Bump the github-actions group with 3 updates

[dependabot]

Bumps the github-actions group with 3 updates: github/codeql-action/init, github/codeql-action/analyze and github/gh-aw/actions/setup.

Updates github/codeql-action/init from 4.37.9 to 4.38.1

Release notes

Sourced from github/codeql-action/init's releases.

v4.38.1

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

v4.38.0

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.2 - 24 Sept 2026

• Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

... (truncated)

Commits

• 1c5b675 Merge pull request #4152 from github/update-v4.38.1-a65b83a73
• a97cdca Add changelog entry for #4146
• cc6c691 Update changelog for v4.38.1
• a65b83a Merge pull request #4146 from github/henrymercer/per-language-bundles-pr
• 07fa87d Clarify the latest-nightly eligibility exception
• f18f353 Describe the bundle URL resolver
• ecec9b5 Share per-language telemetry fields without renaming
• 79fe3a1 Move download telemetry into the status-report directory
• ead1f7d Rename the platform module
• 549d498 Simplify per-language platform eligibility checks
• Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.37.9 to 4.38.1

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.38.1

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

v4.38.0

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.2 - 24 Sept 2026

• Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

... (truncated)

Commits

• 1c5b675 Merge pull request #4152 from github/update-v4.38.1-a65b83a73
• a97cdca Add changelog entry for #4146
• cc6c691 Update changelog for v4.38.1
• a65b83a Merge pull request #4146 from github/henrymercer/per-language-bundles-pr
• 07fa87d Clarify the latest-nightly eligibility exception
• f18f353 Describe the bundle URL resolver
• ecec9b5 Share per-language telemetry fields without renaming
• 79fe3a1 Move download telemetry into the status-report directory
• ead1f7d Rename the platform module
• 549d498 Simplify per-language platform eligibility checks
• Additional commits viewable in compare view

Updates github/gh-aw/actions/setup from 0.87.10 to 0.89.17

Release notes

Sourced from github/gh-aw/actions/setup's releases.

v0.89.17

🌟 Release Highlights

This release focuses on hardening reliability across the AIC accounting pipeline, AWF/firewall integration, and safe-outputs handling, alongside a refreshed model catalog and several documentation clean-ups.

✨ What's New

• Faster, smarter logs auditing — cached workflow runs are no longer redownloaded during logs audits (#61871), and multi-target logs queries are now distributed fairly across targets (#61027), with per-run download duration/size tracked in an end-of-run stats summary (#60951).
• Updated model catalog — added gemini-3.8-flash and claude-fable-5.1 aliases and corrected pricing for gpt-6-astra/gpt-5.6-sol (#61234).
• MCP Gateway and firewall bumped — MCP Gateway updated to v0.4.25 (#61661) and gh-aw-firewall (AWF) updated to v0.28.20 (#61527) and v0.28.17 (#60945), improving compatibility and stability.
• Better automatic grading — native Copilot tool calls are now included in the automatic grader trace payload for more accurate evaluation (#61426).
• Refreshed CLI defaults and scanner image pins for more predictable compiled workflows (#61432).

🐛 Bug Fixes & Improvements

• Fixed Code Scanning Fixer timeouts and tool denials (#61605).
• Fixed slash command activation failing on CRLF line endings (#61602).
• Added support for older curl versions in the AWF installer (#61600).
• Rewrote experiments.<name> references in engine.model into valid job-scoped expressions, preventing invalid compiled workflows (#61599).
• Hardened withRetry against transient fetch failures (#61439).
• Fixed upload_artifact silently succeeding when relative paths were never staged (#61431).
• Fixed Copilot SDK multiword shell-prefix matching and a denial-guard hang (#61430).
• Empty add_labels lists are now treated as a no-op instead of failing the job (#61429).
• Added ability to opt out of the "[aw] Detection Runs" tracking issue independently of threat detection (#61428).
• The safeoutputs CLI transport now fails loudly instead of silently failing open, surfacing real errors sooner (#61427).
• Fixed false-positive AI credits rate-limit detection caused by MCP echoes (#61425).
• Imported engine config (including auth) is now preserved when a workflow sets a top-level model (#61424).
• PLAYWRIGHT_BROWSERS_PATH now uses ${{ runner.temp }} so install and launch agree on the browser path (#61423).
• Fixed several gaps in daily AIC (AI Credits) accounting: legacy runs (#61313), pre-harness failures (#61232), unassigned jobs (#61222), and missing evals now counted as zero instead of skipped (#60892).
• Stabilized the Daily Documentation Healer's runtime (#61235).
• AWF fatal startup errors are now surfaced in agent failure reports (#61199), and not_started execution evidence is recorded when AWF fails before the engine harness starts (#61202).
• Added the Go ecosystem to the network allowlist for ci-coach (#61201).
• Validated cached run uniqueness across JSONL shards to prevent duplicate accounting (#61220).
• Preserved agent accounting in fallback artifacts (#61053).
• Fixed a flaky pkg/cli test-unit crash from concurrent Cobra completion generation (#61146).

📚 Documentation

• Several self-healing documentation passes fixed inaccuracies found via issue analysis (#61683, #61443).
• Documented the threat-detection report-as-issue field (#61563).
• Trimmed and clarified the workflow structure, tools, and IssueOps reference docs (#61485, #61238, #60998).
• Updated the glossary from the daily scan (#61104).

Generated by 🚀 Release · copilot · auto · 18.5 AIC · ⊞ 11.6K

---

What's Changed

• Bump MCP Gateway to v0.4.25 by @​lpcox with @​Copilot in github/gh-aw#61661
• [docs] Self-healing documentation fixes from issue analysis - 2026-09-17 by @​github-actions[bot] in github/gh-aw#61683
• [log] Add debug logging to add-workflow code paths by @​github-actions[bot] in github/gh-aw#61710

... (truncated)

Changelog

Sourced from github/gh-aw/actions/setup's changelog.

Changelog

All notable changes to this project will be documented in this file.

v0.40.1 - 2026-02-03

Move from githubnext/gh-aw to github/gh-aw

If you were a former user of the githubnext Agentic Workflows you might have to re-register the extension to reflect the new location. As the gh-aw project moved from githubnext to github please delete the old channel and register the new one.

Example:

gh extension list
NAME   REPO              VERSION
gh aw  githubnext/gh-aw  v0.36.0
gh extension upgrade --all
[aw]: already up to date
gh extension remove gh-aw
gh extension install github/gh-aw
✓ Installed extension github/gh-aw
gh extension list
NAME   REPO          VERSION
gh aw  github/gh-aw  v0.40.1

Bug Fixes

Handle 502 Bad Gateway errors in assign_to_agent handler by treating them as success. The cloud gateway may return 502 errors during agent assignment, but the assignment typically succeeds despite the error. The handler now logs 502 errors for troubleshooting but does not fail the workflow.

Add discussion interaction to smoke workflows and serialize the discussion

flag in safe-outputs handler config.

Smoke workflows now select a random discussion and post thematic comments to validate discussion comment functionality. The compiler now emits the "discussion": true flag in GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG when a workflow requests discussion output, and lock files include discussions: write permission where applicable.

Add discussion interaction to smoke workflows; compiler now serializes the discussion flag into the safe-outputs handler config so workflows can post comments to discussions. Lock files include discussions: write where applicable.

Smoke workflows pick a random discussion and post a thematic comment (copilot: playful, claude: comic-book, codex: mystical oracle, opencode: space mission). This is a non-breaking tooling/workflow change.

Add discussion interaction to smoke workflows; deprecate the discussion flag and

... (truncated)

Commits

• 0045747 Avoid redownloading cached runs during logs audit (#61871)
• 9894316 chore: update planned Go, Actions, and docs dependencies (#61774)
• 886aadd Add debug logging to add-workflow code paths (#61710)
• 331bd89 docs: document edit/format commands, audit-diff tool, and fix chat-ops exampl...
• 6db2a82 Bump MCP Gateway to v0.4.25 (#61661)
• 85f8845 Fix slash command activation for CRLF line endings (#61602)
• ce450ab Support older curl versions in AWF installer (#61600)
• 7f516a8 Rewrite experiments.\<name> in engine.model to valid job-scoped expressions ...
• 02f7a69 Bump gh-aw-firewall to v0.28.20 (#61527)
• 3a6ecc5 Fix Code Scanning Fixer timeout and tool denials (#61605)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[Copilot]

Copilot review overview

🟢 Approval recommended

No unresolved review issues were identified.

Review effort: Lite
Findings: None

What changed in this PR

Updates pinned GitHub Actions dependencies for CodeQL scanning and issue-triage workflows.

Changes:

• Upgraded CodeQL init/analyze to v4.38.1.
• Upgraded gh-aw setup to v0.89.17.

File	Description
.github/​workflows/​issue-triage.lock.yml	Updates gh-aw setup pins.
.github/​workflows/​codeql.yml	Updates CodeQL action pins.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.