Update github-actions dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
aws-actions/configure-aws-credentials (changelog)	action	digest	e6de054 → cbe3b39
github/codeql-action (changelog)	action	digest	e4fba86 → cdf488f

---

Configuration

📅 Schedule: (in timezone Etc/UTC)

• Branch creation
  • "after 5pm on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[claude]

Dependency bump review — github/codeql-action e4fba86 → cdf488f

Reviewed per .claude/REVIEW.md. No findings — this bump looks clean.

Digest verification

• cdf488f595d80d6e07e03d4674febd5ab45fa938 dereferences to both the v4 and v4.37.9 annotated tags upstream, and the commit is GPG-verified (2026-08-26). The # v4 trailing comment stays accurate.
• Both init (.github/workflows/codeql-analysis.yml:50) and analyze (:56) were bumped together; grep confirms these are the only codeql-action references in the repo, so no ref is left behind on the old digest.

Upstream range: v4.37.3 → v4.37.9 (216 commits)

Changelog/commit log reviewed for regressions affecting this workflow:

Release	Change	Impact here
4.37.4	tools input can be set via the github-codeql-tools repository property (#4037)	Informational. This workflow doesn't set tools, so if the org ever sets that custom property it would now apply to this run. Advanced-setup workflow values still win when set. No action needed today.
4.37.5	Fix: a network error while streaming the bundle download no longer kills init; it falls back to download-then-extract (#4061)	Strictly a robustness improvement for CI flakiness.
4.37.6	Default remote config-file path changed to .github/codeql-config.yml (#4070)	No impact — this workflow passes no config-file input, and there is no CodeQL config file in the repo.
4.37.4 / 4.37.7 / 4.37.9	Default CodeQL bundle 2.26.2 → 2.26.3 → 2.26.4	Expected. Query-pack updates can surface new/changed alerts on the go and javascript-typescript matrix legs — that's normal scanner drift, not a regression in the action.
4.37.8	No user-facing changes	—

The remaining commits are internal refactors (Python→TypeScript changelog tooling, CLI output caching, status-report plumbing), dependabot npm/action bumps, and rebuilds. Nothing changes the inputs this workflow uses (languages, build-mode, category) or the required permissions block.

Secret / PII check

No changes in this diff add stdout, stderr, or log output. Upstream telemetry changes in the range (registry_types, job-run UUID) report registry types and a generated UUID, not credentials.

[claude]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.

Details for this dependency bump (github/codeql-action digest e4fba86 → cdf488f, both # v4):

• Both call sites (init and analyze in .github/workflows/codeql-analysis.yml) were bumped to the same digest, so the init/analyze versions stay in sync, and these are the only codeql-action references in the repo.
• The pin remains a full 40-character commit SHA (not a mutable tag), so the supply-chain posture is unchanged.
• Per .claude/REVIEW.md I attempted to review the upstream release notes/commit log for the bumped range, but network access to the upstream repo (gh api, web fetch) is not permitted in this review environment, so that range check could not be completed. A malformed/nonexistent SHA would fail loudly on the next CodeQL run rather than regress silently.

[claude]

Renovate dependency review — reviewed, looks clean ✅

Diff is 3 lines, digest-only pin updates across two workflows. No new stdout/stderr/log output, no secret or PII exposure introduced.

Digest verification

Both new digests resolve to the current tip of the moving major tags, so the trailing # v6 / # v4 comments remain accurate:

Action	Old	New	Resolves to
aws-actions/configure-aws-credentials	e6de054 (v6.2.3)	cbe3b39	v6 → v6.2.4
github/codeql-action/{init,analyze}	e4fba86 (v4.37.3)	cdf488f	v4 → v4.37.9

Both usages of codeql-action in .github/workflows/codeql-analysis.yml were bumped together — no stale digest left elsewhere in .github/.

Upstream changes in the bumped range

configure-aws-credentials v6.2.3 → v6.2.4 (compare) — bug fixes only, no behavior change for how .github/workflows/tilt-flow.yml:488 uses it:

• #1943 — allowed-account-ids handling fix, plus it masks proxy URL userinfo via core.setSecret, drops account IDs from the mismatch error message (that error is emitted before any mask exists), and rejects newline injection into the generated AWS credentials INI file. All net-positive for secret hygiene. None of the touched inputs (allowed-account-ids, use-existing-credentials, aws-profile, proxy) are set in our step.
• The same PR reworks loadCredentials() to call defaultProvider() directly instead of building a throwaway STSClient, so region/endpoint/proxy are threaded through. Our step assumes a role via OIDC (role-to-assume + audience), which doesn't go through that path.
• #1937 — skips the backoff sleep after the final retry attempt. Latency-only.

codeql-action v4.37.3 → v4.37.9 (changelog) — no breaking changes; 4.37.3 and 4.37.8 are "no user facing changes":

• Default CodeQL bundle moves 2.26.1 → 2.26.4 (via 4.37.4 / 4.37.7 / 4.37.9). Worth knowing this is the only change that can realistically alter results here — new/updated queries may surface additional alerts on go and javascript-typescript. Not a regression, just the expected consequence of a bundle bump.
• 4.37.5 fixes a real reliability bug: a network error while streaming the bundle download used to fail init outright instead of falling back to download-then-extract. Strict improvement for CI flakiness.
• 4.37.6 changes the default remote config-file path to .github/codeql-config.yml, and 4.37.4 adds the github-codeql-tools repository property for overriding tools. Neither config-file nor tools is set in our workflow, so both are no-ops for us.

CI

Analyze (javascript-typescript) already passed on the new digest; Analyze (go) and the flow tests were still running at review time. Renovate is holding the merge on renovate/stability-days (minimum release age).

No regressions found — safe to merge once checks go green.