fix: align codeql-action init/analyze SHA to autobuild

[guimoreirar]

Problem

Go CodeQL scans fail at the Autobuild step:
Loaded a configuration file for version '4.37.3', but running version '4.35.1'.

Root cause: the github/codeql-action steps are on two different SHAs:

• init + analyze → c10b8064 (CodeQL 4.35.1)
• autobuild + upload-sarif → e4fba868 (CodeQL 4.37.3)

init sets up 4.35.1; autobuild (newer) expects 4.37.3 → version skew → autobuild aborts.

Fix

Bump codeql-init and codeql-analyze composites to e4fba868 so all four codeql-action steps run the same CodeQL (4.37.3). Same major (v4); no behavior change beyond version alignment.

Seen on LerianStudio/vault-lerian PR #3.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 88fc4a58-479c-4874-b45f-087c5bd94577

📥 Commits

Reviewing files that changed from the base of the PR and between cb28c98 and 9dd4c72.

📒 Files selected for processing (2)

• src/security/codeql-analyze/action.yml
• src/security/codeql-init/action.yml

---

Summary by CodeRabbit

• Chores
  • Updated security analysis automation to the latest pinned CodeQL v4 action revisions.
  • Retained existing configuration and inputs.

Walkthrough

The CodeQL initialization and analysis composite actions now reference the same updated pinned commit for v4. Existing inputs and exported entities remain unchanged.

Changes

CodeQL action pin update

Layer / File(s)	Summary
Update CodeQL action pins src/security/codeql-init/action.yml, src/security/codeql-analyze/action.yml	Both CodeQL steps now use commit e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 instead of the previous commit.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Possibly related PRs

• LerianStudio/github-actions-shared-workflows#655: Updates the pinned CodeQL init and analyze references in the same files.
• LerianStudio/github-actions-shared-workflows#656: Updates the same CodeQL action pins.

Suggested labels: security, dependencies, composite, size/XS

Suggested reviewers: fredcamaral

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the problem and fix but omits the required Type of Change, Testing, and Related Issues sections.	Add the missing template sections, select the applicable change type, document validation steps and workflow results, and specify related issues or state that none apply.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the CodeQL init and analyze SHA alignment, which matches the primary change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/codeql-action-sha-align

---

_{Comment @coderabbitai help to get the list of available commands.}

[lerian-studio]

🛡️ CodeQL Analysis Results

Languages analyzed: actions

✅ No security issues found.

---

_{🔍 View full scan logs | 🛡️ Security tab}

[lerian-studio]

🔍 Lint Analysis

Check	Files Scanned	Status
YAML Lint	2 file(s)	✅ success
Action Lint	no changes	⏭️ skipped
Pinned Actions	2 file(s)	✅ success
Markdown Link Check	no changes	⏭️ skipped
Spelling Check	2 file(s)	✅ success
Shell Check	2 file(s)	✅ success
README Check	2 file(s)	✅ success
Composite Schema	2 file(s)	✅ success
Deployment Matrix	no changes	⏭️ skipped

---

_{🔍 View full scan logs}

[lerian-studio]

🔍 PR Validation Summary

✅ PR Mergeable — no blocking failures

Check	Status	Blocking
Source Branch	✅ success	yes
PR Title	✅ success	yes
PR Description	✅ success	yes
Breaking Change Guard	✅ success	yes
PR Size	✅ success	no
Auto Labels	✅ success	no
PR Metadata	✅ success	no

---

_{🔍 View workflow run}

[guimoreirar]

Fechando: redundante. origin/develop e main já têm init/analyze em e4fba868 (alinhado com autobuild) — o mismatch só aparecia num checkout local desatualizado (30 commits atrás). O fix já está no v1.53.1.