Bump the github-actions group with 4 updates

.github/workflows/codeql.yml

@@ -87,7 +87,7 @@ jobs:
       # rather than watching a compiler. Written here rather than left to a
       # default so that a change of default is a change to this file.
       - name: Initialise the analysis
-        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           languages: rust
           build-mode: none
@@ -111,7 +111,7 @@ jobs:
       # So the condition below excludes the fork and nothing else. What the fork
       # half rests on is not measured here and stays a claim.
       - name: Analyse
-        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           output: ${{ env.SARIF_DIR }}
           upload: never
@@ -141,7 +141,7 @@ jobs:
       # a verdict that was already made, and hides no finding.
       - name: Upload the findings to the code-scanning tab
         if: always() && ((github.event_name == 'push' && github.ref == 'refs/heads/main') || github.event.pull_request.head.repo.full_name == github.repository)
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: ${{ env.SARIF_DIR }}/rust.sarif
           category: /language:rust

.github/workflows/scorecard.yml

@@ -97,7 +97,7 @@ jobs:
 
       # Surface the findings in the code-scanning tab, alongside CodeQL and zizmor.
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: results.sarif
           category: scorecard

.github/workflows/shared-hygiene.yml

@@ -47,6 +47,6 @@ permissions:
 
 jobs:
   hygiene:
-    uses: iderex/wache/.github/workflows/pr-hygiene.yml@113085b269d3437a3f96ff9e7060b64b0af88ab1 # v1.2.0
+    uses: iderex/wache/.github/workflows/pr-hygiene.yml@4d91113f744527d4dd6397bb09fb276ef18b09fc # v1.3.0
     with:
       subject_names_issue: false

.github/workflows/shell-analysis.yml

@@ -103,7 +103,7 @@ jobs:
       # finding.
       - name: Upload the findings to the code-scanning tab
         if: always() && ((github.event_name == 'push' && github.ref == 'refs/heads/main') || github.event.pull_request.head.repo.full_name == github.repository)
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: ${{ env.SARIF }}
           category: shellcheck

.github/workflows/zizmor.yml

@@ -89,7 +89,7 @@ jobs:
         # skip the "Fail on actionable findings" step below.
         if: (github.event_name == 'push' && github.ref == 'refs/heads/main') || (github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.user.login != 'dependabot[bot]')
         continue-on-error: true
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: results.sarif
           category: zizmor