Update github/codeql-action action to v4.38.0 (main)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
github/codeql-action	action	minor	v4.37.9 → v4.38.0

---

Release Notes

github/codeql-action (github/codeql-action)

v4.38.0

Compare Source

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #​4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #​4072
• Update default CodeQL bundle version to 2.27.0. #​4129

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 79722a43-0fc3-4a8e-9f47-c22eae76a8cf

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:54 AM UTC · Completed 3:04 AM UTC

Commit: cd01138 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $4.73

[github-actions]

🚀 Preview is available at https://c695f4be.enterprise-contract.pages.dev

[fullsend-ai-review]

Review

Mechanical Renovate bump of github/codeql-action/upload-sarif from v4.37.9 to v4.38.0 in .github/workflows/scorecards.yml. The new SHA b96794f015dfd88f77b49b1c93e0fa7110f94c63 was independently verified against the upstream github/codeql-action v4.38.0 annotated tag (tag object 4bd7200e1f146b1c937cae12d258b50f41a53cf8 dereferences to that commit). Pinning style (<SHA> # <version-tag>) is consistent with the rest of the workflow.

Findings

Info

• [protected-path] .github/workflows/scorecards.yml — Change modifies a protected path (.github/). Authorization is inferred from renovate.json (which extends github>conforma/.github//config/renovate/renovate.json), which authorizes automated GitHub Actions version bumps. Human approval is still required for protected-path changes regardless of context.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 4:44 AM UTC · Completed 4:49 AM UTC

Commit: cd01138 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $2.49

[fullsend-ai-retro]

Retro summary — PR #568 (Renovate: codeql-action v4.37.9 → v4.38.0)

Outcome: Review agent successfully verified a 1-line SHA bump in .github/workflows/scorecards.yml, emitted a single informational protected-path finding, and the PR auto-merged ~1h40m after review completion. The mechanical work was correct; the concern is cost/effort proportionality.

Key data

• Review run: conforma/.fullsend actions/runs/34922893816 — opus, effort=high, $4.73, 11 min wall-clock, 61 top-level tool notices, 14 sub-agent dispatches, resolved from fullsend-ai/agents@v0.41.0.
• Diff scope: 1 file, +1/-1 line. The review agent orchestrator itself acknowledged "trivial mechanical Renovate PR" mid-run yet still dispatched correctness / security / style / docs-currency / intent-coherence / challenger / risk-assessment sub-agents; all but challenger returned empty findings.
• Two internal iterations on the same commit (cd01138): iter 1 $2.25 / 26 turns / 3m37s; iter 2 $2.49 / 31 turns / 4m27s. Iter 2 re-read the same skill files loaded by iter 1 and re-ran the same gh api repos/github/codeql-action/git/ref/tags/v4.38.0 SHA verification that iter 1 already completed. No new commits arrived between iterations.
• Sonnet fallback failure: claude-sonnet-4-5@20250929 is not available on your vertex deployment fired three times against the risk-assessment sub-agent; it fell back with "sub-agent failed - proceeding without risk score" and the review comment surfaced it as a Note.
• Recent Renovate PRs on this repo show the same cost floor: 🚨 Update dependency toml to v5 (main) #565 $4.20, Update conforma/github-workflows digest to 837d70f (main) #554 $4.91, Update github actions (main) (patch) #545 $4.42 — every mechanical bump is landing in the $4–$5 range on opus/high.

No new proposals filed — this ground is already thoroughly covered

Every angle this run surfaced maps to an existing open issue. Filing new issues would be duplicate noise. The corroborating evidence:

Scope-aware model / effort routing for trivial bot PRs

• fullsend-ai/fullsend#6891 — pre-flight scope heuristic to adjust review effort/model
• fullsend-ai/fullsend#5777 — route model tier by diff complexity, not just author type
• fullsend-ai/fullsend#2842 — cheaper model for trivial bot-authored PRs
• fullsend-ai/fullsend#4177, #4060, #1358, #2639 — fast-paths for automated dependency updates
• fullsend-ai/agents#497, #301, #257 — scope-classified sub-agent downgrade / lightweight review path / pre-review early exit

Sub-agent over-dispatch on version bumps (matches this run exactly)

• fullsend-ai/agents#204 — first-run sub-agent over-dispatch on a version bump; reinforces agents#152. New data point from this run: the orchestrator explicitly classified the PR as trivial mechanical and still fanned out all specialist sub-agents, so the classification signal is being generated but not enforced on dispatch.

Sonnet-4-5 Vertex availability failure inflating cost

• fullsend-ai/fullsend#6666 — stale sonnet model mapping causes ~5x cost inflation via opus fallback. New data point: on this run the fallback path silently degraded the risk-assessment sub-agent to "no risk score" rather than escalating to opus, so the failure mode isn't only cost — it can also drop coverage. Worth adding to that issue.

Cross-iteration redundancy

• fullsend-ai/agents#140 / #252 cover sub-agent file re-reads (partially resolved by PR Update the rego-antora-extension dep #172). This run additionally shows the orchestrator itself re-running a gh api SHA verification and re-loading skill files across its two internal iterations on an unchanged commit — a variant that's adjacent but not identical to Add .tool-versions file #140. If PR Update the rego-antora-extension dep #172's caching doesn't extend to orchestrator-level iterations on the same commit, that's worth noting on Add .tool-versions file #140 or Bump wrangler from 3.50.0 to 3.51.2 #252.

Autonomy note

The PR carried the requires-manual-review label yet was auto-merged by Renovate ~2 hours after opening with no human review recorded. The review agent's SHA-against-upstream-tag verification was the strongest signal in the pipeline, and it landed before merge. That's a reasonable place to grant more explicit autonomy for the github-actions minor/patch bump with SHA verified against upstream tag case — but the mechanism for that already lives inside the fast-path proposals above.