Update github/codeql-action action to v4.37.9

.github/workflows/build-container-bake.yml

@@ -608,7 +608,7 @@ jobs:
           && github.event_name != 'merge_group'
           && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
           && steps.trivy.outputs.count != '0'
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           # No `category` here: each SARIF carries its own distinct category
           # (automationDetails.id set in the scan step) so multi-target scans

.github/workflows/build-container.yml

@@ -353,7 +353,7 @@ jobs:
           && github.event_name != 'merge_group'
           && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
           && hashFiles('trivy-results.sarif') != ''
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: "trivy-results.sarif"
           category: "container-scan"

.github/workflows/codeql.yml

@@ -190,7 +190,7 @@ jobs:
       # analysis produced was clear-text logging of a credential in a Playwright
       # login helper — test code leaks into CI logs like any other code.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           languages: ${{ matrix.language }}
           queries: security-and-quality
@@ -214,7 +214,7 @@ jobs:
         run: bash -euo pipefail -c "$PRE_BUILD_CMD"
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           category: /language:${{ matrix.language }}
           # On `merge_group` the analysis runs but its result is not uploaded.

.github/workflows/gitleaks.yml

@@ -82,7 +82,7 @@ jobs:
 
       - name: Upload SARIF to code scanning
         if: always() && hashFiles('betterleaks.sarif') != ''
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: betterleaks.sarif
           category: betterleaks

.github/workflows/go-check.yml

@@ -537,7 +537,7 @@ jobs:
         # failure on every successful merge. Push and pull_request events
         # re-run the same scan with a stable ref, so coverage is not lost.
         if: always() && github.event_name != 'merge_group' && hashFiles('gosec-results.sarif') != ''
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: gosec-results.sarif
 

.github/workflows/release-go-app.yml

@@ -637,7 +637,7 @@ jobs:
         # and producing a guaranteed `ref ... not found` failure. Release/push
         # events run with stable refs.
         if: github.event_name != 'merge_group' && hashFiles('trivy-results.sarif') != ''
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: trivy-results.sarif
           category: container-scan

.github/workflows/scorecard.yml

@@ -59,6 +59,6 @@ jobs:
         # and producing a guaranteed `ref ... not found` failure. Push and
         # schedule events run with stable refs.
         if: github.event_name != 'merge_group'
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: results.sarif

.github/workflows/security-container.yml

@@ -198,7 +198,7 @@ jobs:
         # the moment the merge completes, racing with codeql-action/upload-sarif
         # and producing a guaranteed `ref ... not found` failure.
         if: always() && inputs.upload-sarif && github.event_name != 'merge_group' && hashFiles('trivy-results.sarif') != ''
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: trivy-results.sarif
           category: ${{ inputs.sarif-category }}