chore(security): unify CodeQL Action v4.37.7

[seonghobae]

Outcome

Pins all 14 central github/codeql-action init, analyze, and upload-sarif uses to the full commit referenced by the official annotated v4.37.7 tag. This clean current-main replacement combines the complete scope of stale v4.37.6 alignment #918 with current v4.37.7 update #1107, which covered only two workflows.

Supersedes #918.
Supersedes #1107.

Verification

• TDD repository-wide pin contract failed on the existing v4.37.0/v4.37.4/v4.37.5 split and passed after alignment
• 1,394 passed, 1 skipped
• 8,346 statements / 3,214 branches at 100% coverage
• docstring coverage 100%
• actionlint passed for all seven changed workflows
• workflow shell-syntax contracts passed in the full suite
• git diff --check passed

Provenance

The official annotated v4.37.7 tag resolves to ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd. The doctoring record cites the official release and GitHub immutable-SHA guidance in APA 7th form.

---

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b2a520a4-a010-4d1b-aa41-b1860de659ea

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Implemented on exact head . The CodeQL pin contract now scans both and workflow files and only treats lines containing as action references, preventing both extension and explanatory-comment blind spots. Targeted contract tests: 4 passed; passed.

[seonghobae]

Implemented on exact head fe69696. The CodeQL pin contract now scans both yml and yaml workflow files and only treats lines containing uses as action references, preventing extension and explanatory comment blind spots. Targeted contract tests: 4 passed. git diff check passed.

[seonghobae]

Exact-head check RCA: current Strix run 32689043676 emitted provider-infrastructure output, produced no vulnerability report artifact, and failed on the NVIDIA fallback/direct-OpenAI provider path (LLM Provider NOT provided). The gate is correctly failing closed; no source vulnerability finding is present in this log. Revalidate after the provider/failover root PR is healthy.