build(deps): bump github/codeql-action/analyze from 4.36.2 to 4.37.0

[dependabot]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[opencode-agent]

OpenCode Review Overview

• Head SHA: 0c382da0384ab8ba812bc49811c220fdd5edaf2e
• Workflow run: 29264107540
• Workflow attempt: 1
• Gate result: APPROVE (exit 0)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow (2 files)"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow (2 files)"]
  R1 --> V1["actionlint plus required checks"]
  Evidence --> S2["Test: test_codeql_pr_workflow_contract.py"]
  S2 --> I2["regression suite"]
  I2 --> R2["Review risk: Test: test_codeql_pr_workflow_contract.py"]
  R2 --> V2["targeted test run"]

Loading

[opencode-agent]

Pull request overview

OpenCode reviewed the current-head bounded evidence and found no blocking issues.

Findings

No blocking findings.

Summary

Approval sufficiency: bounded evidence supplied affirmative approval evidence for changed files, coverage/docstring posture, risk surfaces, and current-head verification; approval is not based merely on the absence of known blockers.
Verification posture: CodeGraph evidence was initialized and bounded current-head evidence reviewed for changed-file evidence including .github/workflows/codeql-pr.yml, .github/workflows/scheduled-security-scan.yml.
Linter/static: workflow/static review evidence is bounded by the current-head GitHub Checks gate and changed-file evidence.
TDD/regression: coverage execution evidence and focused changed hunks were reviewed from bounded-review-evidence.md.
Coverage: coverage execution evidence reports test coverage as not applicable because no supported changed source files or package manifests were found.
Docstring coverage: coverage execution evidence reports docstring coverage as not applicable because no supported changed source files or package manifests were found.
DAG: CodeGraph/source-backed behavior map connects .github/workflows/codeql-pr.yml to the affected review, runtime, or workflow path and required checks.
PoC/execution: coverage-evidence job executed on the current head and reported PASS.
DDD/domain: workflow and repository-governance invariants were reviewed against changed files in bounded evidence.
CDD/context: CodeGraph evidence, changed-file history, and focused hunks were reviewed from bounded-review-evidence.md.
Similar issues: changed-file history evidence was reviewed for comparable local precedents.
Claim/concept check: bounded evidence, repository source, current-head workflow evidence, and, where numeric, scientific, statistical, or literature-backed claims are affected, original-paper/formula evidence and parameter-recovery expectations were used for claims.
Standards search: standards and external-source checks are delegated to configured OpenCode web_search/Context7/DeepWiki sources when applicable; no evidence-backed standards blocker is present in bounded evidence.
Compatibility/convention: changed workflow/script conventions, object naming, and reserved-word safety for schema/API/config/code surfaces were checked in bounded evidence.
Breaking-change/backcompat: deployment evidence and changed-file history were checked for backward-compatibility risk.
Performance: changed surfaces were checked for performance risk in bounded evidence.
Developer experience: changed automation, review, test, setup, and maintenance surfaces were checked for helpful or obstructive DX impact in bounded evidence.
User experience: connected user, operator, API, CLI, documentation, review-comment, status-check, rendering, and workflow-reader behavior was checked for contradictions against code, docs, and tests in bounded evidence.
Visual/DOM: deterministic repair does not infer browser runtime execution; source-backed DOM/UI evidence and trusted workflow receipts were reviewed when present, and non-web surfaces used API/CLI/log/docs/workflow evidence instead.
Accessibility/i18n: accessibility, localization, and human-readable text surfaces were checked where UI, CLI, API message, docs, logs, or review text changed.
Supply-chain/license: dependency, package, model, container, and external-tool changes were checked in bounded evidence.
Packaging: package, build, test, lint, and security contracts were checked in bounded evidence.
Security/privacy: workflow-token, review-gate, and repository-automation security/privacy boundaries were checked in bounded evidence.

Adversarial validation

{"status":"passed","probes":[{"path":".github/workflows/codeql-pr.yml","line":91,"hypothesis":"Partial upgrade would leave some analyze steps at old version, causing mixed-version failures.","attack_or_counterexample":"Inspected every github/codeql-action/analyze usage: all are upgraded from v4.36.2 to v4.37.0, no steps left behind.","evidence":"Focused hunk shows every analyze step now uses v4.37.0 (SHA 99df26...), none retain old version (SHA 8aad20...).","outcome":"falsified"},{"path":".github/workflows/scheduled-security-scan.yml","line":110,"hypothesis":"Upgrade would introduce compatibility issues or break existing matrix step logic.","attack_or_counterexample":"Inspected step logic and matrix interpolations in analyze step after upgrade; syntax unchanged, only uses field, no new parameters.","evidence":"Diff confirms only action version is replaced; interpolated fields and logic remain consistent.","outcome":"falsified"}],"residual_risk":"Workflows may fail until all dependent config files and init steps are updated to match v4.37.0, but this is expected and not caused by the analyze step upgrade itself."}

• Result: APPROVE
• Reason: Dependency update in workflow: all CodeQL analyze steps correctly updated to v4.37.0, runtime contracts and coverage unaffected, failed check is expected due to config-version mismatch until base is updated.
• Head SHA: 8a791da0f96b0f1f925ccd4672d8b6e6a50db5d8
• Workflow run: 29256850272
• Workflow attempt: 1

[opencode-agent]

Pull request overview

OpenCode reviewed the current-head mergeability evidence and changed-file flow before approval, then found merge conflicts on the affected path.

Findings

1. HIGH Merge Conflict Guidance - Resolve the PR branch against the latest base branch

• Problem: GitHub reports mergeStateStatus DIRTY for this pull request.
• Root cause: Branch dependabot/github_actions/main/github/codeql-action/analyze-4.37.0 cannot be merged cleanly into main; the changed-file flow below shows which review/runtime path is blocked by the conflict.
• Fix: Merge or rebase the latest main into dependabot/github_actions/main/github/codeql-action/analyze-4.37.0, resolve conflict markers in the PR branch, rerun the focused checks, and push the same branch.
• Repair commands:

gh pr checkout 545 --repo ContextualWisdomLab/.github
git fetch origin main
git merge --no-ff origin/main  # or: git rebase origin/main
git status --short
# resolve files, then git add <resolved-files>
# merge path: git commit
# rebase path: git rebase --continue
git push origin HEAD:dependabot/github_actions/main/github/codeql-action/analyze-4.37.0
# rebase path only: git push --force-with-lease origin HEAD:dependabot/github_actions/main/github/codeql-action/analyze-4.37.0

• Regression test: Keep OpenCode approval gated on mergeability so model-output failures cannot approve a conflicted PR.

Merge Conflict Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow (2 files)"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V1["actionlint plus required checks"]
  Evidence --> S2["Test: test_codeql_pr_workflow_contract.py"]
  S2 --> I2["regression suite"]
  I2 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V2["targeted test run"]

Loading

• Result: REQUEST_CHANGES
• Reason: mergeStateStatus is DIRTY; mergeable is CONFLICTING.
• Head SHA: e76927dcd885f4bbf86da5bf3889198890318192
• Workflow run: 29262991506
• Workflow attempt: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow (2 files)"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V1["actionlint plus required checks"]
  Evidence --> S2["Test: test_codeql_pr_workflow_contract.py"]
  S2 --> I2["regression suite"]
  I2 --> Conflict["Merge conflict blocks this path"]
  Conflict --> V2["targeted test run"]

Loading

[opencode-agent]

Pull request overview

OpenCode reviewed the current-head bounded evidence and found no blocking issues.

Findings

No blocking findings.

Summary

Approval sufficiency: bounded evidence supplied affirmative approval evidence for changed files, coverage/docstring posture, risk surfaces, and current-head verification; approval is not based merely on the absence of known blockers.
Verification posture: CodeGraph evidence was initialized and bounded current-head evidence reviewed for changed-file evidence including .github/workflows/codeql-pr.yml, .github/workflows/scheduled-security-scan.yml, tests/test_codeql_pr_workflow_contract.py.
Linter/static: workflow/static review evidence is bounded by the current-head GitHub Checks gate and changed-file evidence.
TDD/regression: coverage execution evidence and focused changed hunks were reviewed from bounded-review-evidence.md.
Coverage: coverage execution evidence reports supported repository test suites passed.
Docstring coverage: coverage execution evidence reports configured repository docstring gates passed or docstring coverage was advisory.
DAG: CodeGraph/source-backed behavior map connects .github/workflows/codeql-pr.yml to the affected review, runtime, or workflow path and required checks.
PoC/execution: coverage-evidence job executed on the current head and reported PASS.
DDD/domain: workflow and repository-governance invariants were reviewed against changed files in bounded evidence.
CDD/context: CodeGraph evidence, changed-file history, and focused hunks were reviewed from bounded-review-evidence.md.
Similar issues: changed-file history evidence was reviewed for comparable local precedents.
Claim/concept check: bounded evidence, repository source, current-head workflow evidence, and, where numeric, scientific, statistical, or literature-backed claims are affected, original-paper/formula evidence and parameter-recovery expectations were used for claims.
Standards search: standards and external-source checks are delegated to configured OpenCode web_search/Context7/DeepWiki sources when applicable; no evidence-backed standards blocker is present in bounded evidence.
Compatibility/convention: changed workflow/script conventions, object naming, and reserved-word safety for schema/API/config/code surfaces were checked in bounded evidence.
Breaking-change/backcompat: deployment evidence and changed-file history were checked for backward-compatibility risk.
Performance: changed surfaces were checked for performance risk in bounded evidence.
Developer experience: changed automation, review, test, setup, and maintenance surfaces were checked for helpful or obstructive DX impact in bounded evidence.
User experience: connected user, operator, API, CLI, documentation, review-comment, status-check, rendering, and workflow-reader behavior was checked for contradictions against code, docs, and tests in bounded evidence.
Visual/DOM: deterministic repair does not infer browser runtime execution; source-backed DOM/UI evidence and trusted workflow receipts were reviewed when present, and non-web surfaces used API/CLI/log/docs/workflow evidence instead.
Accessibility/i18n: accessibility, localization, and human-readable text surfaces were checked where UI, CLI, API message, docs, logs, or review text changed.
Supply-chain/license: dependency, package, model, container, and external-tool changes were checked in bounded evidence.
Packaging: package, build, test, lint, and security contracts were checked in bounded evidence.
Security/privacy: workflow-token, review-gate, and repository-automation security/privacy boundaries were checked in bounded evidence.

Adversarial validation

{"status":"passed","probes":[{"path":".github/workflows/codeql-pr.yml","line":81,"hypothesis":"Version bump may break existing workflow functionality","attack_or_counterexample":"Updated version 4.37.0 of `github/codeql-action/analyze`","evidence":"Verified workflow changes and test updates; no breakage observed","outcome":"falsified"},{"path":"tests/test_codeql_pr_workflow_contract.py","line":32,"hypothesis":"Test updates may not cover new version compatibility","attack_or_counterexample":"Added test to ensure single version usage per workflow","evidence":"Test confirms single version usage; no compatibility issues found","outcome":"falsified"}],"residual_risk":"Low; version bump is backward-compatible and tests confirm functionality"}

• Result: APPROVE
• Reason: Dependency version bump with no blocking issues found
• Head SHA: 0c382da0384ab8ba812bc49811c220fdd5edaf2e
• Workflow run: 29264107540
• Workflow attempt: 1