build(deps): bump github/codeql-action/analyze from 4.36.2 to 4.37.0

.github/workflows/codeql-pr.yml

@@ -90,13 +90,13 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha }}
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           category: "/language:${{ matrix.language }}"
           upload: false
@@ -197,13 +197,13 @@ jobs:
           ref: ${{ format('refs/pull/{0}/merge', github.event.pull_request.number) }}
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           category: "/language:${{ matrix.language }}-merge"
           upload: false

.github/workflows/scheduled-security-scan.yml

@@ -89,13 +89,13 @@ jobs:
         with:
           persist-credentials: false
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
       - name: Perform CodeQL Analysis
         continue-on-error: true
-        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           category: "/language:${{ matrix.language }}-scheduled"
 

tests/test_codeql_pr_workflow_contract.py

@@ -1,5 +1,6 @@
 import json
 import os
+import re
 from pathlib import Path
 import subprocess
 import sys
@@ -40,6 +41,22 @@ def test_codeql_pr_workflow_gates_head_and_merge_sarif_locally() -> None:
     assert "security-events: write" not in workflow
 
 
+def test_codeql_action_steps_use_one_version_per_workflow() -> None:
+    """Prevent CodeQL init/analyze version splits from failing PR analysis."""
+    for filename in ("codeql-pr.yml", "scheduled-security-scan.yml"):
+        workflow = (REPO_ROOT / ".github/workflows" / filename).read_text(
+            encoding="utf-8"
+        )
+        refs = set(
+            re.findall(
+                r"github/codeql-action/(?:init|analyze|upload-sarif)@([0-9a-f]{40})",
+                workflow,
+            )
+        )
+
+        assert len(refs) == 1, f"{filename} mixes CodeQL action refs: {sorted(refs)}"
+
+
 def test_codeql_sarif_gate_logs_and_fails_only_unsuppressed_medium_plus(
     tmp_path: Path,
 ) -> None: