chore(ci): consolidate immutable CodeQL action pins

[seonghobae]

Purpose

Consolidate three overlapping dependency updates into one current-main, test-first supply-chain change for the repository's manual CodeQL marker workflow.

Test-first history

• Exact protected base: 44ea2827947d7cdde0063488f8da2ca50a373459.
• RED contract commit: 496474275cb3fdb8f8a54dee02a4767acdb0b8f8.
• Current exact head: d890ddb71f931a2a8d07d1260caea8086e6fd0c3.

The permanent test was committed before the workflow implementation. It requires the reviewed full-length action pins and checkout credential boundary and fails against the protected-base workflow.

Change

• pin actions/checkout v7.0.1 to 3d3c42e5aac5ba805825da76410c181273ba90b1;
• set persist-credentials: false on the checkout step;
• pin both github/codeql-action/init and the disabled documentation-only analyze marker to v4.37.6 commit 5595ccaf912efad79be6eef63a5619ff05969be3;
• preserve manual dispatch, read-only permissions, default/central SARIF ownership, and the disabled analyze step;
• add a permanent regression contract, authoritative doctoring with APA 7 references, and an Unreleased changelog entry.

The official v4.37.6 tag resolves exactly to the pinned CodeQL commit. No tag, branch, reviewer identity, credential name, security threshold, or branch protection is changed.

Supersession

This current-main replacement fully supersedes:

• [Superseded] Bump actions/checkout from 7.0.0 to 7.0.1 #111 — checkout v7.0.1 and persist-credentials: false;
• [Superseded] Bump github/codeql-action/init from 4.37.0 to 4.37.5 #133 — CodeQL init update; and
• [Superseded] Bump github/codeql-action/analyze from 4.37.0 to 4.37.4 #134 — CodeQL analyze update.

Those predecessor PRs should be closed after this replacement is confirmed to carry their complete valid scope. No predecessor-head check or approval is reused.

Exact-head merge gate

Merge only after the exact current head passes the complete repository tests, all required security and policy checks, current-head automated review, zero unresolved actionable threads, and a qualifying independent non-last-pusher approval. Pending, queued, skipped-required, cancelled, absent, failed, stale-head, status-only, or author-only evidence is not success.

Summary by CodeRabbit

• 보안 개선

  • 코드 분석 자동화 도구를 검증된 버전으로 업데이트했습니다.
  • 소스 저장소 인증 정보가 불필요하게 유지되지 않도록 보안을 강화했습니다.
  • 자동화 구성의 무결성을 확인하는 보안 검증을 추가했습니다.

• 문서

  • 자동화 보안 설정과 검증·복구 절차를 문서화했습니다.
  • 관련 변경 사항을 변경 기록에 반영했습니다.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 22 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 518926bc-45a1-4dde-8d9d-d55f15ef2f40

📥 Commits

Reviewing files that changed from the base of the PR and between b78f050 and b5f731b.

📒 Files selected for processing (1)

• tests/test_codeql_workflow_security.py

📝 Walkthrough

Walkthrough

CodeQL 워크플로의 checkout 및 CodeQL 액션을 불변 커밋으로 갱신했습니다. checkout 자격 증명 지속을 비활성화했습니다. 보안 계약 테스트와 운영 문서를 추가했습니다.

Changes

CodeQL 워크플로 보안

Layer / File(s)	Summary
워크플로 액션 핀 갱신 .github/workflows/codeql.yml, CHANGELOG.md	checkout 및 CodeQL 액션 참조를 지정된 커밋으로 갱신했습니다. persist-credentials: false를 추가했습니다. 변경 사항을 changelog에 기록했습니다.
보안 계약 및 검증 docs/doctoring/codeql-action-pin-consolidation.md, tests/test_codeql_workflow_security.py	액션 핀, 롤백 규칙, 검증 절차를 문서화했습니다. SHA, 버전 주석, 자격 증명 설정, init·analyze 사용 횟수를 검증하는 테스트를 추가했습니다.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• Replay focused central improvements after #731 restores the baseline .github#742 — CodeQL 워크플로 액션 핀과 보안 테스트를 직접 갱신하므로 관련성이 높습니다.

Possibly related PRs

• ContextualWisdomLab/ContextualWisdomLab.github.io#111 — 동일한 checkout 업그레이드와 persist-credentials: false 변경을 포함합니다.
• ContextualWisdomLab/ContextualWisdomLab.github.io#133 — 동일한 CodeQL init 참조를 v4.37.6으로 갱신합니다.

Suggested labels: dependencies, github_actions

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 불변 CodeQL 액션 핀 통합이라는 변경의 주요 목적을 정확하고 간결하게 설명합니다.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/consolidate-codeql-v4-37-6

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent review

Please review exact current head d890ddb71f931a2a8d07d1260caea8086e6fd0c3. This consolidated PR supersedes #111, #133, and #134; those duplicates are being closed rather than competing for the same workflow file. Exact-head SAST Semgrep and Security Scan have completed successfully and CodeRabbit status is success. Please evaluate the current head independently; do not reuse predecessor-head approvals or checks.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/test_codeql_workflow_security.py`:
- Around line 21-36: Update the security workflow test around the existing
checkout and CodeQL assertions to parse the YAML and select the checkout, init,
and analyze steps structurally. Compare each step’s uses value directly against
its expected SHA, assert checkout’s with.persist-credentials is boolean false,
and assert analyze retains its if: ${{ false }} condition and the workflow’s
read-only permissions.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0eb7730e-a6a3-40f8-817c-0782e2ad907a

📥 Commits

Reviewing files that changed from the base of the PR and between 312e452 and b78f050.

📒 Files selected for processing (4)

• .github/workflows/codeql.yml
• CHANGELOG.md
• docs/doctoring/codeql-action-pin-consolidation.md
• tests/test_codeql_workflow_security.py

[seonghobae]

@opencode-agent review-only request for exact current head b5f731bd3873104e2477ffbe128342e7fcaedd1d. Please inspect the complete current diff and repository policy, including the structurally scoped CodeQL workflow security regression added for the resolved review finding. Do not mutate the branch, change ready state, merge, or bypass protection. Submit a formal current-head verdict only; predecessor-head evidence does not transfer.