build(deps): bump github/codeql-action/init from 4.38.1 to 4.38.2

[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Bumps github/codeql-action/init from 4.38.1 to 4.38.2.

Release notes

Sourced from github/codeql-action/init's releases.

v4.38.2

• Update default CodeQL bundle version to 2.27.1. #4160

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.2 - 24 Sept 2026

• Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

... (truncated)

Commits

• 2892aa5 Merge pull request #4168 from github/update-v4.38.2-a6ef2c96f
• 8ad03a3 Trigger workflows
• 98af865 Update changelog for v4.38.2
• a6ef2c9 Merge pull request #4156 from github/mario-campos/fix-validate-cmd
• 1ef28a1 Merge pull request #4166 from github/dependabot/github_actions/dot-github/wor...
• 26cb08b Merge pull request #4163 from github/mbg/fix-getCommitOid-stubs
• f035ce3 Merge pull request #4165 from github/dependabot/npm_and_yarn/npm-minor-8eaed9...
• 5e4e255 Rebuild
• b13f5f4 Bump ruby/setup-ruby
• c87fe57 Rebuild
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: blocked before merge. Reviewed October 6, 2026, 4:57 AM ET / 08:57 UTC (Revision 3).

ClawSweeper review

What this changes

Updates the pinned CodeQL initialization action to 4.38.2 in Discrawl’s Go security-scanning workflow.

Regression provenance

Possible regression — probable (reviewed change; failure trace). No predecessor PR is attributed.

Merge readiness

⛔ Blocked before merge - 5 items remain

The update remains necessary, but the previously reported version mismatch still blocks CodeQL analysis on this exact head. Neither current main nor the latest release contains the upgrade.

Priority: P2
Reviewed head: f8f7449df8d3080132685c26261623296dfe1451

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	The pin update is focused, but its demonstrated incompatibility prevents the security workflow from completing.
Proof confidence	🌊 off-meta tidepool	Not applicable: Dependabot is exempt from contributor setup proof. The actual workflow execution nevertheless demonstrates the blocking version mismatch; no stored-data contract changes.
Patch quality	🧂 unranked krab (1/6)	Security review found an item that needs attention.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: Dependabot is exempt from contributor setup proof. The actual workflow execution nevertheless demonstrates the blocking version mismatch; no stored-data contract changes.
Evidence reviewed	9 items	Introduced mismatch: The sole introduced change updates initialization to 2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2, while analysis remains pinned to 4.38.1 at line 37. Observed exact-head failure: Check 111206747914 belongs to the pinned PR head. Its annotations report: “Loaded a configuration file for version '4.38.2', but running version '4.38.1'”, including failure of the analysis post-action step. Applicable dependency contract: The workflow directly executes this dependency. Its configuration loader rejects any configuration whose recorded action version differs from the running action version.
Findings	1 actionable finding	[P1] Update the analysis action alongside initialization
Security	Needs attention	Preserve security-scan completion: The introduced initialization version cannot be consumed by the existing analysis action, leaving this workflow unable to complete security analysis and upload results.

How this fits together

Discrawl’s CodeQL workflow scans repository changes for security problems. Initialization prepares the analysis configuration, and the analysis step consumes it and uploads findings to GitHub.

flowchart LR
  A[Repository changes] --> B[GitHub workflow]
  B --> C[CodeQL initialization]
  C --> D[Version compatibility check]
  D --> E[Go security analysis]
  E --> F[GitHub security findings]

Loading

Before merge

• Update the analysis action alongside initialization (P1) - Initialization now writes a 4.38.2 configuration, but the analysis step at line 37 still runs 4.38.1. Its configuration loader requires exact version equality, and the check on this head reports that rejection, preventing analysis and upload. Pin analysis to the same 4.38.2 commit. This remains the unfixed finding from the earlier review.
• Resolve security concern: Preserve security-scan completion - The introduced initialization version cannot be consumed by the existing analysis action, leaving this workflow unable to complete security analysis and upload results.
• Resolve merge risk (P1) - Merging the initialization-only update would prevent CodeQL analysis and security-result upload because the analysis action rejects the newer configuration.
• Complete next step (P2) - Pin analysis to the same 4.38.2 commit as initialization and verify that CodeQL analysis and upload complete.
• Improve patch quality - Align the analysis pin with initialization and obtain a successful CodeQL analysis and upload run.

Findings

• [P1] Update the analysis action alongside initialization — .github/workflows/codeql.yml:32
• [medium] Preserve security-scan completion — .github/workflows/codeql.yml:32

Agent review details

Security

Needs attention: The upstream pin is verified and permissions remain unchanged, but the mismatched actions disable completion of the security scan.

Review metrics

Metric	Value	Why it matters
CodeQL action pins	1 updated, 1 left at 4.38.1	The two steps exchange configuration that requires matching action versions.

Merge-risk options

Maintainer options:

1. Align both CodeQL pins (recommended)
   Update the analysis action to the same 4.38.2 commit and verify that the resulting workflow completes analysis and upload.

Copy recommended automerge instruction

@clawsweeper automerge

Special instructions:
Pin github/codeql-action/analyze to 2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 with the v4.38.2 comment, matching initialization, and verify the CodeQL workflow completes analysis and upload.

Technical review

Best possible solution:

Keep initialization and analysis pinned to the same verified 4.38.2 commit so the security scan completes end to end.

Do we have a high-confidence way to reproduce the issue?

Yes, for the patch defect: the real GitHub Actions run on the exact PR head records the configuration-version rejection, matching the inspected dependency contract.

Is this the best way to solve the issue?

No, the initialization-only update is incomplete; updating both action pins together is the narrow repair.

Full review comments:

• [P1] Update the analysis action alongside initialization — .github/workflows/codeql.yml:32
  Initialization now writes a 4.38.2 configuration, but the analysis step at line 37 still runs 4.38.1. Its configuration loader requires exact version equality, and the check on this head reports that rejection, preventing analysis and upload. Pin analysis to the same 4.38.2 commit. This remains the unfixed finding from the earlier review.
  Confidence: 1

Overall correctness: patch is incorrect
Overall confidence: 1

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against 52470d9c7187.

Labels

Label changes:

No label changes.

Label justifications:

• P2: This is a bounded dependency update with a concrete security-scanning workflow defect.
• merge-risk: 🚨 automation: The introduced version mismatch demonstrably prevents the CodeQL workflow from completing.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🌊 off-meta tidepool and patch quality is 🧂 unranked krab.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: Dependabot is exempt from contributor setup proof. The actual workflow execution nevertheless demonstrates the blocking version mismatch; no stored-data contract changes.

Evidence

Security concerns:

• [medium] Preserve security-scan completion — .github/workflows/codeql.yml:32
  The introduced initialization version cannot be consumed by the existing analysis action, leaving this workflow unable to complete security analysis and upload results.
  Confidence: 1

Acceptance criteria:

• [P1] git diff --check.
• [P1] gh pr checks 270 --repo openclaw/discrawl.
• [P1] gh run view --repo openclaw/discrawl --log.

What I checked:

• Introduced mismatch: The sole introduced change updates initialization to 2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2, while analysis remains pinned to 4.38.1 at line 37. (.github/workflows/codeql.yml:32, f8f7449df8d3)
• Observed exact-head failure: Check 111206747914 belongs to the pinned PR head. Its annotations report: “Loaded a configuration file for version '4.38.2', but running version '4.38.1'”, including failure of the analysis post-action step. (.github/workflows/codeql.yml:32, f8f7449df8d3)
• Applicable dependency contract: The workflow directly executes this dependency. Its configuration loader rejects any configuration whose recorded action version differs from the running action version. (src/config-utils.ts:1426, 1c5b675653bb)
• Verified upstream pin: The upstream annotated v4.38.2 tag resolves to the exact commit introduced by this PR. (2892aa5e19bb)
• Verified merge result: The test merge has the pinned main parent followed by the exact PR head parent; its diff retains the same initialization-only update and version mismatch. (.github/workflows/codeql.yml:32, e6dbe13a6ece)
• Main and release remain unchanged: Pinned main and latest release v0.15.6 both use 4.38.1 for initialization and analysis; the requested upgrade is not already implemented. (.github/workflows/codeql.yml:32, cd7fa1ce5eb7)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• openclaw/openclaw-secops: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (2 earlier review cycles)

• reviewed 2026-10-03T12:57:33.181Z sha f8f7449 :: blocked before merge. :: [P1] Update the analysis action alongside initialization
• reviewed 2026-10-05T12:01:30.123Z sha f8f7449 :: blocked before merge. :: [P1] Update the analysis action alongside initialization

[steipete]

Incorporated into #272, now merged. CodeQL initialization and analysis were updated together to v4.38.2 so their configuration versions match; the same PR includes TruffleHog v3.97.9 and groups future CodeQL updates. The combined head passed CodeQL, secret scans, full CI, and the remote make check gate (86.0% coverage). Thanks for the update.

Closing this separate update as superseded by the verified combined change.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.