chore(deps): bump the github-actions group across 1 directory with 2 updates

[dependabot]

Bumps the github-actions group with 2 updates in the / directory: github/codeql-action/init and github/codeql-action/analyze.

Updates github/codeql-action/init from 4.37.7 to 4.38.0

Release notes

Sourced from github/codeql-action/init's releases.

v4.38.0

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

v4.37.9

• Update default CodeQL bundle version to 2.26.4. #4106

v4.37.8

No user facing changes.

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

... (truncated)

Commits

• b96794f Merge pull request #4131 from github/update-v4.38.0-7e08580a9
• 02d5093 Update changelog for v4.38.0
• 7e08580 Merge pull request #4130 from github/henrymercer/workflow-runner-sizing
• bfcc52b Run slow macOS checks on larger runners
• 8c251e7 Merge pull request #4129 from github/update-bundle/codeql-bundle-v2.27.0
• 0b7ca40 Add changelog note
• 40484b3 Update default bundle to codeql-bundle-v2.27.0
• 977e6ce Merge pull request #4124 from github/henrymercer/toolcache-bundle-cleanup
• 40a6b38 Address toolcache cleanup review feedback
• deece8f Apply suggestion from @​henrymercer
• Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.37.7 to 4.38.0

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.38.0

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

v4.37.9

• Update default CodeQL bundle version to 2.26.4. #4106

v4.37.8

No user facing changes.

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

... (truncated)

Commits

• b96794f Merge pull request #4131 from github/update-v4.38.0-7e08580a9
• 02d5093 Update changelog for v4.38.0
• 7e08580 Merge pull request #4130 from github/henrymercer/workflow-runner-sizing
• bfcc52b Run slow macOS checks on larger runners
• 8c251e7 Merge pull request #4129 from github/update-bundle/codeql-bundle-v2.27.0
• 0b7ca40 Add changelog note
• 40484b3 Update default bundle to codeql-bundle-v2.27.0
• 977e6ce Merge pull request #4124 from github/henrymercer/toolcache-bundle-cleanup
• 40a6b38 Address toolcache cleanup review feedback
• deece8f Apply suggestion from @​henrymercer
• Additional commits viewable in compare view

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clawhub	Ready	Preview	Sep 15, 2026 4:11pm UTC

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 15, 2026, 12:12 PM ET / 16:12 UTC (Revision 19).

ClawSweeper review

What this changes

Updates ClawHub’s CodeQL initialization and analysis actions from v4.37.7 to v4.38.0 while retaining full commit pins.

Merge readiness

✅ Ready for maintainer review

This update remains useful: current main retains the older CodeQL pin, and no replacement PR was found. No blocking findings emerged from the workflow, upstream compatibility, or supply-chain review.

Priority: P3
Reviewed head: 6f7bd76945010a7bcbb2bb70bcab116b875c2de0

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, verified dependency update with successful execution of the affected workflow and no blocking findings.
Proof confidence	🌊 off-meta tidepool	Not applicable: Dependabot’s maintenance update is exempt from contributor proof; additionally, the real CodeQL workflow successfully ran initialization and analysis for all five profiles on the pinned head.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: Dependabot’s maintenance update is exempt from contributor proof; additionally, the real CodeQL workflow successfully ran initialization and analysis for all five profiles on the pinned head.
Evidence reviewed	8 items	Exact introduced change: The complete pinned base-to-head diff changes only the init and analyze commit references; permissions, triggers, runner, profiles, and inputs remain unchanged. Verified upstream release identity: The official annotated v4.38.0 tag resolves to exactly the proposed b96794f015dfd88f77b49b1c93e0fa7110f94c63 commit. The workflow directly executes this dependency, establishing the upstream contract boundary. Runtime and cleanup compatibility: Read both action manifests, release notes, and relevant upstream setup/download/package patches. The supplied inputs remain supported under Node 24. New toolcache cleanup is restricted to GitHub-hosted runners, guarded against earlier CodeQL setup, and avoids symlinked CodeQL directories; cleanup errors do not throw.
Findings	None	None.
Security	None	None.

How this fits together

CodeQL Light scans selected ClawHub source and workflow files through five security profiles. GitHub Actions initializes the analyzer, runs the configured queries, and uploads results to GitHub code scanning.

flowchart LR
  A[Repository changes or scheduled run] --> B[Workflow filters]
  B --> C[Five security profiles]
  C --> D[Initialize CodeQL]
  D --> E[Analyze selected source]
  E --> F[GitHub code scanning results]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
LOC	+2/-2 across 1 workflow	The patch only updates two synchronized dependency pins.
CodeQL execution	5 of 5 profiles passed	Every configured profile successfully exercised initialization and analysis on the reviewed head.

Technical review

Best possible solution:

Keep both CodeQL actions synchronized on the verified release commit within the existing five-profile workflow.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR updates a CI dependency and does not report a product bug.

Is this the best way to solve the issue?

Yes—updating both immutable pins is the narrowest maintenance path. Retaining the old release misses the update, while floating tags would weaken reproducibility; neither is preferable.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 91aecdc22c53.

Labels

Label justifications:

• P3: This is a bounded dependency-maintenance update with no demonstrated urgent user-facing regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Dependabot’s maintenance update is exempt from contributor proof; additionally, the real CodeQL workflow successfully ran initialization and analysis for all five profiles on the pinned head.

Evidence

What I checked:

• Exact introduced change: The complete pinned base-to-head diff changes only the init and analyze commit references; permissions, triggers, runner, profiles, and inputs remain unchanged. (.github/workflows/codeql-light.yml:91, 6f7bd7694501)
• Verified upstream release identity: The official annotated v4.38.0 tag resolves to exactly the proposed b96794f015dfd88f77b49b1c93e0fa7110f94c63 commit. The workflow directly executes this dependency, establishing the upstream contract boundary. (b96794f015df)
• Runtime and cleanup compatibility: Read both action manifests, release notes, and relevant upstream setup/download/package patches. The supplied inputs remain supported under Node 24. New toolcache cleanup is restricted to GitHub-hosted runners, guarded against earlier CodeQL setup, and avoids symlinked CodeQL directories; cleanup errors do not throw. (src/setup-codeql.ts, b96794f015df)
• Changed workflow exercised: Run https://github.com/openclaw/clawhub/actions/runs/34993116447 belongs to the pinned head. All five profiles completed successfully, including both Initialize CodeQL and Analyze steps in every job. (.github/workflows/codeql-light.yml:89, 6f7bd7694501)
• Still absent from main and latest release: The inspected main-to-head diff shows main still using ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd. The supplied latest release v0.23.3 uses 7188fc363630916deb702c7fdcf4e481b751f97a, also different from the proposed update. A repository search for CodeQL 4.38.0 returned only this open PR. (.github/workflows/codeql-light.yml:91, 87ca030c30f3)
• Routing and policy: Read the full root AGENTS.md and ClawHub PR maintainer skill; no nested AGENTS.md was found under .github and no maintainer-notes directory exists. CODEOWNERS routes workflows to openclaw/openclaw-secops. GitHub file history identifies vincentkoc as a relevant historical contributor and subsequent dependency updates by Dependabot. (.github/CODEOWNERS:12, 6f7bd7694501)

Likely related people:

• vincentkoc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• openclaw/openclaw-secops: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (18 earlier review cycles; latest 8 shown)

• reviewed 2026-09-04T16:13:19.961Z sha cbc1e20 :: blocked before merge. :: none
• reviewed 2026-09-07T16:10:47.610Z sha cbc1e20 :: needs maintainer review before merge. :: none
• reviewed 2026-09-07T16:16:37.120Z sha 93d0474 :: needs maintainer review before merge. :: none
• reviewed 2026-09-08T16:14:25.615Z sha 93d0474 :: needs maintainer review before merge. :: none
• reviewed 2026-09-09T16:13:43.584Z sha df0b470 :: needs maintainer review before merge. :: none
• reviewed 2026-09-10T16:12:42.799Z sha 3c888a9 :: needs maintainer review before merge. :: none
• reviewed 2026-09-11T16:12:36.984Z sha 9f0a270 :: needs maintainer review before merge. :: none
• reviewed 2026-09-14T16:16:16.171Z sha ddb47da :: needs maintainer review before merge. :: none

[blacksmith-sh]

Found 2 test failures on Blacksmith runners:

Failures

Test	View Logs
[chromium] › e2e/local-auth/ malicious-skill-ban-flow.pw.test.ts:102:1 › malicious prepublication retries keep the c lean latest visible	View Logs
e2e/local-auth/malicious-skill-ban-flow.pw.test.ts/ malicious prepublication retries keep the clean latest visible	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}