chore(deps): Update GitHub Actions to v4.37.0

[williaby]

Summary

Why

Scheduled patch update, bug fixes and security patches with no API changes.

Changes

This PR contains the following updates:

Package	Type	Update	Change	OpenSSF
github/codeql-action	action	minor	v4.36.3 → v4.37.0

Impact

• ✅ Patch update: bug fixes and security patches only
• ✅ No breaking changes

Acceptance Criteria

• All CI checks pass

Testing

• CI gates pass (tests, lint, type checking, security scan)

Notes

---

Release Notes

github/codeql-action (github/codeql-action)

v4.37.0

Compare Source

• Update default CodeQL bundle version to 2.26.0. #​3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@​ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #​3973

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • "after 10pm every weekday,before 5am every weekday,every weekend"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

Summary by CodeRabbit

• Chores
  • Updated the security analysis workflow to use the latest CodeQL action version.
  • Maintained the existing Python scanning configuration and query settings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 3c2f37c3-1a8e-4774-a73f-4c07dcb4007d

📥 Commits

Reviewing files that changed from the base of the PR and between c6e218d and 3d4b998.

📒 Files selected for processing (1)

• .github/workflows/codeql.yml

---

📝 Walkthrough

Walkthrough

The CodeQL workflow updates its initialization and analysis actions from v4.36.3 to v4.37.0 while preserving the existing Python language, build mode, and query configuration.

Changes

CodeQL workflow maintenance

Layer / File(s)	Summary
Update CodeQL action versions .github/workflows/codeql.yml	The CodeQL initialization and analysis steps are updated to v4.37.0 without changing their configuration.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Possibly related PRs

• williaby/image-generation#36: Modifies the same CodeQL workflow actions and includes related action pin updates.
• williaby/image-generation#64: Updates the same CodeQL action steps while preserving their configuration.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the dependency update to GitHub Actions version v4.37.0, though it is broader than the specific CodeQL action change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch renovate/github-actions

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/github/codeql-action/analyze	99df26d4f13ea111d4ec1a7dddef6063f76b97e9	Unknown	Unknown
actions/github/codeql-action/init	99df26d4f13ea111d4ec1a7dddef6063f76b97e9	Unknown	Unknown

Scanned Files

• .github/workflows/codeql.yml

[Copilot]

Pull request overview

This PR updates the pinned github/codeql-action GitHub Actions used by the repository’s CodeQL workflow from v4.36.3 to v4.37.0, keeping the security scanning pipeline current with upstream fixes.

Changes:

• Bump github/codeql-action/init to v4.37.0 (pinned by commit SHA).
• Bump github/codeql-action/analyze to v4.37.0 (pinned by commit SHA).