ci(codeql): synchronize actions at 4.37.5

[aparragithub]

Closes #169

Summary

• Updates CodeQL initialization and analysis to the same official v4.37.5 commit pin.
• Prevents independently updated CodeQL actions from producing incompatible workflow configurations.

Changes

File	Change
.github/workflows/codeql.yml	Pins both init and analyze to the official v4.37.5 SHA.

Test Plan

• git diff --check HEAD^ HEAD
• Parsed the workflow with PyYAML 6.0.3
• Verified both CodeQL actions use the same official v4.37.5 SHA
• Verified the annotated upstream tag resolves to the pinned commit
• Completed the four-lens receipt-driven review and pre-PR gate

Contributor Checklist

• Linked open approved issue Sync CodeQL actions to 4.37.5 #169
• Workflow validation completed
• Documentation not required; behavior is unchanged
• Conventional commit format
• No Co-Authored-By trailers

Summary by CodeRabbit

• Chores
  • Updated security scanning workflows to newer CodeQL action versions.
  • Workflow settings and behavior remain unchanged.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 2d4d70f9-c66a-4a87-8048-423221ace50c

📥 Commits

Reviewing files that changed from the base of the PR and between 167d3e6 and b2f3f65.

📒 Files selected for processing (1)

• .github/workflows/codeql.yml

---

📝 Walkthrough

Walkthrough

The CodeQL workflow updates its initialization and analysis actions from v4.37.3 to v4.37.5. Both actions use pinned commit hashes. No other workflow settings change.

Changes

CodeQL action synchronization

Layer / File(s)	Summary
Update CodeQL action pins .github/workflows/codeql.yml	The initialization and analysis actions use the v4.37.5 commit pins. Other workflow settings remain unchanged.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• aparragithub/odoo-forge#73: Updates the pinned CodeQL initialization and analysis actions.
• aparragithub/odoo-forge#148: Updates the pinned CodeQL action version in the same workflow.
• aparragithub/odoo-forge#153: Updates both CodeQL references to v4.37.5 with a pinned commit.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the CI change and the synchronized CodeQL action version.
Linked Issues check	✅ Passed	Both CodeQL actions were updated to the synchronized official v4.37.5 pin without workflow or dependency changes.
Out of Scope Changes check	✅ Passed	The changes are limited to the two CodeQL action references required by issue #169.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/sync-codeql-4.37.5

---

_{Comment @coderabbitai help to get the list of available commands.}