chore(deps): update CodeQL Action and harden backfill inputs

.github/workflows/codeql-backfill.yml

@@ -38,11 +38,14 @@ jobs:
       - name: Enumerate target commits
         id: commits
         shell: bash
+        env:
+          BRANCH_INPUT: ${{ inputs.branch }}
+          COMMIT_COUNT_INPUT: ${{ inputs.commit_count }}
         run: |
           set -euo pipefail
 
-          count="${{ inputs.commit_count }}"
-          branch="${{ inputs.branch }}"
+          count="${COMMIT_COUNT_INPUT}"
+          branch="${BRANCH_INPUT}"
 
           if ! [[ "${count}" =~ ^[0-9]+$ ]]; then
             echo "commit_count must be a positive integer" >&2
@@ -81,15 +84,15 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           languages: ${{ matrix.language }}
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/autobuild@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           category: "/language:${{ matrix.language }}/backfill"
           ref: "refs/heads/${{ inputs.branch }}"

scripts/ci/validate_codeql_backfill.py

@@ -34,6 +34,30 @@ def main() -> int:
     require("github/codeql-action/analyze@" in text, "must upload CodeQL analysis")
     require('ref: "refs/heads/${{ inputs.branch }}"' in text, "analysis ref must target the requested branch")
     require("sha: ${{ matrix.commit }}" in text, "analysis SHA must use the selected commit")
+    require(
+        "BRANCH_INPUT: ${{ inputs.branch }}" in text,
+        "branch input must enter the shell through env",
+    )
+    require(
+        "COMMIT_COUNT_INPUT: ${{ inputs.commit_count }}" in text,
+        "commit_count input must enter the shell through env",
+    )
+    require(
+        'branch="${BRANCH_INPUT}"' in text,
+        "shell must read the branch from its environment",
+    )
+    require(
+        'count="${COMMIT_COUNT_INPUT}"' in text,
+        "shell must read commit_count from its environment",
+    )
+    require(
+        'branch="${{ inputs.branch }}"' not in text,
+        "branch input must not be interpolated into run scripts",
+    )
+    require(
+        'count="${{ inputs.commit_count }}"' not in text,
+        "commit_count input must not be interpolated into run scripts",
+    )
 
     language_match = re.search(r"language:\s*\[(?P<languages>[^\]]+)\]", text)
     require(language_match is not None, "language matrix is required")