From 0f81e347ecc1a1835caaa9d00ca0dc1b91580a23 Mon Sep 17 00:00:00 2001
From: Sami Rusani <sr@samirusani>
Date: Fri, 14 Aug 2026 23:31:06 +0200
Subject: [PATCH] Move all three CodeQL action pins to v4.37.4 atomically

Supersedes #348, #350 and #352, which cannot be merged individually. Two
independent reasons, and either alone is sufficient.

CodeQL refuses to run on a split version. The CI log on #348 says it plainly:
"Loaded a configuration file for version '4.37.3', but running version
'4.37.4'". Both CodeQL jobs fail on all three PRs, so whichever merged first
would leave main's security scanning broken until the other two followed.

And test_ci_action_dependency_carrier_uses_exact_atomic_pins asserts the three
refs are identical and that each carries the literal version comment. That guard
fired on all three PRs. It is worth being precise about what happened, because
this repository has been burned by the opposite: a previous dependency backlog
retired two mutation guards silently, by moving a value some hardcoded digest
depended on. This time the guard did not go quiet. It failed loudly and it
caught a real defect. So the constants are updated deliberately here rather than
the guard being softened into deriving the pin from the workflow, because the
equality-across-three-copies IS the atomicity property that just proved its
worth.

Digests dereferenced from upstream rather than taken from the PR. Both tags are
annotated, so a single-hop read returns the tag object; both were followed to
the commit. v4.37.3 is e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 and matches what
was committed. v4.37.4 is f205ea1c3313d32999d8d6a48b4f6530d4437b38 and matches
what is applied.

The guard was re-checked for vacuity after the update: reverting one of the
three workflow pins turns it red, restoring turns it green.

Two latent instances of the same hardcoded-digest pattern remain and are not
touched here. The same test asserts the actions/checkout digest 19 times, and
test_phase5_enterprise_handoff_truth.py embeds that digest inside a multi-line
string literal, which is the harder one to notice. A future actions/checkout
bump hits both. Worth knowing that the repository already solved this correctly
twice, in test_single_tenant_deployment.py and
test_least_privilege_deployment_workflow.py, which derive the pin from the
workflow instead.

Verified: 4544 unit passed, 2 skipped.
---
 .github/workflows/security-scans.yml    | 6 +++---
 tests/unit/test_vnext_release_polish.py | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/security-scans.yml b/.github/workflows/security-scans.yml
index 21d8c76b..bb3455c5 100644
--- a/.github/workflows/security-scans.yml
+++ b/.github/workflows/security-scans.yml
@@ -105,12 +105,12 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
         with:
           languages: ${{ matrix.language }}
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/autobuild@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
 
       - name: Analyze
-        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
diff --git a/tests/unit/test_vnext_release_polish.py b/tests/unit/test_vnext_release_polish.py
index 0e907b05..5856396d 100644
--- a/tests/unit/test_vnext_release_polish.py
+++ b/tests/unit/test_vnext_release_polish.py
@@ -480,13 +480,13 @@ def test_ci_action_dependency_carrier_uses_exact_atomic_pins() -> None:
         "3d3c42e5aac5ba805825da76410c181273ba90b1"
     ] * 19
     assert codeql_refs == [
-        "e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81"
+        "f205ea1c3313d32999d8d6a48b4f6530d4437b38"
     ] * 3
     security_workflow = _read(".github/workflows/security-scans.yml")
     for step in ("init", "autobuild", "analyze"):
         assert (
             f"github/codeql-action/{step}@"
-            "e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3"
+            "f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4"
         ) in security_workflow