From 62e0c9ea1eda2467882dee40a29358dd31dcd397 Mon Sep 17 00:00:00 2001
From: alderpath <alderpath@proton.me>
Date: Fri, 13 Nov 2026 23:58:52 +0000
Subject: [PATCH] chore(ci): bump codeql-action to 4.39.3 and action-gh-release
 to 3.0.4

Pins verified against the upstream tags (annotated tag deref):
  github/codeql-action v4.39.3 -> 33d7b85 (init/analyze/upload-sarif move
  together; bumping analyze alone leaves CodeQL inconsistent, the failure
  Dependabot PRs #36/#37/#39 would have caused if merged piecemeal)
  softprops/action-gh-release v3.0.4 -> 8a0cd65

Supersedes #36 #37 #38 #39 so the three codeql refs land as one unit.
---
 .github/workflows/codeql-analysis.yml | 4 ++--
 .github/workflows/release.yml         | 2 +-
 .github/workflows/scorecard.yml       | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index eb93a9d..d531573 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -27,12 +27,12 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - uses: actions-rust-lang/setup-rust-toolchain@a188e68d0fd2bd36ad51dccb2b07ba6e75105f30  # v2.0.1
       - name: initialize CodeQL
-        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370  # v4.39.1
+        uses: github/codeql-action/init@33d7b85da1a04171e211befe2c739303b9a4c066  # v4.39.3
         with:
           languages: ${{ matrix.language }}
       - name: build
         run: cargo build --workspace
       - name: perform CodeQL analysis
-        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370  # v4.39.1
+        uses: github/codeql-action/analyze@33d7b85da1a04171e211befe2c739303b9a4c066  # v4.39.3
         with:
           category: /language:${{ matrix.language }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d8b0040..f12d2b8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -177,7 +177,7 @@ jobs:
             (cd "$(dirname "$f")" && sha256sum "$(basename "$f")")
           done > artifacts/SHA256SUMS
           cat artifacts/SHA256SUMS
-      - uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64  # v3.0.3
+      - uses: softprops/action-gh-release@8a0cd651e5b2365bd640854a3fa5dfc70e4875f3  # v3.0.4
         with:
           files: |
             artifacts/**/*.tar.gz
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 3ec6207..25f87c1 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -31,6 +31,6 @@ jobs:
           name: SARIF
           path: results.sarif
           retention-days: 5
-      - uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370  # v4.39.1
+      - uses: github/codeql-action/upload-sarif@33d7b85da1a04171e211befe2c739303b9a4c066  # v4.39.3
         with:
           sarif_file: results.sarif