From 2084d7488711efd46e81fd3262204207addefbab Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 13 Jul 2026 13:37:03 +0000
Subject: [PATCH 1/2] build(deps): bump github/codeql-action/analyze from
 4.36.2 to 4.37.0

---
updated-dependencies:
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/codeql-pr.yml               | 4 ++--
 .github/workflows/scheduled-security-scan.yml | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/codeql-pr.yml b/.github/workflows/codeql-pr.yml
index ed439c444..7d02e9c96 100644
--- a/.github/workflows/codeql-pr.yml
+++ b/.github/workflows/codeql-pr.yml
@@ -97,7 +97,7 @@ jobs:
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           category: "/language:${{ matrix.language }}"
           upload: always
@@ -135,7 +135,7 @@ jobs:
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           category: "/language:${{ matrix.language }}-merge"
           upload: always
diff --git a/.github/workflows/scheduled-security-scan.yml b/.github/workflows/scheduled-security-scan.yml
index 1b9cd1e18..92533724a 100644
--- a/.github/workflows/scheduled-security-scan.yml
+++ b/.github/workflows/scheduled-security-scan.yml
@@ -95,7 +95,7 @@ jobs:
           build-mode: ${{ matrix.build-mode }}
       - name: Perform CodeQL Analysis
         continue-on-error: true
-        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           category: "/language:${{ matrix.language }}-scheduled"
 

From ba9ddf1d458b0aeadc8ee482758f57855d97995e Mon Sep 17 00:00:00 2001
From: Seongho Bae <seongho@kw.ac.kr>
Date: Tue, 14 Jul 2026 00:36:55 +0900
Subject: [PATCH 2/2] fix(codeql): keep action versions consistent

---
 .github/workflows/codeql-pr.yml               |  4 ++--
 .github/workflows/scheduled-security-scan.yml |  2 +-
 tests/test_codeql_pr_workflow_contract.py     | 17 +++++++++++++++++
 3 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/codeql-pr.yml b/.github/workflows/codeql-pr.yml
index 7d02e9c96..457ffb61e 100644
--- a/.github/workflows/codeql-pr.yml
+++ b/.github/workflows/codeql-pr.yml
@@ -91,7 +91,7 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha }}
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -129,7 +129,7 @@ jobs:
           ref: ${{ format('refs/pull/{0}/merge', github.event.pull_request.number) }}
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
diff --git a/.github/workflows/scheduled-security-scan.yml b/.github/workflows/scheduled-security-scan.yml
index 92533724a..b6d7e2905 100644
--- a/.github/workflows/scheduled-security-scan.yml
+++ b/.github/workflows/scheduled-security-scan.yml
@@ -89,7 +89,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
diff --git a/tests/test_codeql_pr_workflow_contract.py b/tests/test_codeql_pr_workflow_contract.py
index 6a858be00..e23969bb7 100644
--- a/tests/test_codeql_pr_workflow_contract.py
+++ b/tests/test_codeql_pr_workflow_contract.py
@@ -1,3 +1,4 @@
+import re
 from pathlib import Path
 
 
@@ -25,3 +26,19 @@ def test_codeql_pr_workflow_uploads_head_and_merge_sarif_for_ruleset_gate() -> N
     assert "refs/pull/{0}/head" in workflow
     assert "refs/pull/{0}/merge" in workflow
     assert "security-events: write" in workflow
+
+
+def test_codeql_action_steps_use_one_version_per_workflow() -> None:
+    """Prevent CodeQL init/analyze version splits from failing PR analysis."""
+    for filename in ("codeql-pr.yml", "scheduled-security-scan.yml"):
+        workflow = (REPO_ROOT / ".github/workflows" / filename).read_text(
+            encoding="utf-8"
+        )
+        refs = set(
+            re.findall(
+                r"github/codeql-action/(?:init|analyze|upload-sarif)@([0-9a-f]{40})",
+                workflow,
+            )
+        )
+
+        assert len(refs) == 1, f"{filename} mixes CodeQL action refs: {sorted(refs)}"