From ccd18c069f021fa3f5d79dc1848630fd8333d269 Mon Sep 17 00:00:00 2001
From: Mateusz Lewandowski <matlew2003@gmail.com>
Date: Tue, 6 Oct 2026 12:14:57 +0200
Subject: [PATCH] chore(ci): update CodeQL actions together to 4.38.2

---
 .github/workflows/ci.yml     | 2 +-
 .github/workflows/codeql.yml | 4 ++--
 scripts/validate_ci.py       | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 24b07c1..6ae4c62 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -126,7 +126,7 @@ jobs:
         run: cat .ai/reports/agent-plan.md >> "$GITHUB_STEP_SUMMARY"
       - name: Upload SARIF to GitHub code scanning
         if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
-        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
         with:
           sarif_file: .ai/reports/ai-dev.sarif
 
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index a860b88..a49213c 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -20,9 +20,9 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4
+      - uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
         with:
           languages: python
           build-mode: none
           queries: security-extended
-      - uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4
+      - uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
diff --git a/scripts/validate_ci.py b/scripts/validate_ci.py
index 99be359..0ca74be 100644
--- a/scripts/validate_ci.py
+++ b/scripts/validate_ci.py
@@ -61,7 +61,7 @@
 REQUIRED_AGENT_REPORT_TOKENS = [
     "security-events: write",
     "persist-credentials: false",
-    "github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63",
+    "github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2",
     "github.event.pull_request.head.repo.full_name == github.repository",
 ]