fix(security): align codeql init/analyze pins with autobuild

[fredcamaral]

Description

Every codeql_scan job in pr-security-scan.yml (and thus go-pr-validation.yml) currently fails on Go-changing PRs with:

Error: We were unable to automatically build your code. ...
Loaded a configuration file for version '4.35.1', but running version '4.36.3'

Root cause: the codeql-init / codeql-analyze composites pin github/codeql-action at c10b8064 (v4.35.1), while the Autobuild step inside pr-security-scan.yml was bumped by Dependabot to 54f647b7 (v4.36.3, tag v1.46.x) and e4fba868 (v4.37.3, develop / v1.48+). codeql-action requires init/autobuild/analyze to run the exact same version, so the mix hard-fails before the build starts. Dependabot cannot see the composites (src/**/action.yml is outside the github-actions ecosystem scan, as noted in .github/dependabot.yml), which is how the pins drifted.

This PR aligns both composites with the pin already used by Autobuild and upload-sarif on develop:

# src/security/codeql-init/action.yml, src/security/codeql-analyze/action.yml
- uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13  # v4 (4.35.1)
+ uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81  # v4 (4.37.3)

Note for consumers: because the composites resolve via the floating @v1 tag, callers pinned to tags whose Autobuild step is on a different codeql-action version (e.g. v1.46.x → v4.36.3) will still mismatch after this ships; they need to bump to a tag whose autobuild pin is e4fba868 (v1.48.0+). Longer term, consider having pr-security-scan.yml consume autobuild through a composite too, so all four codeql-action steps bump atomically.

Type of Change

• fix: Bug fix in a workflow (incorrect behavior, broken step, wrong condition)

Breaking Changes

None.

Testing

• YAML syntax validated locally
• Triggered a real workflow run on a caller repository using @this-branch or the beta tag
• Verified all existing inputs still work with default values
• Confirmed no secrets or tokens are printed in logs
• Checked that unrelated workflows are not affected

Caller repo / workflow run: Failure reproduced on https://github.com/LerianStudio/plugin-br-bank-transfer/actions/runs/31132478400 (validate / Security (pipeline) / codeql_scan); the pins are only consumed via @v1, so a pre-merge caller run cannot exercise this change directly.

Related Issues

Closes #

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: ASSERTIVE

Plan: Pro

Run ID: b2f61440-eb20-46de-b069-8aa7917fe425

📥 Commits

Reviewing files that changed from the base of the PR and between d58ae2e and df19a09.

📒 Files selected for processing (2)

• src/security/codeql-analyze/action.yml
• src/security/codeql-init/action.yml

---

Summary by CodeRabbit

• Chores
  • Updated the security analysis tooling to a newer version while preserving existing configuration and behavior.

Walkthrough

The pull request updates the pinned commits for the CodeQL initialization and analysis actions. Existing version labels and inputs remain unchanged.

Changes

CodeQL action pins

Layer / File(s)	Summary
Update CodeQL action commits src/security/codeql-init/action.yml, src/security/codeql-analyze/action.yml	The CodeQL initialization and analysis steps reference new pinned commits. Existing action versions and inputs remain unchanged.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the CodeQL security pin alignment in the init and analyze composites.
Description check	✅ Passed	The description explains the failure, root cause, pin changes, consumer impact, testing, and validation limits; the empty issue reference is non-critical.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/align-codeql-action-pins

---

_{Comment @coderabbitai help to get the list of available commands.}

[lerian-studio]

🔍 Lint Analysis

Check	Files Scanned	Status
YAML Lint	2 file(s)	✅ success
Action Lint	no changes	⏭️ skipped
Pinned Actions	2 file(s)	✅ success
Markdown Link Check	no changes	⏭️ skipped
Spelling Check	2 file(s)	✅ success
Shell Check	2 file(s)	✅ success
README Check	2 file(s)	✅ success
Composite Schema	2 file(s)	✅ success
Deployment Matrix	no changes	⏭️ skipped

---

_{🔍 View full scan logs}

[lerian-studio]

🔍 PR Validation Summary

✅ PR Mergeable — no blocking failures

Check	Status	Blocking
Source Branch	✅ success	yes
PR Title	✅ success	yes
PR Description	✅ success	yes
Breaking Change Guard	✅ success	yes
PR Size	✅ success	no
Auto Labels	✅ success	no
PR Metadata	✅ success	no

---

_{🔍 View workflow run}

[lerian-studio]

🛡️ CodeQL Analysis Results

Languages analyzed: actions

✅ No security issues found.

---

_{🔍 View full scan logs | 🛡️ Security tab}