build(deps): bump github/codeql-action from 4.37.4 to 4.37.6

[dependabot]

Bumps github/codeql-action from 4.37.4 to 4.37.6.

Release notes

Sourced from github/codeql-action's releases.

v4.37.6

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

v4.37.5

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

Changelog

Sourced from github/codeql-action's changelog.

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

Commits

• 5595cca Merge pull request #4071 from github/update-v4.37.6-6a9359a1b
• ec9c757 Add change note for PR 4070
• 45c8742 Update changelog for v4.37.6
• 6a9359a Merge pull request #4070 from github/mbg/remote-address/change-file-default
• 065cdc0 Change DEFAULT_CONFIG_FILE_NAME
• f99dd5a Merge pull request #4066 from github/dependabot/npm_and_yarn/js-yaml-5.2.2
• 1804b21 Merge pull request #4068 from github/mergeback/v4.37.5-to-main-d1ba80a1
• 3020a2f Rebuild
• 93c3a5a Update changelog and version after v4.37.5
• d1ba80a Merge pull request #4067 from github/update-v4.37.5-1cd4d01d5
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 8, 2026, 10:35 PM ET / August 9, 2026, 02:35 UTC.

ClawSweeper review

What this changes

The PR updates the CodeQL workflow’s initialization and analysis actions from version 4.37.4 to 4.37.6.

Merge readiness

⚠️ Ready for maintainer review - 4 items remain

The patch is a clean, tested update to executable security-scanning automation, but a maintainer should explicitly accept the upstream CodeQL action release before merge.

Priority: P3
Reviewed head: 7c3262d5239970ef5e1cd4410064e0b2f951fd12
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A narrowly scoped dependency update with successful exact-head automation, pending the owner’s normal upstream-action trust decision.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot workflow-only PR is exempt from contributor real-behavior proof; the supplied exact-head CodeQL run provides relevant operational validation.
Patch quality	🐚 platinum hermit (4/6)	Security review found an item that needs attention.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This Dependabot workflow-only PR is exempt from contributor real-behavior proof; the supplied exact-head CodeQL run provides relevant operational validation.
Evidence reviewed	4 items	Narrow workflow update: The proposed branch changes only the two CodeQL action references from v4.37.4 to v4.37.6. Existing permission boundary: The action executes in a workflow limited to actions and contents read access plus security-events write access. Current workflow provenance: The current CodeQL workflow, including its v4.37.4 references, was introduced by the v0.13.0 release commit.
Findings	None	None.
Security	Needs attention	Accept the updated executable action release: Both CodeQL steps will execute the newer upstream action version; the successful run supports compatibility, but repository owners must decide whether to trust that release at this workflow boundary.

How this fits together

GitHub Actions runs CodeQL against pull requests, main-branch changes, and a weekly schedule, then reports Go security analysis to GitHub. This PR changes the GitHub-maintained action release used for initialization and analysis.

flowchart LR
  A[Source changes] --> B[CodeQL workflow]
  B --> C[CodeQL initialization]
  C --> D[Go security analysis]
  D --> E[GitHub security results]

Loading

Decision needed

Question	Recommendation
Should this repository accept github/codeql-action v4.37.6 as the executable CodeQL implementation under the existing workflow permissions?	Approve the patch update: Accept the official GitHub CodeQL patch release, whose exact PR head completed the repository’s CodeQL and standard validation checks.

Why: The patch is mechanically correct and passes its exact-head checks, but only repository owners can accept the third-party action release at this trust boundary.

Before merge

• Resolve security concern: Accept the updated executable action release - Both CodeQL steps will execute the newer upstream action version; the successful run supports compatibility, but repository owners must decide whether to trust that release at this workflow boundary.
• Resolve merge risk (P1) - Merging advances executable third-party security-scanning code that runs with security-results write permission; green checks show compatibility for this head but do not replace maintainer acceptance of GitHub’s upstream action release.
• Complete next step (P2) - A repository owner needs to accept the executable upstream CodeQL action release; no code repair is needed.

Findings

• [low] Accept the updated executable action release — .github/workflows/codeql.yml:32

Agent review details

Security

Needs attention: The patch preserves the existing workflow structure but changes an executable third-party action under security-results write permission, requiring owner acceptance of the upstream release.

Review metrics

Metric	Value	Why it matters
Workflow references changed	2 changed, 0 added, 0 removed	Both changes update the same CodeQL action release within one security workflow.
Exact-head checks	7 successful repository checks plus CodeQL	The updated action completed the repository’s supplied validation set on the proposed head.

Merge-risk options

Maintainer options:

1. Accept the GitHub action patch release (recommended)
   Merge after an owner accepts the upstream v4.37.6 executable action release, relying on the successful exact-head workflow results.
2. Pause for source or pinning review
   Hold the PR if the project requires a separate review of upstream action changes or a revised immutable-pinning policy before action updates.

Technical review

Best possible solution:

Accept the official patch update after confirming the repository’s existing trust policy permits this CodeQL action release; keep the current narrow workflow scope and permissions unchanged.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a GitHub Actions dependency update, not a reported runtime defect; the supplied exact-head CodeQL check completed successfully.

Is this the best way to solve the issue?

Yes: changing the two existing action references is the narrowest way to take the upstream patch release without altering workflow behavior or permissions.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning high; reviewed against 5413e5043fe7.

Labels

Label changes:

• add merge-risk: 🚨 security-boundary: The updated executable action runs in a workflow that can write security-event results.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• remove rating: 🦞 diamond lobster: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.

Label justifications:

• P3: This is a routine patch-level CI dependency update with no reported user-facing regression.
• merge-risk: 🚨 automation: The diff changes the GitHub Action release that performs repository security scanning.
• merge-risk: 🚨 security-boundary: The updated executable action runs in a workflow that can write security-event results.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This Dependabot workflow-only PR is exempt from contributor real-behavior proof; the supplied exact-head CodeQL run provides relevant operational validation.

Evidence

Security concerns:

• [low] Accept the updated executable action release — .github/workflows/codeql.yml:32
  Both CodeQL steps will execute the newer upstream action version; the successful run supports compatibility, but repository owners must decide whether to trust that release at this workflow boundary.
  Confidence: 0.97

What I checked:

• Narrow workflow update: The proposed branch changes only the two CodeQL action references from v4.37.4 to v4.37.6. (.github/workflows/codeql.yml:32, 7c3262d52399)
• Existing permission boundary: The action executes in a workflow limited to actions and contents read access plus security-events write access. (.github/workflows/codeql.yml:12, 5413e5043fe7)
• Current workflow provenance: The current CodeQL workflow, including its v4.37.4 references, was introduced by the v0.13.0 release commit. (.github/workflows/codeql.yml:32, c169dc7588f8)
• Exact-head validation: The supplied PR checks show successful CodeQL, test, lint, dependency, Docker, release-check, and secret-scanning runs for the proposed head. (.github/workflows/codeql.yml:32, 7c3262d52399)

Likely related people:

• Vincent Koc: Current-main blame and history attribute the creation of the CodeQL workflow to the v0.13.0 release commit. (role: workflow introducer; confidence: high; commits: c169dc7588f8; files: .github/workflows/codeql.yml)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• An owner should explicitly accept the GitHub CodeQL v4.37.6 release before merging.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (8 earlier review cycles)

• reviewed 2026-08-08T12:56:58.995Z sha 7c3262d :: needs maintainer review before merge. :: none
• reviewed 2026-08-08T15:22:10.422Z sha 7c3262d :: needs maintainer review before merge. :: none
• reviewed 2026-08-08T16:35:56.173Z sha 7c3262d :: needs maintainer review before merge. :: none
• reviewed 2026-08-08T18:41:17.352Z sha 7c3262d :: needs maintainer review before merge. :: none
• reviewed 2026-08-08T20:02:13.777Z sha 7c3262d :: needs maintainer review before merge. :: none
• reviewed 2026-08-08T21:27:55.829Z sha 7c3262d :: needs maintainer review before merge. :: none
• reviewed 2026-08-08T22:44:35.706Z sha 7c3262d :: needs maintainer review before merge. :: none
• reviewed 2026-08-09T01:03:57.382Z sha 7c3262d :: needs maintainer review before merge. :: none

[steipete]

Landed as 48feec921fbb6237b4c3a846d09ba5b44fc3e528 after exact-head validation.

Proof:

• Hosted CI was green for head 7c3262d5239970ef5e1cd4410064e0b2f951fd12, including the upgraded CodeQL analyze job, lint, tests, dependency checks, Docker, release snapshot, and secret scans.
• Local make check passed: tidy verification, formatting, lint, vet, staticcheck, gosec (0 findings), govulncheck (0 called vulnerabilities), 85.2% coverage, race tests, CLI smoke, and six-platform GoReleaser snapshot.
• Real built CLI smoke passed: ./bin/discrawl --version, ./bin/discrawl metadata --json, and ./bin/discrawl help tui all returned expected output.
• /Users/steipete/.codex/skills/agent-scripts/autoreview/scripts/autoreview --mode branch --base origin/main reported no accepted/actionable findings.

No caveats; the patch only updates both CodeQL action references from v4.37.4 to v4.37.6.