[tonibergholm-codento]

Summary

 # .github/workflows/codeql.yml, scorecard_analysis.yml
-github/codeql-action/{init,analyze,upload-sarif}@24c5418… # v4.38.3
+github/codeql-action/{init,analyze,upload-sarif}@6f2ac81… # v4.39.0

 # .github/dependabot.yml (github-actions)
+groups:
+  codeql-action:
+    patterns: ["github/codeql-action/*"]

Supersedes #289, #292, #293. Each bumped one of the three steps, and the action refuses mixed versions: Loaded a configuration file for version '4.39.0', but running version '4.38.3'. 6f2ac81… is the commit that tag v4.39.0 peels to (checked with the GitHub API).

Evidence

• Before: ci(deps): bump github/codeql-action/init from 4.38.3 to 4.39.0 #292 and ci(deps): bump github/codeql-action/analyze from 4.38.3 to 4.39.0 #293, analyze (rust|actions|javascript-typescript) fail with the version-mismatch error above.
  After: all three steps on one version; the analyze jobs on this PR are the proof.

Merge Danger

Door: two-way.

Blast Radius: CI only. The analyze checks are required, so a CodeQL 4.39.0 regression would block every PR until reverted.

Summary by CodeRabbit

• Chores
  • Grouped CodeQL action updates in Dependabot.
  • Updated CodeQL and Scorecard workflows to use the latest pinned CodeQL action revision.

[coderabbitai]

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: a8683111-78fd-41a7-8849-7d509d7578ce

📥 Commits

Reviewing files that changed from the base of the PR and between 7b3dad4 and 99921a5.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: f21618c4-1d74-45f2-a4b1-42b29ccbf96e

📥 Commits

Reviewing files that changed from the base of the PR and between 1838e63 and 7b3dad4.

📒 Files selected for processing: 3

• .github/dependabot.yml
• .github/workflows/codeql.yml
• .github/workflows/scorecard_analysis.yml

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 7 remain after this review.

📝 Walkthrough

The Dependabot configuration now groups CodeQL action updates. The CodeQL and Scorecard workflows now pin their CodeQL actions to v4.39.0.

Changes: CodeQL Action Updates

Layer / File(s)	Summary
Group and pin CodeQL actions .github/dependabot.yml, .github/workflows/codeql.yml, .github/workflows/scorecard_analysis.yml	Dependabot groups updates for github/codeql-action/*. The CodeQL init and analyze steps and the Scorecard upload-sarif step now use v4.39.0. Workflow inputs and SARIF configuration are unchanged.

Priority: ⬆️ High

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 7b3da

No actionable merge-blocking risk remains.

Architecture risk: 🔵 Low · up to 7b3da

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/dependabot.yml: Added a codeql-action update group matching all dependencies whose names begin with github/codeql-action/.
• observed — Modified behavior in .github/workflows/codeql.yml: Updated the pinned CodeQL init and analyze actions from v4.38.3 to v4.39.0; the configuration inputs remain unchanged.
• observed — Modified behavior in .github/workflows/scorecard_analysis.yml: The upload-sarif action pin changes from v4.38.3 to v4.39.0.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the CodeQL action update to version 4.39.0 and the grouped Dependabot configuration.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-22T12:25:07.615480Z	99921a5	New commits
🔒 Security Review	✅ Completed 2026-10-22T12:25:59.899151Z	99921a5	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[tonibergholm]

Required checks green on the up-to-date head; the analyze jobs now pass with all three codeql-action steps on one version.