From 43e790215bc3bd69ff826064f0f1d82793240a56 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 25 Aug 2026 07:05:25 +0000
Subject: [PATCH 1/3] ci: bump github/codeql-action/analyze from 4.36.2 to
 4.37.8

Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.36.2 to 4.37.8.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28)

---
updated-dependencies:
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.8
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/codeql.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 1a9461d5..dae5fb6f 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -40,6 +40,6 @@ jobs:
           languages: ${{ matrix.language }}
 
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
         with:
           category: "/language:${{ matrix.language }}"

From 1614f6a73536a267d901dff98ba8a7ff6f2b2bb5 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 25 Aug 2026 04:02:10 -0700
Subject: [PATCH 2/3] test(ci): require matching CodeQL action versions

---
 tests/unit/coverage-script-contract.test.mjs | 25 ++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/tests/unit/coverage-script-contract.test.mjs b/tests/unit/coverage-script-contract.test.mjs
index 149440e5..f41843e7 100644
--- a/tests/unit/coverage-script-contract.test.mjs
+++ b/tests/unit/coverage-script-contract.test.mjs
@@ -45,4 +45,29 @@ assert.doesNotMatch(
   'coverage cases never recursively invoke a coverage wrapper',
 );
 
+const codeqlWorkflow = readFileSync(
+  new URL('../../.github/workflows/codeql.yml', import.meta.url),
+  'utf8',
+);
+const codeqlActions = [
+  ...codeqlWorkflow.matchAll(
+    /uses:\s*github\/codeql-action\/(init|analyze)@([0-9a-f]{40})\s*#\s*v(\d+\.\d+\.\d+)/g,
+  ),
+].map(([, action, digest, version]) => ({ action, digest, version }));
+assert.deepEqual(
+  codeqlActions.map(({ action }) => action).sort(),
+  ['analyze', 'init'],
+  'CodeQL workflow must pin exactly the init and analyze actions covered by this contract',
+);
+assert.equal(
+  new Set(codeqlActions.map(({ version }) => version)).size,
+  1,
+  'CodeQL init and analyze must use the same released action version',
+);
+assert.equal(
+  new Set(codeqlActions.map(({ digest }) => digest)).size,
+  1,
+  'CodeQL init and analyze must use the same immutable action commit',
+);
+
 console.log('✓ coverage script contract tests passed');

From 8439b10a6b3d5f19d495d86917a5abfdca94a3c0 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Tue, 25 Aug 2026 04:02:50 -0700
Subject: [PATCH 3/3] fix(ci): align CodeQL init with analyze

---
 .github/workflows/codeql.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index dae5fb6f..d1f8e775 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -35,7 +35,7 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
         with:
           languages: ${{ matrix.language }}