chore(deps): update github/codeql-action action to v4.37.9

[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
github/codeql-action	action	minor	v4.36.3 → v4.37.9

---

Release Notes

github/codeql-action (github/codeql-action)

v4.37.9

Compare Source

• Update default CodeQL bundle version to 2.26.4. #​4106

v4.37.8

Compare Source

No user facing changes.

v4.37.7

Compare Source

• Update default CodeQL bundle version to 2.26.3. #​4085

v4.37.6

Compare Source

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #​4070

v4.37.5

Compare Source

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #​4061

v4.37.4

Compare Source

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #​4037
• Update default CodeQL bundle version to 2.26.2. #​4051

v4.37.3

Compare Source

No user facing changes.

v4.37.2

Compare Source

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #​4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #​4007

v4.37.1

Compare Source

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #​3956
• Update default CodeQL bundle version to 2.26.1. #​4019

v4.37.0

Compare Source

• Update default CodeQL bundle version to 2.26.0. #​3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@​ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #​3973

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 2866c96f-eab2-4940-a346-b305e10fd008

📥 Commits

Reviewing files that changed from the base of the PR and between 100ebfd and cb96f82.

📒 Files selected for processing (2)

• .github/workflows/scorecard.yaml
• .github/workflows/security-codeql.yml

Included review availability: Your plan provides up to 12 included reviews per hour; 6 remain after this review.

---

Walkthrough

The pull request updates pinned CodeQL actions from v4.36.3 to v4.37.9 in the scorecard and security analysis workflows.

Changes

CodeQL workflow updates

Layer / File(s)	Summary
Update CodeQL action pins .github/workflows/scorecard.yaml, .github/workflows/security-codeql.yml	The workflows update SARIF upload, initialization, autobuild, and analysis actions to pinned CodeQL Action v4.37.9.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to cb96f

This updates the CodeQL workflow actions to v4.37.9 while retaining commit pinning. The reviewed workflow changes introduce no identified security, correctness, or operational risk and are ready to merge.

Suggested reviewers: xynnn007

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: updating the pinned github/codeql-action GitHub Action to v4.37.9.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PASS. The pull request changes only two GitHub workflow files. The exact diff updates pinned CodeQL Action references from v4.36.3 to v4.37.9. It does not add or modify Ginkgo test titles such as `It(…
Test Structure And Quality	✅ Passed	PASS: The pull request changes only two GitHub workflow files. The exact parent-to-HEAD diff updates pinned CodeQL Action references and adds no Ginkgo test files, It blocks, cluster operations, wai…
Microshift Test Compatibility	✅ Passed	PASS: The pull request changes only two GitHub workflow files. The diff updates CodeQL Action pins and adds no Ginkgo tests or test code. Therefore, the MicroShift test compatibility check is not appl…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS. The exact pull-request delta changes only two GitHub workflow files and updates pinned CodeQL action versions. It adds no Ginkgo e2e tests or other test entities, so the SNO multi-node compatibi…
Topology-Aware Scheduling Compatibility	✅ Passed	The pull request changes only GitHub Actions workflow configuration. The exact diff updates pinned CodeQL and runner-related action versions and retains workflow concurrency settings. It does not add …
Ote Binary Stdout Contract	✅ Passed	PASS. The pull request changes only four pinned github/codeql-action references in .github/workflows/scorecard.yaml and .github/workflows/security-codeql.yml. The exact parent-to-HEAD diff conta…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: The pull request changes only two GitHub Actions workflow files. The diff only updates pinned CodeQL action references from v4.36.3 to v4.37.9. It adds no Ginkgo e2e tests, IPv4 assumptions, or …
No-Weak-Crypto	✅ Passed	PASS: The pull request changes only four pinned github/codeql-action references from v4.36.3 to v4.37.9. The added lines contain no MD5, SHA1, DES, 3DES, RC4, Blowfish, ECB, custom crypto, or secret…
Container-Privileges	✅ Passed	PASS. The pull request changes only pinned github/codeql-action references in two GitHub workflow files. The exact diff adds no privileged: true, hostPID, hostNetwork, hostIPC, SYS_ADMIN c…
No-Sensitive-Data-In-Logs	✅ Passed	PASS — The diff only replaces four pinned github/codeql-action references from v4.36.3 to v4.37.9. It adds no run, echo, debug, secret, token, password, or personal-data logging. The workflows p…

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

Full details: Stable And Deterministic Test Names

Explanation

PASS. The pull request changes only two GitHub workflow files. The exact diff updates pinned CodeQL Action references from v4.36.3 to v4.37.9. It does not add or modify Ginkgo test titles such as It(), Describe(), Context(), or When(), and it introduces no dynamic test-name values.

Full details: Test Structure And Quality

Explanation

PASS: The pull request changes only two GitHub workflow files. The exact parent-to-HEAD diff updates pinned CodeQL Action references and adds no Ginkgo test files, It blocks, cluster operations, waits, or assertions. Therefore the stated Ginkgo test quality requirements are not applicable.

Full details: Microshift Test Compatibility

Explanation

PASS: The pull request changes only two GitHub workflow files. The diff updates CodeQL Action pins and adds no Ginkgo tests or test code. Therefore, the MicroShift test compatibility check is not applicable.

Full details: Single Node Openshift (Sno) Test Compatibility

Explanation

PASS. The exact pull-request delta changes only two GitHub workflow files and updates pinned CodeQL action versions. It adds no Ginkgo e2e tests or other test entities, so the SNO multi-node compatibility check is not applicable.

Full details: Topology-Aware Scheduling Compatibility

Explanation

The pull request changes only GitHub Actions workflow configuration. The exact diff updates pinned CodeQL and runner-related action versions and retains workflow concurrency settings. It does not add or modify deployment manifests, operator code, controllers, replicas, affinity, topology spread, node selectors, tolerations, or PDBs. The topology-aware scheduling check is therefore not applicable.

Full details: Ote Binary Stdout Contract

Explanation

PASS. The pull request changes only four pinned github/codeql-action references in .github/workflows/scorecard.yaml and .github/workflows/security-codeql.yml. The exact parent-to-HEAD diff contains no OTE binary or application code changes. The repository is a Rust workspace and the tracked-source search found no OpenShift Tests Extension, Ginkgo, Go main, or related process-level logging markers. Therefore, the OTE JSON stdout contract is not affected.

Full details: Ipv6 And Disconnected Network Test Compatibility

Explanation

PASS: The pull request changes only two GitHub Actions workflow files. The diff only updates pinned CodeQL action references from v4.36.3 to v4.37.9. It adds no Ginkgo e2e tests, IPv4 assumptions, or external-connectivity test logic.

Full details: No-Weak-Crypto

Explanation

PASS: The pull request changes only four pinned github/codeql-action references from v4.36.3 to v4.37.9. The added lines contain no MD5, SHA1, DES, 3DES, RC4, Blowfish, ECB, custom crypto, or secret/token comparison logic. Concurrency settings were already present in the parent revision. Repository-wide weak-crypto references are pre-existing and unchanged.

Full details: Container-Privileges

Explanation

PASS. The pull request changes only pinned github/codeql-action references in two GitHub workflow files. The exact diff adds no privileged: true, hostPID, hostNetwork, hostIPC, SYS_ADMIN capability, root execution setting, or allowPrivilegeEscalation: true. A repository search found no matching explicit privilege configuration in the changed files.

Full details: No-Sensitive-Data-In-Logs

Explanation

PASS — The diff only replaces four pinned github/codeql-action references from v4.36.3 to v4.37.9. It adds no run, echo, debug, secret, token, password, or personal-data logging. The workflows pass only CodeQL language/category values and a SARIF file path to the actions.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch konflux/mintmaker/main/github-codeql-action-4.x

---

_{Comment @coderabbitai help to get the list of available commands.}