  R1 --> V1["actionlint plus required checks"]

Loading

[opencode-agent]

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for cf87c5389ad776c5f03b92226a3307bd7e759fe7.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32634912565/job/97183098656)
• Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32634912565/job/97183098656)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow (2 files)"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow (2 files)"]
  R1 --> V1["actionlint plus required checks"]

Loading

[seonghobae]

Superseded by clean protected-main replacement #1274. The replacement retains this PR’s official v4.37.7 commit while extending it to every central init, analyze, and upload-sarif use with a repository-wide regression contract.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.