chore(ci): update CodeQL action coherently to 4.37.8

[seonghobae]

Summary

Supersedes #1685 and #1686, which independently updated analyze and init on the same workflow and therefore could not satisfy the repository's pinned-SHA regression contract on their own.

• pins every github/codeql-action/init and github/codeql-action/analyze use to the reviewed v4.37.8 release SHA db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28;
• strengthens tests/test_codeql_workflow_contract.py so both jobs must use exactly two init and two analyze references, all on that same SHA;
• preserves the existing pull-request/manual trigger split, upload: never, checkout pin, and least-privilege permissions.

Test-first lineage

• RED/source-level fail-first edaf86051aa8e062ef4706a4c5c975ae0e02b985: the regression contract requires the v4.37.8 SHA while the workflow still contains v4.37.7, deterministically making the pin contract unsatisfied.
• GREEN/source fix c7f08bb0b1ad00019f664b59f885e3991ba201ce: updates all four CodeQL action call sites coherently to v4.37.8 so the exact-count/same-release contract is satisfied.
• exact current head f811f4714112accc0972a3f0fdb99f8d74ba5055: non-force reconciliation with protected main@b5a3a0c1057d4b53d7a4bb18e0de69f630c2b45c; main...head leaves only the intended two-file CodeQL pin/contract delta. The protected binary-response Measurement files carried by the intervening ancestry are already present on main and are not part of this PR's effective delta.

No hosted RED is claimed because the RED commit existed only as isolated source lineage before the PR was opened.

Exact-current hosted evidence

On unchanged f811f4714112accc0972a3f0fdb99f8d74ba5055, repository CI 33633947456 is now terminal success. The six substantive jobs all ran on GitHub-hosted runners with checkout/source execution and passed: Python 3.14 100259967637, GPU smoke 100259967802, Rust 100259967902, fuzz 100259967954, Python 3.12 100259968046, and package 100259968061; the downstream required aggregate python job 100469330106 also acquired a runner and completed success at 2026-09-03T12:25:29Z. Repository CodeQL 33633947418, SAST Semgrep 33633947570, OSV-Scanner PR 33633947983, Security Scan 33633947183, and Scorecard PR 33633947204 are likewise terminal success. The repository-required Analyze (actions) check is therefore GREEN on this exact head.

Remaining current-head evidence is not all passing. OpenCode required-workflow run 33633945191 has coverage-source-tree 100467837180 terminal success, but coverage-evidence 100644558073 remains queued before runner assignment/source execution (runner_id=0, empty runner/group identity, steps=[]). Strix run 33633945187 has strix job 100259961027 terminal cancelled without runner or steps; its later cancel-superseded-pr-runs job 100259960620 did execute successfully, so the cancelled Strix verdict is not source/security evidence and cannot be promoted to GREEN. Noema run 33633945304 did acquire a hosted runner, validated the exact head, provisioned the contextual-orchestrator sidecar, then failed at the first causal boundary Prepare Noema model verdict (100259961436, step 13) after the earlier credential/head/sidecar steps had succeeded. The exposed job metadata does not establish which already-tracked model-output/provider sub-class caused that model-verdict failure, so it is classified only as central Noema review-control/runtime evidence rather than a fast-mlsirm source finding.

The historical central CodeQL PR run 33633948806 still records startup_failure, but CodeQL is no longer one of the live organization ruleset's nine required-workflow paths. It must not be misreported as the current organization-required blocker. Current central queue/admission evidence for runnerless coverage/scan lanes is tracked on ContextualWisdomLab/.github#712; the open Noema model-output/retry owner issues remain in the central .github repository. No leaf no-op retrigger or source churn is warranted.

Review state is also non-landing: the only submitted #1690 review is Devin COMMENTED, there are zero inline review threads, and a fresh organization-wide search finds zero open fast-mlsirm PRs with a qualifying current APPROVED state.

Safety / scope

This is CI dependency maintenance only. It changes no package/runtime dependencies, model formulas, statistical or psychometric arithmetic, Rust/Python backend ownership, security thresholds, or protected-branch policy. It does not weaken any required gate.

Landing remains subject to exact-current required workflows, resolved review conversations, and the live approval policy. No self-approval, administrator bypass, force update, gate weakening, or predecessor-evidence transfer is requested.

---

Summary by CodeRabbit

• Security

  • Updated CodeQL analysis actions to a newly reviewed, fixed version for improved workflow security and consistency.

• Tests

  • Updated workflow validation checks to confirm all CodeQL initialization and analysis steps use the approved version.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 1f6d255a-4c50-4d90-804a-b7973bef2bc6

📥 Commits

Reviewing files that changed from the base of the PR and between 4562770 and c7f08bb.

📒 Files selected for processing (2)

• .github/workflows/codeql.yml
• tests/test_codeql_workflow_contract.py

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The CodeQL workflow now uses a new pinned action commit. The contract test centralizes the commit and verifies that both CodeQL actions appear twice with the expected pin.

Changes

CodeQL action pin update

Layer / File(s)	Summary
Update CodeQL pin and validation .github/workflows/codeql.yml, tests/test_codeql_workflow_contract.py	The workflow uses the new CodeQL commit for initialization and analysis. The contract test validates the shared pin and action occurrence counts.

Estimated code review effort: 2 (Simple) | ~5 minutes

Merge Risk: ⚪ Minimal · up to c7f08

This PR coherently updates the pinned CodeQL actions and the test enforcing those pins while preserving existing workflow triggers, permissions, checkout pinning, and upload behavior. No actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 1 files. (1 skipped: 1 …
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: coherently updating the CodeQL CI action to version 4.37.8.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 1 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/codeql-action-pin-4.37.8

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}