chore(release): promote v1.53.1

[fredcamaral]

GitHub Actions Shared Workflows

---

Description

Promotes the validated develop state to main for the stable v1.53.1 release, so the CodeQL pin alignment from #655 reaches the floating v1 tag.

Every Go-changing PR in the org is currently red on codeql_scan with:

##[error]We were unable to automatically build your code. Please replace the call to the
autobuild action with your custom build steps. Loaded a configuration file for version
'4.35.1', but running version '4.36.3'

pr-security-scan.yml resolves the CodeQL composites through the floating v1 tag while pinning autobuild by SHA in the workflow itself, so the two must agree:

      - name: Initialize CodeQL
        uses: LerianStudio/github-actions-shared-workflows/src/security/codeql-init@v1   # v1 -> v1.53.0 -> codeql-action v4.35.1
      # ...
      - name: Autobuild
        uses: github/codeql-action/autobuild@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81   # v4.37.3

codeql-action hard-fails on any init/autobuild version mismatch. #655 fixed it by moving codeql-init and codeql-analyze to e4fba86 (v4.37.3), matching autobuild, but that fix currently only exists on develop and in the pre-release v1.53.1-beta.1. v1 still points at v1.53.0 (e76b082), which carries the mismatched c10b806 (v4.35.1) pin, so callers stay broken until a stable release moves the tag.

This promotion carries three commits: #655 and its backmerge/rebase commits. No workflow inputs, outputs, or defaults change.

Type of Change

• feat: New workflow or new input/output/step in an existing workflow
• fix: Bug fix in a workflow (incorrect behavior, broken step, wrong condition)
• perf: Performance improvement (e.g. caching, parallelism, reduced steps)
• refactor: Internal restructuring with no behavior change
• docs: Documentation only (README, docs/, inline comments)
• ci: Changes to self-CI (workflows under .github/workflows/ that run on this repo)
• chore: Dependency bumps, config updates, maintenance
• test: Adding or updating tests
• BREAKING CHANGE: Callers must update their configuration after this PR

Breaking Changes

None to the workflow interface. Worth flagging for release notes: once v1 moves, the composites resolve to codeql-action v4.37.3, so callers pinned to a shared-workflows tag whose autobuild SHA is older than e4fba86 (that is, anything below v1.48.0) will keep failing with the inverse mismatch and need to bump their pipeline ref to v1.48.0 or newer. plugin-br-bank-transfer is one such caller and is being bumped in LerianStudio/plugin-br-bank-transfer#282.

Testing

• YAML syntax validated locally
• Triggered a real workflow run on a caller repository using @this-branch or the beta tag
• Verified all existing inputs still work with default values
• Confirmed no secrets or tokens are printed in logs
• Checked that unrelated workflows are not affected

Caller repo / workflow run: Verified by pin inspection across tags: v1.48.0..v1.53.0 pin autobuild@e4fba86 (v4.37.3) while codeql-init@v1 resolves to c10b806 (v4.35.1); at v1.53.1-beta.1 all three (init, analyze, autobuild) are e4fba86. Failing caller run: https://github.com/LerianStudio/plugin-br-bank-transfer/actions/runs/31134542606/job/92731111874

Related Issues

Ships #655.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 5b75f377-ffa0-460e-ba40-370dde6facc7

📥 Commits

Reviewing files that changed from the base of the PR and between f5109f6 and 02462c8.

📒 Files selected for processing (2)

• src/security/codeql-analyze/action.yml
• src/security/codeql-init/action.yml

---

Summary by CodeRabbit

• Chores
  • Updated security scanning configuration to use the latest verified CodeQL action revisions.
  • Maintained existing scanning behavior and configuration while improving the reliability of security analysis.
  • No changes to application functionality or the end-user experience.

Walkthrough

The pull request updates the pinned commits for the CodeQL initialization and analysis actions. Both actions remain on v4 with their existing configuration.

Changes

CodeQL action pin updates

Layer / File(s)	Summary
Update CodeQL action pins src/security/codeql-init/action.yml, src/security/codeql-analyze/action.yml	The CodeQL initialization and analysis steps now reference newer pinned v4 action commits.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• LerianStudio/github-actions-shared-workflows#655: Updates the same CodeQL initialization and analysis action pins.

Suggested labels: security, composite, size/XS

Suggested reviewers: bedatty

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the stable v1.53.1 release promotion, which is the pull request's primary objective.
Description check	✅ Passed	The description follows the template and documents the CodeQL fix, release impact, breaking-change considerations, testing, and related issue.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch develop

---

_{Comment @coderabbitai help to get the list of available commands.}

[lerian-studio]

🔍 Lint Analysis

Check	Files Scanned	Status
YAML Lint	2 file(s)	✅ success
Action Lint	no changes	⏭️ skipped
Pinned Actions	2 file(s)	✅ success
Markdown Link Check	no changes	⏭️ skipped
Spelling Check	2 file(s)	✅ success
Shell Check	2 file(s)	✅ success
README Check	2 file(s)	✅ success
Composite Schema	2 file(s)	✅ success
Deployment Matrix	no changes	⏭️ skipped

---

_{🔍 View full scan logs}

[lerian-studio]

🛡️ CodeQL Analysis Results

Languages analyzed: actions

✅ No security issues found.

---

_{🔍 View full scan logs | 🛡️ Security tab}

[lerian-studio]

🔍 PR Validation Summary

✅ PR Mergeable — no blocking failures

Check	Status	Blocking
Source Branch	✅ success	yes
PR Title	✅ success	yes
PR Description	✅ success	yes
Breaking Change Guard	✅ success	yes
PR Size	✅ success	no
Auto Labels	✅ success	no
PR Metadata	✅ success	no

---

_{🔍 View workflow run}