chore(deps): update CodeQL Action to 4.37.5

[dependabot]

What

Updates every github/codeql-action step in the CodeQL backfill workflow from v4.36.2 to the current v4.37.5 release, pinned to immutable commit d1ba80a13dd99fba24a470575428917156a28b43.

Why

v4.37.5 includes the upstream fix that falls back to a complete bundle download when a network error occurs during streaming extraction. Keeping init, autobuild, and analyze on one exact commit preserves supply-chain integrity and avoids mixed Action runtimes.

Validation

The existing workflow-contract validator and repository CI must pass at this current head before merge.

[coderabbitai]

📝 Walkthrough

Walkthrough

CodeQL 백필 워크플로의 init, autobuild 및 analyze 액션 버전을 v4.36.2에서 v4.37.4로 업데이트했습니다.

Changes

CodeQL 분석 워크플로

Layer / File(s)	Summary
CodeQL 액션 버전 변경 .github/workflows/codeql-backfill.yml	CodeQL 초기화, 자동 빌드 및 분석 액션 버전을 v4.36.2에서 v4.37.4로 변경했습니다.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• ContextualWisdomLab/pg-erd-cloud#58: 동일한 CodeQL 워크플로 단계의 액션 버전을 업데이트했습니다.
• ContextualWisdomLab/pg-erd-cloud#82: CodeQL 워크플로의 액션 버전을 업데이트했습니다.
• ContextualWisdomLab/pg-erd-cloud#105: 다른 워크플로 파일의 CodeQL 액션 버전을 업데이트했습니다.

Suggested reviewers: seonghobae

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	제목은 CodeQL Action 업데이트를 설명하지만 실제 변경 버전은 4.37.4이고 제목은 4.37.5를 명시합니다.	제목의 버전을 실제 변경 버전인 4.37.4로 수정하세요.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dependabot/github_actions/github/codeql-action/analyze-4.37.4

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@dependabot rebase

[seonghobae]

Reviewed: routine pinned-version bump, checks green.

[seonghobae]

@dependabot rebase

[dependabot]

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

[seonghobae]

@dependabot recreate

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/codeql-backfill.yml:
- Line 92: Update the CodeQL action references used by the init and autobuild
steps to the same v4.37.4 commit SHA already used by analyze, ensuring all
CodeQL stages in the workflow are pinned consistently.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 440d76a7-e87b-4fdd-ab2c-b56aaa87beb2

📥 Commits

Reviewing files that changed from the base of the PR and between 941264c and 52ae59a.

📒 Files selected for processing (1)

• .github/workflows/codeql-backfill.yml

[seonghobae]

Reviewed: pinned checkout v7.0.1 + CodeQL action digest bumps only.

[seonghobae]

@dependabot rebase

[dependabot]

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

[seonghobae]

Reviewed current head: all CodeQL init/autobuild/analyze steps are pinned consistently to v4.37.4, the review thread is resolved, and CI, Security Scan, and Semgrep pass.

[seonghobae]

@opencode-agent @cwl-noema-review Please independently review exact current head ae3439ec32e23d2d1b29688ead893f24eededbe9. Confirm every CodeQL init/analyze/upload step in each affected workflow uses one immutable v4.37.4 SHA without permission or SARIF behavior drift. Exact-head CI, Security Scan, and Semgrep are green; submit APPROVE only if no blocker remains.

[seonghobae]

@opencode-agent Please independently review exact current head ae3439ec32e23d2d1b29688ead893f24eededbe9. Verify that every CodeQL init, autobuild, and analyze step in .github/workflows/codeql-backfill.yml uses the same immutable v4.37.4 commit, the resolved CodeRabbit finding remains fixed, and exact-head CI, Security Scan, Semgrep, and CodeRabbit status all succeed. Submit APPROVE only if no blocker remains.

@cwl-noema-review Please perform the second independent exact-head review after OpenCode. The current maintainer approval does not substitute for latest-pusher-independent review.

[seonghobae]

@opencode-agent @cwl-noema-review Please independently review exact current head bca2108ae082a9f23732359387c995423c08a7ec. Current-head CI, Security Scan, and SAST Semgrep are successful; the sole CodeRabbit thread is resolved. Verify the one-file change pins CodeQL init, autobuild, and analyze consistently to immutable v4.37.5 commit d1ba80a13dd99fba24a470575428917156a28b43, preserves languages/category/ref behavior, and introduces no permission or trigger drift. Submit APPROVE only for this exact head if no blocking finding remains.

[seonghobae]

@opencode-agent Please review exact current head bca2108ae082a9f23732359387c995423c08a7ec. Verify every github/codeql-action stage in codeql-backfill.yml is pinned to the same immutable v4.37.5 commit, workflow permissions and analysis semantics are unchanged, and the existing contract validator passes. Current-head CI, Security Scan, Semgrep, and CodeRabbit are green; submit APPROVE only if no blocking finding remains.

[seonghobae]

@cwl-noema-review Please independently review exact current head bca2108ae082a9f23732359387c995423c08a7ec. Confirm the immutable Action upgrade is internally version-consistent and does not widen permissions or weaken code-scanning behavior. Submit APPROVE only if no blocker remains.