chore(deps): bump the actions group across 1 directory with 2 updates

[dependabot]

Bumps the actions group with 2 updates in the / directory: github/codeql-action/init and github/codeql-action/analyze.

Updates github/codeql-action/init from 4.36.2 to 4.36.3

Release notes

Sourced from github/codeql-action/init's releases.

v4.36.3

No user facing changes.

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

• Cache CodeQL CLI version information across Actions steps. #3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
• Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

• Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
• Add support for SHA-256 Git object IDs. #3893
• Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

• We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899
• For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791
• If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892
• Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

4.35.4 - 07 May 2026

• Update default CodeQL bundle version to 2.25.4. #3881

4.35.3 - 01 May 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837
• Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850
• Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853
• Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852

... (truncated)

Commits

• 54f647b Merge pull request #3984 from github/update-v4.36.3-1f34ec164
• e78819e Trigger checks
• 2c9d3d6 Update changelog for v4.36.3
• 1f34ec1 Merge pull request #3983 from github/mbg/repo-props/ff-for-config-file-prop
• d5f0145 Log when repository property has a value but is ignored
• f27f563 Add test for when the FF is off
• 0025d0f Use FF
• f7fa18f Add FF for config file repo property
• 628fc3f Merge pull request #3979 from github/henrymercer/overlay-db-cleanup-size-tele...
• 9cfb67b Add clarifying comments
• Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.36.2 to 4.36.3

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.36.3

No user facing changes.

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

• Cache CodeQL CLI version information across Actions steps. #3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
• Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

• Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
• Add support for SHA-256 Git object IDs. #3893
• Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

• We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899
• For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791
• If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892
• Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

4.35.4 - 07 May 2026

• Update default CodeQL bundle version to 2.25.4. #3881

4.35.3 - 01 May 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837
• Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850
• Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853
• Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852

... (truncated)

Commits

• 54f647b Merge pull request #3984 from github/update-v4.36.3-1f34ec164
• e78819e Trigger checks
• 2c9d3d6 Update changelog for v4.36.3
• 1f34ec1 Merge pull request #3983 from github/mbg/repo-props/ff-for-config-file-prop
• d5f0145 Log when repository property has a value but is ignored
• f27f563 Add test for when the FF is off
• 0025d0f Use FF
• f7fa18f Add FF for config file repo property
• 628fc3f Merge pull request #3979 from github/henrymercer/overlay-db-cleanup-size-tele...
• 9cfb67b Add clarifying comments
• Additional commits viewable in compare view

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 9, 2026, 5:11 PM ET / 21:11 UTC.

Summary
Updates .github/workflows/codeql.yml to move the SHA-pinned github/codeql-action/init and github/codeql-action/analyze refs from v4.36.2 to v4.36.3.

Reproducibility: not applicable. this is a Dependabot GitHub Actions dependency update, not a bug report. The relevant verification is diff review, upstream tag/release verification, YAML parsing, and current-head check status.

Review metrics: 2 noteworthy metrics.

• Workflow surface: 1 modified, 0 added, 0 removed. The review can stay focused on the CodeQL automation dependency update rather than router runtime behavior.
• Action refs updated: 2 SHA-pinned refs updated. Both CodeQL init and analyze move together to the verified upstream v4.36.3 commit.

Merge readiness
Overall: 🦞 diamond lobster
Proof: 🌊 off-meta tidepool
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Next step before merge

• [P2] No repair lane is needed; this clean Dependabot workflow update is ready for normal maintainer or code-owner review.

Security
Cleared: The diff only updates pinned CodeQL Action init and analyze commits, with no permission, trigger, secret, script, or package-resolution changes.

Review details

Best possible solution:

Land the pinned CodeQL Action patch update after normal maintainer or code-owner review, keeping the existing workflow permissions and SHA-pinning pattern unchanged.

Do we have a high-confidence way to reproduce the issue?

Not applicable; this is a Dependabot GitHub Actions dependency update, not a bug report. The relevant verification is diff review, upstream tag/release verification, YAML parsing, and current-head check status.

Is this the best way to solve the issue?

Yes; updating the existing SHA-pinned CodeQL Action refs in the workflow is the narrow maintainable path for this dependency bump.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 281ed5259705.

Label changes

Label justifications:

• P3: This is a low-risk GitHub Actions dependency maintenance PR with a four-line workflow diff and successful current-head CI/CodeQL checks.
• rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🌊 off-meta tidepool and patch quality is 🦞 diamond lobster.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Not applicable; this is a Dependabot bot workflow dependency PR, and current-head CI/CodeQL checks provide the relevant validation context.

Evidence reviewed

What I checked:

• Current main still uses the older CodeQL Action ref: Current main pins both CodeQL steps to 8aad20d150bbac5944a9f9d289da16a4b0d87c1e, so the requested dependency update is not already implemented on the default branch. (.github/workflows/codeql.yml:42, 281ed5259705)
• PR diff is limited to two CodeQL Action refs: The PR changes only .github/workflows/codeql.yml, replacing the init and analyze action SHAs with 54f647b7e1bb85c95cddabcd46b0c578ec92bc1a. (.github/workflows/codeql.yml:42, e6482438a160)
• Upstream v4.36.3 tag target verified: GitHub's github/codeql-action v4.36.3 annotated tag dereferences to commit 54f647b7e1bb85c95cddabcd46b0c578ec92bc1a, and the release body says there are no user-facing changes. (54f647b7e1bb)
• PR-head workflow YAML parses: The PR-head version of .github/workflows/codeql.yml loaded successfully through Ruby YAML parsing without writing to the checkout. (.github/workflows/codeql.yml:1, e6482438a160)
• Live PR state and checks are clean: GitHub reports the PR as mergeable with a clean merge state, and current-head CI, workflow lint, and both CodeQL analysis jobs succeeded. (e6482438a160)
• Workflow ownership history inspected: git blame ties the CodeQL workflow lines to the initial workflow commit by Vincent Koc, while gh pr view 2 shows steipete merged a recent adjacent GitHub Actions dependency update touching this workflow. (.github/workflows/codeql.yml:42, 61fb4ea24131)

Likely related people:

• Vincent Koc: Blame and workflow history show this person introduced the CodeQL workflow and most of the current automation surface in the initial release-automation commit. (role: introduced workflow behavior; confidence: high; commits: 61fb4ea24131, 700efef1731e; files: .github/workflows/codeql.yml, .github/workflows/release.yml, .github/dependabot.yml)
• steipete: GitHub PR metadata shows this person merged the recent Dependabot GitHub Actions update that touched .github/workflows/codeql.yml, .github/workflows/ci.yml, and .github/workflows/release.yml. (role: recent adjacent merger; confidence: medium; commits: 80d00680d54f; files: .github/workflows/codeql.yml, .github/workflows/ci.yml, .github/workflows/release.yml)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (7 earlier review cycles)

• reviewed 2026-07-06T19:30:41.576Z sha 212a593 :: needs maintainer review before merge. :: none
• reviewed 2026-07-07T18:57:13.955Z sha 212a593 :: needs maintainer review before merge. :: none
• reviewed 2026-07-07T19:01:47.500Z sha 212a593 :: needs maintainer review before merge. :: none
• reviewed 2026-07-07T22:09:05.773Z sha 212a593 :: needs maintainer review before merge. :: none
• reviewed 2026-07-08T18:57:37.055Z sha 212a593 :: needs maintainer review before merge. :: none
• reviewed 2026-07-08T19:01:45.212Z sha 212a593 :: needs maintainer review before merge. :: none
• reviewed 2026-07-09T19:01:52.320Z sha e648243 :: needs maintainer review before merge. :: none