chore(github-action): update action github/codeql-action (v4.37.6 → v4.37.7)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
github/codeql-action	action	patch	v4.37.6 → v4.37.7

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

github/codeql-action (github/codeql-action)

v4.37.7

Compare Source

• Update default CodeQL bundle version to 2.26.3. #​4085

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: undefined

Post-upgrade command 'helm-docs --chart-search-root=. --log-level=warn' has not been added to the allowed list in allowedCommands

File name: undefined

Post-upgrade command 'helm-schema --chart-search-root . --skip-auto-generation required,additionalProperties --append-newline' has not been added to the allowed list in allowedCommands

[github-actions]

Renovate PR Analysis

Update Summary

• Dependency: github/codeql-action
• Version: v4.37.6 → v4.37.7
• Type: patch

Release Changes

• Update default CodeQL bundle version to 2.26.3 (#4085)
• Internal dependency bumps (brace-expansion 1.1.16 → 1.1.18, js-yaml 5.2.2 → 5.2.3, undici ^6.24.0 → ^6.28.0, npm-minor group)
• Internal refactors (logger availability for getCodeQLForCmd, OverlayAnalysisResourceChecksV2 promotion); no action input/output changes
• Released 2026-08-13; verified via repos/github/codeql-action/compare/v4.37.6...v4.37.7 (31 commits, no interface changes)

Breaking Changes

None affecting our usage. The with: inputs we use (languages, build-mode, category, sarif_file) are unchanged; no new required parameters.

Code Changes Required

None. The PR updates all 3 references in the repo, each pinned by commit SHA with the version comment retained:

• .github/workflows/codeql.yaml:33 (init)
• .github/workflows/codeql.yaml:39 (analyze)
• .github/workflows/vulnerability-scan.yaml:87 (upload-sarif)

Verified via grep -rn "codeql-action" .github/workflows/ — exactly 3 matches, all covered by the diff. No Dockerfile, docker-bake.hcl, or apps/ files are touched; no multi-arch implications (CI-only).

Security Impact

Positive but low-risk: newer CodeQL analysis engine (bundle 2.26.3) and patched npm transitive dependencies (brace-expansion) improve the scanning toolchain itself. No effect on built container images — the action runs only in CI and does not alter image contents or the threat surface of published images.

Recommendation

Safe to merge — patch bump of a CI-only GitHub Action, digest-pinned, covers all references, no breaking input changes, and not in the exclusion list (not a runtime base image, not an LLM/AI SDK, not cni-plugins, not a major bump).