ci(codeql): bump init and analyze together to v4.37.3

[aparragithub]

Closes #72
Supersedes #65

Summary

• Bumps both github/codeql-action/init and github/codeql-action/analyze from v3 to the same commit e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 (v4.37.3).
• Dependabot chore(deps): bump github/codeql-action/init from 3.37.3 to 4.37.3 #65 bumped only init, which would have left analyze on v3. The CodeQL Action requires both sub-actions to come from the same release, so merging chore(deps): bump github/codeql-action/init from 3.37.3 to 4.37.3 #65 as-is would have split the versions and broken the analyze job — one of the checks that gates merges to main.

Changes

File	Change
.github/workflows/codeql.yml	init (line 25) and analyze (line 31) both pinned to e4fba868 (v4.37.3)

Verification

• v4.37.3 and v4 both dereference to commit e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 (both are annotated tags, so the tag object had to be dereferenced to its target).
• analyze/action.yml is present at that commit, so one pinned SHA legitimately covers both sub-actions.
• codeql.yml is the only file in .github/ referencing codeql-action — no other pin was left behind.
• The workflow YAML parses, and both codeql-action steps resolve to a single distinct SHA.

v4 breaking changes — why they do not apply here

• Minimum CodeQL bundle raised to 2.19.4: this workflow uses the default bundle on GitHub-hosted ubuntu-latest, which is well past that.
• CODEQL_ACTION_CLEANUP_TRAP_CACHES deprecated: never set in this repository.

Test plan

• Both pins resolve to one commit SHA (asserted programmatically)
• Workflow YAML parses
• CodeQL and analyze checks pass on this PR — the real proof, since this PR changes the analyzer itself

Follow-up

Close #65 once this merges.

Summary by CodeRabbit

• Chores
  • Updated the automated security scanning workflow to use newer CodeQL analysis actions.
  • Maintained existing Python security and quality checks.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 3ae10465-8aa2-4298-a162-529af9b92c93

📥 Commits

Reviewing files that changed from the base of the PR and between 2ffb1e0 and a9f867f.

📒 Files selected for processing (1)

• .github/workflows/codeql.yml

---

📝 Walkthrough

Walkthrough

The CodeQL workflow updates both init and analyze actions to the pinned v4.37.3 commit while retaining the existing Python language and security-and-quality query configuration.

Changes

CodeQL workflow update

Layer / File(s)	Summary
Align CodeQL action pins .github/workflows/codeql.yml	Both CodeQL action steps now use the same v4.37.3 pinned commit. Existing language and query settings remain unchanged.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested labels: dependencies, github_actions

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: bumping CodeQL init and analyze together to v4.37.3.
Linked Issues check	✅ Passed	The workflow update matches the linked issues by pinning both CodeQL sub-actions to the same v4.37.3 SHA.
Out of Scope Changes check	✅ Passed	The PR only changes the CodeQL workflow pins and keeps the existing configuration and behavior intact.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/codeql-action-v4

---

_{Comment @coderabbitai help to get the list of available commands.}