chore(security): unify CodeQL Action v4.37.7

[seonghobae]

Outcome

Pins all 14 central github/codeql-action init, analyze, and upload-sarif uses to the full commit referenced by the official annotated v4.37.7 tag. This clean current-main replacement combines the complete scope of stale v4.37.6 alignment #918 with current v4.37.7 update #1107, which covered only two workflows.

Supersedes #918.
Supersedes #1107.

Verification

• TDD repository-wide pin contract failed on the existing v4.37.0/v4.37.4/v4.37.5 split and passed after alignment
• 1,394 passed, 1 skipped
• 8,346 statements / 3,214 branches at 100% coverage
• docstring coverage 100%
• actionlint passed for all seven changed workflows
• workflow shell-syntax contracts passed in the full suite
• git diff --check passed

Provenance

The official annotated v4.37.7 tag resolves to ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd. The doctoring record cites the official release and GitHub immutable-SHA guidance in APA 7th form.

---

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b2a520a4-a010-4d1b-aa41-b1860de659ea

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Implemented on exact head . The CodeQL pin contract now scans both and workflow files and only treats lines containing as action references, preventing both extension and explanatory-comment blind spots. Targeted contract tests: 4 passed; passed.

[seonghobae]

Implemented on exact head fe69696. The CodeQL pin contract now scans both yml and yaml workflow files and only treats lines containing uses as action references, preventing extension and explanatory comment blind spots. Targeted contract tests: 4 passed. git diff check passed.

[seonghobae]

Exact-head check RCA: current Strix run 32689043676 emitted provider-infrastructure output, produced no vulnerability report artifact, and failed on the NVIDIA fallback/direct-OpenAI provider path (LLM Provider NOT provided). The gate is correctly failing closed; no source vulnerability finding is present in this log. Revalidate after the provider/failover root PR is healthy.

[opencode-agent]

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for 1da2fce5a10c5036cb4c305b60b63594b0a446fd.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32718354490/job/97404293658)
• Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32718354490/job/97404293658)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow (7 files)"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow (7 files)"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Changed file: CHANGELOG.md"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
  R2 --> V2["required checks"]
  Evidence --> S3["Docs: codeql-action-single-version.md"]
  S3 --> I3["operator or user guidance"]
  I3 --> R3["Review risk: Docs: codeql-action-single-version.md"]
  R3 --> V3["docs review"]
  Evidence --> S4["Test: test_codeql_pr_workflow_contract.py"]
  S4 --> I4["regression suite"]
  I4 --> R4["Review risk: Test: test_codeql_pr_workflow_contract.py"]
  R4 --> V4["targeted test run"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: 1da2fce5a10c5036cb4c305b60b63594b0a446fd
• Workflow run: 32746020377
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for 1da2fce5a10c5036cb4c305b60b63594b0a446fd.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32718354490/job/97404293658)
• Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32718354490/job/97404293658)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow (7 files)"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow (7 files)"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Changed file: CHANGELOG.md"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
  R2 --> V2["required checks"]
  Evidence --> S3["Docs: codeql-action-single-version.md"]
  S3 --> I3["operator or user guidance"]
  I3 --> R3["Review risk: Docs: codeql-action-single-version.md"]
  R3 --> V3["docs review"]
  Evidence --> S4["Test: test_codeql_pr_workflow_contract.py"]
  S4 --> I4["regression suite"]
  I4 --> R4["Review risk: Test: test_codeql_pr_workflow_contract.py"]
  R4 --> V4["targeted test run"]

Loading

[opencode-agent]

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for 1da2fce5a10c5036cb4c305b60b63594b0a446fd.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32718354490/job/97404293658)
• Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32718354490/job/97404293658)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow (7 files)"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow (7 files)"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Changed file: CHANGELOG.md"]
  S2 --> I2["repository behavior"]
  I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
  R2 --> V2["required checks"]
  Evidence --> S3["Docs: codeql-action-single-version.md"]
  S3 --> I3["operator or user guidance"]
  I3 --> R3["Review risk: Docs: codeql-action-single-version.md"]
  R3 --> V3["docs review"]
  Evidence --> S4["Test: test_codeql_pr_workflow_contract.py"]
  S4 --> I4["regression suite"]
  I4 --> R4["Review risk: Test: test_codeql_pr_workflow_contract.py"]
  R4 --> V4["targeted test run"]

Loading