fix(ci): relock github/codeql-action at v4.38.2 so codeql.yml starts

[hyperpolymath]

Why

#103 bumped codeql.yml to github/codeql-action@v4.38.2, but .github/workflows/actions.lock (the native Actions lockfile, which dependabot does not update) still pinned v4.38.0. Since merge 97ffa9d every codeql.yml run on main is a startup_failure with the annotation Invalid lockfile: .github/workflows/actions.lock#L1 (run 37046729552), i.e. jobs=0 and no check-run at all. The parent 9a1067a ran green on 2026-10-01.

What

Regenerated the lock entry with the authoritative tool:

gh actions-lock .github/workflows/codeql.yml

• github/codeql-action@v4.38.0 → @v4.38.2 (2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2)
• the tool also pruned nine SHA-keyed dependency entries (actions/cache, actions/checkout@3d3c…, actions/upload-artifact@043f…, denoland/setup-deno, dtolnay/rust-toolchain, editorconfig-checker, erlef/setup-beam, ossf/scorecard-action, webfactory/ssh-agent) that no workflows: list, no workflow file and no transitive uses: edge references. Measured before accepting: 0 references each; the new lock is transitively closed (9 entries, 3 edges, 0 unresolved) and gh actions-lock --no-fix --json reports valid: true.

No workflow file changes.

Verification after merge

The first codeql.yml run on the merge SHA must not be startup_failure (actions/runs?head_sha=<merge>).

🤖 Generated with Claude Code

https://claude.ai/code/session_01F1dMuLprAVdZyYPLwZ4t8q

Deferred red checks (non-required; standing ruling 2026-09-15)

• Deferred: governance / Allowlist Preflight — red on base 97ffa9d (and on 9a1067a before it) → Deferred red checks on dependabot PR #103 #104
• Deferred: governance / Workflow security linter — red on base 97ffa9d (and on 9a1067a before it) → Deferred red checks on dependabot PR #103 #104

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• .github/workflows/actions.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: b230b932-7139-4d80-af48-59d10a929627

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Pull request is closed - (🔄 Check again to try again)

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Autopilot could not be updated. Open Coding to check access and billing.