Update github/codeql-action action to v4.39.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
github/codeql-action	action	minor	v4.38.3 → v4.39.0

---

Release Notes

github/codeql-action

v4.39.0

Compare Source

• Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #​4205
• The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #​4148
• Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #​4206
• The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #​4198

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[fossabot]

Needs Review

I recommend reviewing this upgrade before merging because it introduces a high-confidence breaking change that bumps the minimum required CodeQL bundle version. While this repository uses GitHub-hosted runners (ubuntu-26.04) which typically ship with up-to-date CodeQL bundles and are unlikely to be affected, the breaking change should be explicitly verified before proceeding. Additionally, an external CI check from Snyk is failing, and since we cannot access its logs, we cannot determine whether the failure is related to this upgrade. The upgrade itself also delivers 1 new feature and 2 bug fixes, and no security vulnerabilities were identified for this version range.

Tip: Comment @​fossabot fix to attempt automatic fixes.

Fix Suggestions

We identified 2 fixable issues in this upgrade.

• Verify that the GitHub-hosted runner's CodeQL bundle version meets the new minimum of 2.20.7 required by codeql-action 4.39.0
  Files: .github/workflows/codeql.yml
• Investigate the failing Snyk CI check to rule out any connection to the codeql-action upgrade
  Files: .github/workflows/codeql.yml

AI Assistant Prompt

Copy prompt for AI assistant

# Dependency Upgrade Review: `github/codeql-action` 4.38.3 → 4.39.0

Repository: algorithm-exercises-py, PR #999

## Context

This PR upgrades `github/codeql-action` from 4.38.3 to 4.39.0. The upgrade includes:
- **Breaking change**: Minimum required CodeQL bundle version raised to **2.20.7**
- 2 bug fixes (cache restoration with third-party caching, `start-proxy` on non-github.com instances)
- 1 new feature

## What I Need Help With

Please help me verify and address the following items in this PR:

### 1. Verify CodeQL Bundle Compatibility

**File:** `.github/workflows/codeql.yml`

The workflow runs on `ubuntu-26.04` (GitHub-hosted runner). The new minimum CodeQL bundle version is **2.20.7**.

**Action needed:**
- Review `.github/workflows/codeql.yml` and confirm the runner configuration.
- GitHub-hosted runners almost certainly ship with a bundle >= 2.20.7, but help me add a verification step or confirm this is safe.
- If the workflow uses any pinned or overridden CodeQL versions, flag them.
- No code change is expected if the runner bundle is already sufficient — just confirm.

### 2. Check for Snyk CI Failure (Manual)

The `security/snyk` CI check is failing, but logs are inaccessible (external provider). This is likely unrelated to the codeql-action upgrade, but needs human confirmation.

**Action needed:**
- Note that I need to manually check the Snyk dashboard at: https://app.snyk.io/org/sir-gon/pr-checks/56be7318-cfff-4b78-bb52-e5c4909a463f
- Help me determine if anything in this PR's changes could plausibly affect Snyk.

### 3. Review the Workflow File

Please review `.github/workflows/codeql.yml` and confirm:
- All `github/codeql-action/*` action references (init, analyze, autobuild, etc.) are consistently updated to the new version.
- No other configuration in the workflow conflicts with the 4.39.0 requirements.
- The workflow doesn't pin a specific CodeQL bundle version below 2.20.7.

Please start by reading `.github/workflows/codeql.yml` and providing your assessment.

What we checked

• The github/codeql-action/init@​v4 action is actively used in the CodeQL workflow. This confirms the dependency is in use via the @​v4 floating tag, meaning the upgrade from 4.38.3 → 4.39.0 directly affects this workflow. ^[1]
• github/codeql-action/analyze@​v4 is also used in the same workflow. Both init and analyze sub-actions are subject to the minimum CodeQL bundle version change introduced in the new version. ^[2]
• The workflow runs on ubuntu-26.04 (GitHub-hosted runner). GitHub-hosted runners receive up-to-date CodeQL bundles automatically, which means the new minimum bundle version requirement of 2.20.7 is very likely already satisfied — reducing the practical impact of the breaking change for this repository. ^[3]
• Confirmed breaking change in this release: the minimum required CodeQL bundle version is raised to 2.20.7. Self-hosted runners or environments pinned to older CodeQL bundles (below 2.20.7) would be broken by this upgrade. GitHub-hosted runners are not expected to be affected. ^[4]
• Version 4.38.3 added a deprecation warning for CodeQL versions 2.21.2 and earlier, flagged as discontinued after September 24, 2026. The new version formalizes support boundaries by enforcing the minimum bundle version floor at 2.20.7. ^[5]
• The security/snyk (sir-gon) CI check is failing. Snyk is an unsupported external provider, so logs cannot be analyzed. Per policy, this failure requires a manual review to rule out any connection to the dependency upgrade. ^[6]

Dependency Usage

No usage of the analyzed dependencies was found in this repository.

• The github/codeql-action/init@​v4 action is actively used in the CodeQL workflow. This confirms the dependency is in use via the @​v4 floating tag, meaning the upgrade from 4.38.3 → 4.39.0 directly affects this workflow.
  

  algorithm-exercises-py/.github/workflows/codeql.yml

  Line 85 in 8045751

  uses: github/codeql-action/init@v4

• github/codeql-action/analyze@​v4 is also used in the same workflow. Both init and analyze sub-actions are subject to the minimum CodeQL bundle version change introduced in the new version.
  

  algorithm-exercises-py/.github/workflows/codeql.yml

  Line 113 in 8045751

  uses: github/codeql-action/analyze@v4

View 1 more usage

• The workflow runs on ubuntu-26.04 (GitHub-hosted runner). GitHub-hosted runners receive up-to-date CodeQL bundles automatically, which means the new minimum bundle version requirement of 2.20.7 is very likely already satisfied — reducing the practical impact of the breaking change for this repository.
  

  algorithm-exercises-py/.github/workflows/codeql.yml

  Line 45 in 8045751

  ${{ (matrix.language == 'swift' && 'macos-26') || 'ubuntu-26.04' }}

Changes

github/codeql-action was updated with a breaking change that raises the minimum required CodeQL bundle version — environments running older bundles will need to upgrade before this change is compatible. Two bug fixes are also included: one resolving cache restoration failures with third-party caching implementations, and another ensuring codeql-action/start-proxy correctly locates CodeQL releases on non-github.com GitHub instances.

• Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205 (v4.39.0, changelog)
• Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206 (v4.39.0, changelog)
• The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. [#4198](https://redirect.github.... (v4.39.0, changelog)

View 1 more change

• The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. [#4148](https://redirect.... (v4.39.0, changelog)

References (6)

[1]: The github/codeql-action/init@​v4 action is actively used in the CodeQL workflow. This confirms the dependency is in use via the @​v4 floating tag, meaning the upgrade from 4.38.3 → 4.39.0 directly affects this workflow.

algorithm-exercises-py/.github/workflows/codeql.yml

Line 85 in 8045751

uses: github/codeql-action/init@v4

[2]: github/codeql-action/analyze@​v4 is also used in the same workflow. Both init and analyze sub-actions are subject to the minimum CodeQL bundle version change introduced in the new version.

algorithm-exercises-py/.github/workflows/codeql.yml

Line 113 in 8045751

uses: github/codeql-action/analyze@v4

[3]: The workflow runs on ubuntu-26.04 (GitHub-hosted runner). GitHub-hosted runners receive up-to-date CodeQL bundles automatically, which means the new minimum bundle version requirement of 2.20.7 is very likely already satisfied — reducing the practical impact of the breaking change for this repository.

algorithm-exercises-py/.github/workflows/codeql.yml

Line 45 in 8045751

${{ (matrix.language == 'swift' && 'macos-26') || 'ubuntu-26.04' }}

[4]: Confirmed breaking change in this release: the minimum required CodeQL bundle version is raised to 2.20.7. Self-hosted runners or environments pinned to older CodeQL bundles (below 2.20.7) would be broken by this upgrade. GitHub-hosted runners are not expected to be affected. (source link)

[5]: Version 4.38.3 added a deprecation warning for CodeQL versions 2.21.2 and earlier, flagged as discontinued after September 24, 2026. The new version formalizes support boundaries by enforcing the minimum bundle version floor at 2.20.7. (source link)

[6]: The security/snyk (sir-gon) CI check is failing. Snyk is an unsupported external provider, so logs cannot be analyzed. Per policy, this failure requires a manual review to rule out any connection to the dependency upgrade. (source link)

---

fossabot analyzed this PR using dependency research and AI. View this analysis on the web

[fossabot]

[fossabot]

[fossabot]

No Issues

No application code changes were detected to scan. The PR contains only configuration files, documentation, or other non-code files.

---

fossabot analyzed this PR using SAST security analysis and AI (changed files only).

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (e621a9a) to head (8045751).

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #999   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files          106       106           
  Lines         1875      1875           
  Branches       311       311           
=========================================
  Hits          1875      1875           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.