fix(security): keep every CodeQL Action phase on one revision

[seonghobae]

Problem

Dependabot opened separate updates for CodeQL init, autobuild, analyze, and upload-sarif. Merging those pull requests independently would create an unreviewed mixed CodeQL lifecycle and could leave SARIF publishers on a different implementation revision. The split PR comments also mislabeled a newer SHA as v4.37.0.

Test-first evidence

RED head 4c6bd0828afb1cf6869d8658f43f5b7f334cbbf7 added only services/analysis-engine/tests/test_codeql_action_revision_contract.py. Against protected develop, both focused contracts failed because all CodeQL phases still resolved to v4.37.0 rather than the expected reviewed v4.37.6 SHA.

Current exact head: 8aced19e82b1aefad54b370e2986de700ef4d75b.

The implementation now:

• pins every init, autobuild, analyze, and upload-sarif reference to CodeQL Action v4.37.6 commit 5595ccaf912efad79be6eef63a5619ff05969be3;
• keeps the analysis lifecycle atomic and corrects every version annotation;
• preserves workflow triggers, permissions, language selection, build behavior, SARIF paths, and failure handling;
• adds a permanent repository-wide revision contract;
• records the threat model, update/rollback procedure, Mermaid data flow, and APA 7 primary-source references in docs/doctoring/codeql-action-atomic-revision.md; and
• updates CHANGELOG.md under Unreleased.

The focused contract is GREEN in an independently reconstructed exact-file test run (2 passed). GitHub-hosted exact-head CI, security, supply-chain, central review, and branch-protection evidence remain authoritative and must complete before Ready or merge.

Supersession

After this coordinated PR is exact-head green and review-complete, it supersedes split Dependabot PRs #764, #766, #767, and #768. Their predecessor-head checks and reviews are not transferable.

Merge gate

Keep Draft until full repository CI/security/supply-chain checks succeed on this exact head, CodeRabbit/OpenCode/Noema and a qualifying independent non-author approval are current, all actionable threads are resolved, and branch protection permits merge without bypass.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 63ac868f-c8ac-41d1-955b-17745ee0d88f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

/oc Refetch the live pull request and abort without writing unless its exact head is 7c9343aede26a44239b12c805fdd0ab0b1398dba on branch fix/codeql-action-consistency-v4-37-6. Exact-head CI run 31170110007, job 92839810936, is the authoritative RED evidence: the Rust/Tauri gate passed; quickcheck reached Ruff after all documentation, security-pattern, supply-chain, bootstrap, frontend workspace lint, and docstring gates passed; the only quality failure is I001 for the import block in services/analysis-engine/tests/test_codeql_action_revision_contract.py. Apply the formatter-derived minimum repair only: from services/analysis-engine, run the repository-pinned uv run ruff check tests/test_codeql_action_revision_contract.py --select I --fix, inspect the diff, and commit only Ruff's canonical import-block ordering. Do not hand-guess another style, change the test behavior, CodeQL SHA/version contract, workflows, dependencies, lockfiles, doctoring, release metadata, or unrelated files. Run the focused Ruff check and the two CodeQL contract tests first, then the complete exact-head quickcheck, CI, Rust/Tauri, package/release, SBOM, Security Scan, SAST, and git diff --check. The known two high-severity JavaScript findings belong to atomic baseline PR #783 and must not be papered over here. Do not create another branch, PR, one-shot/self-modifying workflow, patch artifact, or encoded patch. Keep Draft until the new exact head is fully green, current-head actionable threads are zero, #783 has established the protected dependency baseline or this branch is rebased onto it, and a qualifying independent non-author approval exists.