chore(deps): bump the actions group across 1 directory with 2 updates

[dependabot]

Bumps the actions group with 2 updates in the / directory: github/codeql-action/init and github/codeql-action/analyze.

Updates github/codeql-action/init from 4.36.2 to 4.36.3

Release notes

Sourced from github/codeql-action/init's releases.

v4.36.3

No user facing changes.

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

• Cache CodeQL CLI version information across Actions steps. #3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
• Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

• Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
• Add support for SHA-256 Git object IDs. #3893
• Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

• We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899
• For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791
• If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892
• Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

4.35.4 - 07 May 2026

• Update default CodeQL bundle version to 2.25.4. #3881

4.35.3 - 01 May 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837
• Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850
• Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853
• Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852

... (truncated)

Commits

• 54f647b Merge pull request #3984 from github/update-v4.36.3-1f34ec164
• e78819e Trigger checks
• 2c9d3d6 Update changelog for v4.36.3
• 1f34ec1 Merge pull request #3983 from github/mbg/repo-props/ff-for-config-file-prop
• d5f0145 Log when repository property has a value but is ignored
• f27f563 Add test for when the FF is off
• 0025d0f Use FF
• f7fa18f Add FF for config file repo property
• 628fc3f Merge pull request #3979 from github/henrymercer/overlay-db-cleanup-size-tele...
• 9cfb67b Add clarifying comments
• Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.36.2 to 4.36.3

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.36.3

No user facing changes.

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

• Cache CodeQL CLI version information across Actions steps. #3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
• Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

• Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
• Add support for SHA-256 Git object IDs. #3893
• Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

• We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899
• For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791
• If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892
• Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

4.35.4 - 07 May 2026

• Update default CodeQL bundle version to 2.25.4. #3881

4.35.3 - 01 May 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837
• Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850
• Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853
• Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852

... (truncated)

Commits

• 54f647b Merge pull request #3984 from github/update-v4.36.3-1f34ec164
• e78819e Trigger checks
• 2c9d3d6 Update changelog for v4.36.3
• 1f34ec1 Merge pull request #3983 from github/mbg/repo-props/ff-for-config-file-prop
• d5f0145 Log when repository property has a value but is ignored
• f27f563 Add test for when the FF is off
• 0025d0f Use FF
• f7fa18f Add FF for config file repo property
• 628fc3f Merge pull request #3979 from github/henrymercer/overlay-db-cleanup-size-tele...
• 9cfb67b Add clarifying comments
• Additional commits viewable in compare view

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 9, 2026, 1:21 PM ET / 17:21 UTC.

Summary
The PR updates .github/workflows/codeql.yml to pin both github/codeql-action/init and github/codeql-action/analyze from v4.36.2's commit to v4.36.3's commit.

Reproducibility: not applicable. this is a Dependabot workflow dependency bump rather than a reported runtime bug. The review path is diff inspection plus CI/CodeQL status on the PR head.

Review metrics: 2 noteworthy metrics.

• Workflow diff: 1 file changed, 2 additions, 2 deletions. The PR only updates the pinned CodeQL init/analyze action commit in one workflow.
• Current checks: CI and CodeQL succeeded on head 97a7855. The changed workflow executed successfully against the proposed pin.

Merge readiness
Overall: 🦞 diamond lobster
Proof: 🌊 off-meta tidepool
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Next step before merge

• [P2] No repair lane is needed because the PR is already narrow, green, and has no actionable review finding.

Security
Cleared: The diff keeps the same GitHub-owned CodeQL action and permissions, and only advances both pinned action SHAs to the v4.36.3 peeled commit.

Review details

Best possible solution:

Merge through the normal Dependabot workflow once maintainers are satisfied with the green CI and CodeQL checks.

Do we have a high-confidence way to reproduce the issue?

Not applicable; this is a Dependabot workflow dependency bump rather than a reported runtime bug. The review path is diff inspection plus CI/CodeQL status on the PR head.

Is this the best way to solve the issue?

Yes; updating the existing pinned CodeQL init/analyze SHA is the narrowest maintainable way to take this patch release without changing workflow permissions or behavior.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 19206c9629c5.

Label changes

Label changes:

• add rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🌊 off-meta tidepool and patch quality is 🦞 diamond lobster.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a Dependabot bot PR, so the external-contributor real-behavior proof gate does not apply; CI and CodeQL runs are the relevant validation signal.

Label justifications:

• P3: This is a low-risk GitHub Actions dependency maintenance PR with a two-line pinned CodeQL action update.
• rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🌊 off-meta tidepool and patch quality is 🦞 diamond lobster.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a Dependabot bot PR, so the external-contributor real-behavior proof gate does not apply; CI and CodeQL runs are the relevant validation signal.

Evidence reviewed

What I checked:

• Repository policy read: The full target AGENTS.md was read; its workflow and security guidance made this a GitHub Actions supply-chain review, but it did not add a line-level blocker. (AGENTS.md:1, 19206c9629c5)
• Workflow diff is narrow: The PR changes only two uses: pins in the CodeQL workflow, replacing the init/analyze commit SHA for the existing github/codeql-action action. (.github/workflows/codeql.yml:42, 97a785577588)
• Upstream tag resolves to proposed SHA: The peeled upstream tag v4.36.3^{} resolves to 54f647b7e1bb85c95cddabcd46b0c578ec92bc1a, matching the PR's new pin; v4.36.2^{} resolves to the current main pin.
• Upstream release is a patch with no user-facing changes: The GitHub CodeQL Action release view for v4.36.3 reports the release body as No user facing changes. and was published on 2026-07-02.
• Current PR checks are green: GitHub reports the PR as mergeable/clean, with CI and CodeQL check runs succeeding on head 97a785577588015d347099cb58e0cfc5c9f79570. (97a785577588)
• Workflow ownership provenance: Blame on the CodeQL workflow pins points the init/analyze lines to af898fe0cdd34fddba6ca511bbfdc417c3a1a7db, while workflow history also shows a recent merged Dependabot action update at 703ed5aa9108d68cac6d8d686b01daeb8a475a56. (.github/workflows/codeql.yml:42, af898fe0cdd3)

Likely related people:

• vincentkoc: GitHub commit metadata maps the release/setup commit that currently owns the CodeQL init/analyze lines to vincentkoc. (role: introduced workflow area; confidence: medium; commits: af898fe0cdd3; files: .github/workflows/codeql.yml)
• dependabot[bot]: A recent merged Dependabot commit updated another pinned GitHub Action in the same workflow, showing recurring ownership of these dependency-maintenance PRs. (role: recent workflow dependency updater; confidence: medium; commits: 703ed5aa9108; files: .github/workflows/codeql.yml)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (5 earlier review cycles)

• reviewed 2026-07-06T17:21:27.516Z sha ce0007c :: needs maintainer review before merge. :: none
• reviewed 2026-07-07T17:19:35.125Z sha ce0007c :: needs maintainer review before merge. :: none
• reviewed 2026-07-07T18:27:51.592Z sha ce0007c :: needs maintainer review before merge. :: none
• reviewed 2026-07-08T17:18:10.836Z sha ce0007c :: needs maintainer review before merge. :: none
• reviewed 2026-07-08T17:22:38.799Z sha ce0007c :: needs maintainer review before merge. :: none