Update github/codeql-action action to v4.38.3 (main)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
github/codeql-action	action	patch	v4.38.2 → v4.38.3

---

Release Notes

github/codeql-action

v4.38.3

Compare Source

• Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #​4188
• Update default CodeQL bundle version to 2.27.2. #​4203
• Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #​4184

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 7d32c022-f860-4946-8b36-230ba2ec6691

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
unit-tests	100.00% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[fullsend-ai-review]

Risk Assessment: moderate (2/5)

Details

Tiny automated Renovate bump of github/codeql-action pinned SHA in two CI workflow files; protected-path and CI-workflow signals lift it above pure low, but minimal diff, bot author, and healthy history keep it comfortably moderate.

Previous run

Risk Assessment: moderate (2/5)

Details

Patch bump of CodeQL action by Renovate bot; small diff and established update pattern keep base risk low, but both changed files live in .github/workflows/ (protected paths) and the CI_WORKFLOW_CHANGED flag elevates the composite to moderate because these workflows govern security scanning.

Previous run (2)

Risk Assessment: moderate (2/5)

Details

Renovate bot patch-bump of codeql-action in two CI workflow files is minimal in size and authored by a trusted bot, but the protected-path and CI-workflow-changed dimensions elevate the score slightly above low.

[fullsend-ai-review]

Looks good to me

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• .github/workflows/codeql.yml
• .github/workflows/scorecards.yml

Previous run

Review

Findings

Medium

• [protected-path] .github/workflows/codeql.yml, .github/workflows/scorecards.yml — This PR modifies files under the protected path .github/. The PR description provides sufficient context (Renovate patch bump of github/codeql-action from v4.38.2 to v4.38.3 with linked release notes), but human approval is always required for changes to governance and infrastructure files, regardless of context.
  Remediation: Human reviewer should verify the new digest 24c54180a607b1449ed407dd24f251e4e9147c8d corresponds to the claimed v4.38.3 tag of github/codeql-action before merging.

Previous run (2)

Looks good to me

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• .github/workflows/codeql.yml
• .github/workflows/scorecards.yml

[fullsend-ai-retro]

Retro: PR #1906 (Renovate codeql-action v4.38.2 → v4.38.3)

Trivial 6-line SHA-pin bump across two .github/workflows/ files, authored by renovate[bot], merged ~13h after open. The pipeline worked: risk-assessment landed at moderate (2/5), review returned Looks good to me with the protected-path human-gate notice, human reviewer approved, auto-merge completed.

No new proposals filed — every improvement this run surfaces is already covered by an open issue. Logging the evidence here instead per the retro-filing policy.

Evidence for existing open issues

• Wasted review runs on bot rebases — three full review dispatches (~8–9 min each) on three Renovate rebase commits (0ee14d4d → f1937932 → 77bb076d), all producing the same semantic diff. The third run fired at 14:47 UTC, after the human already approved f1937932 at 11:46 UTC. Directly matches fullsend-ai/fullsend#8099 (dedup when diff unchanged after rebase) and fullsend-ai/fullsend#1356. Also matches conforma/policy#... ecosystem of Renovate rebaseWhen=conflicted tuning (fullsend-ai/fullsend#6278).
• Lighter path for bot dependency-bump PRs — this is the exact shape (bot author, pinned-action patch bump, no logic changes) targeted by fullsend-ai/fullsend#8095, #8135, #8383, #7854, and #2842. Three full-strength review runs on a 6-line SHA swap is costly for the signal returned.
• Protected-path reporting is non-deterministic across runs on the same PR — runs 1 and 3 placed the protected-path notice in the sticky blockquote under "Looks good to me" with an empty findings array. Run 2 (f1937932) escalated the same information into a structured Medium finding with a remediation sentence. Same PR, same protected paths, same bot author — different output shape. This is a new data point for fullsend-ai/fullsend#2794 (identical/consistent protected-path comment) and relates to #1392 / #1551.
• Retro dispatched on trivial bot PR with no agent-caught issues — matches fullsend-ai/fullsend#8172, #7486, #7803. This retro itself is an example.

Pipeline notes

• Agents repo discovered: fullsend-ai/agents@0cc4bf8e91bc644c3ffdb2ae158d91131cbf8495 (consistent across all three review runs — no agent-side drift between rebases).
• No fix/code/triage/prioritize stages ran (expected). No test-flakiness signals observed.
• Human reviewer approved without comment, which is correct behavior for an auditable SHA pin against upstream release notes — not rubber-stamping.