ci(security): align CodeQL init and analyze at 4.37.6

[seonghobae]

Root cause

The open CodeQL upgrade lanes diverged: #425 aligned both init and analyze at 4.37.5, while #471 advanced only init to 4.37.6. Merging either unchanged would leave an older or split action identity.

Narrow remediation

• Pin both github/codeql-action/init and github/codeql-action/analyze to the immutable 4.37.6 commit 5595ccaf912efad79be6eef63a5619ff05969be3.
• Change only .github/workflows/codeql.yml.
• Supersede ci(security): update CodeQL init and analyze to 4.37.5 #425 and ci: bump github/codeql-action/init from 4.36.2 to 4.37.6 #471 while preserving their lineage.

Evidence identities

• Live protected base: develop@74a5e99d53b57aa9bc5fcfeab9a9447cf4cc2cf9
• Source commit: f340ebbe3c99aa17c0612ee0ed45ccb4920de929
• File blob: bf21857f18e74ae5d6c8956ae1c2c5d0464af51b

Repository-native and organization review/security gates must pass on this exact head before merge.

Summary by CodeRabbit

• 보안
  • CodeQL 분석 도구를 최신 버전으로 업데이트했습니다.
  • 코드 보안 검사 기능의 안정성과 분석 품질이 개선되었습니다.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 9205412d-5966-4574-a4b8-4fc4c98d1596

📥 Commits

Reviewing files that changed from the base of the PR and between 74a5e99 and f340ebb.

📒 Files selected for processing (1)

• .github/workflows/codeql.yml

---

📝 Walkthrough

Walkthrough

CodeQL 워크플로의 init 및 analyze 액션 버전을 v4.36.2에서 v4.37.6으로 업데이트했습니다.

Changes

CodeQL 액션 업데이트

Layer / File(s)	Summary
CodeQL 액션 버전 업데이트 .github/workflows/codeql.yml	init 및 analyze 액션이 v4.37.6을 사용하도록 변경되었습니다.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 CodeQL init 및 analyze 작업을 버전 4.37.6으로 정렬하는 주요 변경 사항을 정확하고 간결하게 설명합니다.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/codeql-actions-4.37.6

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

The only Trivy gate failure was reproduced locally: base Hono 4.12.32 is affected by the four advisories already remediated by #469. The CodeQL v4.37.6 change from this PR is now transferred into #469 at exact head 9186df5, which preserves both security fixes without duplicate PRs. This PR is superseded by that combined change.