build(deps): bump CodeQL SARIF uploader to 4.37.9

[seonghobae]

Problem

Protected main still pins github/codeql-action/upload-sarif to the v4.37.7 release-line commit ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd. Fresh upstream release inventory on 2026-09-05 shows v4.37.9 (published 2026-08-26) remains the latest v4 release and updates the default CodeQL bundle to 2.26.4. Its immutable commit is cdf488f595d80d6e07e03d4674febd5ab45fa938.

Current protected-main integration

Protected main advanced through #159 to exact 5829a0f08d78de464dd24393ce5d0f25fba9d126. #159 also changed .github/workflows/scorecard-analysis.yml by pinning the hosted runner to ubuntu-24.04, so blindly carrying this branch's older file would regress the now-protected workflow-pressure contract.

The branch was repaired non-destructively at exact d52222df7f9103100e63ba046cc0764c9c13d944, with prior head fea3796a723080068cdc02e064065d6d53eeb3e0 and live protected main as parents. The merged tree preserves #159's ubuntu-24.04, triggers, permissions, checkout pin, Scorecard pin, SARIF path and behavior while changing only the SARIF uploader commit to v4.37.9. No force push or destructive rebase was used.

Fresh compare against protected main reports behind_by=0; the effective delta is exactly one line in .github/workflows/scorecard-analysis.yml.

Verification contract

• exact current branch uses github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9;
• upstream GitHub Releases reports v4.37.9 as the latest v4 release at the fresh read and its release notes bind the default bundle to CodeQL 2.26.4;
• fix(actions): coalesce Wardnet PR validation slots #159's explicit ubuntu-24.04 workflow foundation remains intact;
• every then-live exact-head repository/security/central review/thread/governance gate must terminate cleanly before merge.

All predecessor check/review results are historical after the real protected-main integration. No self/model approval, force push, routine bypass, gate weakening or predecessor-evidence reuse.

Supersedes #126 only to the extent that this exact candidate carries the complete valid uploader-version delta; do not close any predecessor unless its remaining unique delta/evidence is verified fully transferred.

[coderabbitai]

Warning

Review limit reached

Next included review available in 46 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 1a5faddb-c71f-4cdf-8200-65826f846bd7

📥 Commits

Reviewing files that changed from the base of the PR and between 5829a0f and d52222d.

📒 Files selected for processing (1)

• .github/workflows/scorecard-analysis.yml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[seonghobae]

Protected main advanced through #171 to a52ccd0a24a727d9349bb32def7713882d8cad1e, so this older candidate is now a preservation predecessor rather than the integration lane. Fresh upstream inventory still makes the one-line v4.37.9 pin valid, and annotated tag v4.37.9 resolves to immutable commit cdf488f595d80d6e07e03d4674febd5ab45fa938.

Successor #174 was reconstructed directly from exact current protected main and carries exactly that one-line delta while preserving the current Scorecard workflow unchanged otherwise. This PR is now Draft. Do not close it until #174 reaches protected truth or a verified successor demonstrably carries the complete valid delta/evidence; do not promote this predecessor's stale checks into #174.