chore(deps): update github/codeql-action action to v4.38.0

[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
github/codeql-action	action	minor	v4.36.3 → v4.38.0

---

Release Notes

github/codeql-action (github/codeql-action)

v4.38.0

Compare Source

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #​4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #​4072
• Update default CodeQL bundle version to 2.27.0. #​4129

v4.37.9

Compare Source

• Update default CodeQL bundle version to 2.26.4. #​4106

v4.37.8

Compare Source

No user facing changes.

v4.37.7

Compare Source

• Update default CodeQL bundle version to 2.26.3. #​4085

v4.37.6

Compare Source

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #​4070

v4.37.5

Compare Source

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #​4061

v4.37.4

Compare Source

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #​4037
• Update default CodeQL bundle version to 2.26.2. #​4051

v4.37.3

Compare Source

No user facing changes.

v4.37.2

Compare Source

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #​4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #​4007

v4.37.1

Compare Source

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #​3956
• Update default CodeQL bundle version to 2.26.1. #​4019

v4.37.0

Compare Source

• Update default CodeQL bundle version to 2.26.0. #​3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@​ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #​3973

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 39271973-0530-4829-ba30-286fe8003f3f

📥 Commits

Reviewing files that changed from the base of the PR and between cb96f82 and 2995b01.

📒 Files selected for processing (2)

• .github/workflows/scorecard.yaml
• .github/workflows/security-codeql.yml

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

Walkthrough

The pull request updates pinned CodeQL actions from v4.36.3 to v4.38.0 in the scorecard and security analysis workflows.

Changes

CodeQL workflow updates

Layer / File(s)	Summary
Update CodeQL action pins .github/workflows/scorecard.yaml, .github/workflows/security-codeql.yml	The workflows update SARIF upload, initialization, autobuild, and analysis actions to pinned CodeQL Action v4.38.0.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~2 minutes

Change: Other

Suggested reviewers: xynnn007

Merge Risk: ⚪ Minimal · up to 2995b

No actionable merge-blocking risk remains in these workflow-only dependency updates.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: updating the github/codeql-action GitHub Action to v4.38.0.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The pull request changes only two workflow YAML files. The added lines update pinned CodeQL Action references from v4.36.3 to v4.38.0. No Ginkgo test declarations or test titles are added or modified,…
Test Structure And Quality	✅ Passed	PASS. The pull request changes only two GitHub Actions workflow files. The diff updates pinned CodeQL Action references from v4.36.3 to v4.38.0. It adds or changes no Ginkgo tests, It blocks, cluster …
Microshift Test Compatibility	✅ Passed	PASS: The pull request changes only two GitHub workflow files and updates pinned CodeQL Action revisions. The authoritative diff adds no Ginkgo e2e tests or test behavior, so the MicroShift compatibil…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The authoritative PR diff changes only two GitHub Actions workflow files. The added lines only update pinned CodeQL Action references from v4.36.3 to v4.38.0. No Go or test files changed, and no Ginkg…
Topology-Aware Scheduling Compatibility	✅ Passed	PASS — The pull request changes only two GitHub Actions workflow files. The diff updates pinned github/codeql-action references from v4.36.3 to v4.38.0. It adds or modifies no deployment manifests, …
Ote Binary Stdout Contract	✅ Passed	The pull request changes only two workflow YAML files. The four added lines update pinned CodeQL action references; they add no process code, suite setup, logging, or stdout writes. The repository has…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The authoritative PR diff changes only two GitHub Actions workflow files. It updates pinned github/codeql-action versions and adds no Ginkgo e2e tests or test code. Therefore, the IPv4 and disconnec…
No-Weak-Crypto	✅ Passed	The PR changes only four pinned github/codeql-action references from v4.36.3 to v4.38.0 in two workflow files. The added and removed lines contain no MD5, SHA1, DES, 3DES, RC4, Blowfish, ECB, custom…
Container-Privileges	✅ Passed	The pull request changes only four pinned CodeQL action references in two GitHub Actions workflow files. The added lines only update the action commit and version from v4.36.3 to v4.38.0. No changed l…
No-Sensitive-Data-In-Logs	✅ Passed	PASS: The pull request only changes pinned github/codeql-action commit references and version comments in two workflow files. It does not add logging commands, log inputs, secrets, tokens, PII, host…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch konflux/mintmaker/main/github-codeql-action-4.x

---

_{Comment @coderabbitai help to get the list of available commands.}