build(deps): align CodeQL init and analyze on 4.37.6

[dependabot]

Superseded

Closed unmerged in favor of #107.

PR #106 targeted protected main@6841b71935e0b7cb98fb52bcb4709cc5100c8d87. Its repaired contributor head aef32151e22c8b4044c16ca91b41ee664188ddf6 correctly aligned github/codeql-action/init and analyze on immutable v4.37.6, but SAST run 31344272336 checked out synthetic merge af0bfebc046b9b6a4832562c929224ad2c429eba and failed on five inherited protected-main findings in cost_ledger.py and orchestrator.py. The one-file dependency diff did not touch those findings.

#107 reconstructs the same atomic CodeQL 4.37.6 update directly on exact PR #96 security head 3703d0da9823b8258a0be94f1801aa5d61bfad9f. Exact comparison proves #107 is one commit ahead, zero behind that base and changes only .github/workflows/security.yml by two additions/two deletions.

All #106 checks, reviews, statuses, and synthetic-merge evidence are historical and do not transfer to #107. #107 remains Draft pending #96 protected integration, fresh exact-head checks/security evidence, zero valid unresolved findings, and qualifying independent non-author approval.

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head ae45f60bd694c9c7a8d6180ff64769ecbf271304.

• Head SHA: ae45f60bd694c9c7a8d6180ff64769ecbf271304

• Workflow run: 31332122757

• Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: security.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: security.yml"]
  R1 --> V1["actionlint plus required checks"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: ae45f60bd694c9c7a8d6180ff64769ecbf271304
• Workflow run: 31332122757
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head ae45f60bd694c9c7a8d6180ff64769ecbf271304.

• Head SHA: ae45f60bd694c9c7a8d6180ff64769ecbf271304

• Workflow run: 31332122757

• Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: security.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: security.yml"]
  R1 --> V1["actionlint plus required checks"]

Loading

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.