ci: upgrade CodeQL action to v4 (SHA-pinned)

[jackgranatowski]

This pull request was created by @kiro-agent on behalf of @jackgranatowski 👻

Comment with /kiro fix to address specific feedback or /kiro all to address everything.
_{Learn about Kiro Web}

---

Summary

Upgrades the advanced CodeQL workflow to github/codeql-action v4, pinned to a commit SHA.

CI logs on a related run flagged that github/codeql-action@v3:

• runs on Node.js 20, which Actions forces to Node 24 starting 2026-06-16, and
• is scheduled for deprecation in December 2026 (changelog).

Changes (only .github/workflows/codeql.yml):

• github/codeql-action/init and /analyze → v4 (411bbbe…)
• actions/checkout → v6.0.2 SHA (de0fac2…) for consistent supply-chain pinning

No behavioral change to the scan: same languages (javascript-typescript, actions), same security-extended query suite, same triggers.

Notes

• This repo uses the advanced CodeQL workflow (no default-setup conflict), so the v4 upgrade applies cleanly here.
• Overlaps with the codeql.yml change in ci: harden pre-merge checks and supply chain #19 (which SHA-pins to v3). If both stay open, the two codeql-action lines will conflict on merge — resolve in favor of v4 (this PR supersedes that pin). Recommended order: merge this after, or fold the v4 SHA into ci: harden pre-merge checks and supply chain #19.

Testing

• Workflow YAML validated (parses cleanly).
• Diff limited to action-reference lines; reviewed against main.

[coderabbitai]

Warning

Review limit reached

@jackgranatowski, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 36 minutes and 35 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d8c9e91c-665c-453f-bdc6-efa72e67e50b

📥 Commits

Reviewing files that changed from the base of the PR and between faa7b91 and 8d8e310.

📒 Files selected for processing (1)

• .github/workflows/codeql.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/codeql-action-v4

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}