chore(deps): bump the actions group with 3 updates

[dependabot]

Bumps the actions group with 3 updates: github/codeql-action/init, github/codeql-action/analyze and askalf/truecopy-action.

Updates github/codeql-action/init from 4.37.4 to 4.37.6

Release notes

Sourced from github/codeql-action/init's releases.

v4.37.6

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

v4.37.5

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

• Cache CodeQL CLI version information across Actions steps. #3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
• Update default CodeQL bundle version to 2.25.6. #3948

... (truncated)

Commits

• 5595cca Merge pull request #4071 from github/update-v4.37.6-6a9359a1b
• ec9c757 Add change note for PR 4070
• 45c8742 Update changelog for v4.37.6
• 6a9359a Merge pull request #4070 from github/mbg/remote-address/change-file-default
• 065cdc0 Change DEFAULT_CONFIG_FILE_NAME
• f99dd5a Merge pull request #4066 from github/dependabot/npm_and_yarn/js-yaml-5.2.2
• 1804b21 Merge pull request #4068 from github/mergeback/v4.37.5-to-main-d1ba80a1
• 3020a2f Rebuild
• 93c3a5a Update changelog and version after v4.37.5
• d1ba80a Merge pull request #4067 from github/update-v4.37.5-1cd4d01d5
• Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.37.4 to 4.37.6

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.37.6

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

v4.37.5

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

• Cache CodeQL CLI version information across Actions steps. #3943
• Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
• Update default CodeQL bundle version to 2.25.6. #3948

... (truncated)

Commits

• 5595cca Merge pull request #4071 from github/update-v4.37.6-6a9359a1b
• ec9c757 Add change note for PR 4070
• 45c8742 Update changelog for v4.37.6
• 6a9359a Merge pull request #4070 from github/mbg/remote-address/change-file-default
• 065cdc0 Change DEFAULT_CONFIG_FILE_NAME
• f99dd5a Merge pull request #4066 from github/dependabot/npm_and_yarn/js-yaml-5.2.2
• 1804b21 Merge pull request #4068 from github/mergeback/v4.37.5-to-main-d1ba80a1
• 3020a2f Rebuild
• 93c3a5a Update changelog and version after v4.37.5
• d1ba80a Merge pull request #4067 from github/update-v4.37.5-1cd4d01d5
• Additional commits viewable in compare view

Updates askalf/truecopy-action from 1.0.1 to 1.0.3

Release notes

Sourced from askalf/truecopy-action's releases.

v1.0.3 — redstamp PowerShell array-form bypass fix, propagated

Changed

• Default truecopy-ref moved v0.10.1 → v0.10.3. truecopy 0.10.3 carries its redstamp dependency forward, 0.7.3 → 0.7.5: a proven bypass of redstamp's deterministic black gate via PowerShell's -ArgumentList array form ('-ExecutionPolicy','Bypass',...), which scored green while the equivalent space-separated command correctly scored black askalf/redstamp#124 command completed, the space-separated form was blocked, same box, same PID, 7 minutes apart. Since redstamp is the engine every verify/scan call in this action runs through, a consumer pinned to the old default could miss a skill or MCP server using that evasion shape.

No input contract change — a tag, branch, or SHA all still work the same way.

Upgrading

Nothing to change. askalf/truecopy-action@v1 now resolves here.

v1.0.2 — npm v12 compatibility, transitively

Ships six commits that had been sitting on master unreleased — including both halves of the npm v12 fix. Anyone pinning @v1 has been getting the pre-#13 action since 2026-07-12.

Fixed — npm v12 compatibility

npm v12 blocks git dependencies by default. This action installed truecopy over git, so once runners move to npm 12 it would have failed at the install step for every consumer.

• #15 — install from truecopy's signed release tarball for release refs (v0.9.0+), falling back to git for branches and bare SHAs, with --allow-git added on npm ≥ 12. No breaking change: every existing truecopy-ref still resolves. Also adds opt-in verify-attestation, which runs gh attestation verify --owner askalf and refuses to install on failure.
• #13 — default truecopy-ref moved off v0.8.0, which was two minors behind the scanner.
• #16 — default is now v0.10.1, and that specific version matters: truecopy 0.10.0 still declares @askalf/redstamp as a git dependency, so installing 0.10.0 from a tarball only moves the git dep one level down and npm 12 still refuses. 0.10.1 is the first release that is git-dep-free transitively.

Other

• #10 — OpenSSF Scorecard badge points at api.scorecard.dev
• #11, #12 — grouped GitHub Actions dependency bumps

Upgrading

... (truncated)

Changelog

Sourced from askalf/truecopy-action's changelog.

Changelog

All notable changes to truecopy-action are documented here. The action follows the moving-major-tag convention: pin @v1 to track patches, or @<full-sha> for an airtight supply chain.

Unreleased

[1.0.3]

Changed

• Default truecopy-ref moved v0.10.1 → v0.10.3. truecopy 0.10.3 carries its redstamp dependency forward, 0.7.3 → 0.7.5: a proven bypass of redstamp's deterministic black gate via PowerShell's -ArgumentList array form ('-ExecutionPolicy','Bypass',...askalf/redstamp#124verify/scan call in this action runs through, a consumer on the old default could miss a skill or MCP server using that evasion shape. No input contract change — a tag, branch, or SHA all still work the same way.

(The entry below was left over from before v1.0.0 shipped — corrected here since it still claimed the default was v0.8.0, three releases stale.)

Changed (v1.0.0)

• Renamed canon-action → truecopy-action, tracking the canon → truecopy rename. The old askalf/canon-action name still resolves via GitHub's rename redirect; the canon-ref input is now truecopy-ref.

Fixed (v1.0.0)

• canon.lock back-compat now works from the action. The action previously always passed --lock truecopy.lock, which defeated truecopy's built-in fallback to a pre-rename canon.lock — a repo pinned before the rename would fail the gate looking for a file it never had. The lock input now defaults to empty and only passes --lock when set to a non-default path, so truecopy resolves truecopy.lock → canon.lock itself.

Added (v1.0.0)

• SECURITY.md, CONTRIBUTING.md, CODE_OF_CONDUCT.md.
• OpenSSF Scorecard + CodeQL workflows (pinned by SHA) and a Scorecard badge.
• Dependabot (github-actions) to keep the pinned actions/checkout SHA fresh.
• This changelog.

0.1.0 — 2026-07-04

Added

• Initial release: composite action wrapping the engine (then canon). verify gates the lock for drift / poisoning / publisher trust; scan poison-scans manifests, skill directories, or a cloned marketplace repo. Zero third-party action dependencies; the engine is installed at the ref you pin.

Commits

• f9492ab chore: default truecopy-ref v0.10.1 -> v0.10.3 (#18)
• 03f331f chore(deps): bump the actions group with 2 updates (#17)
• f6d7baa fix: default to truecopy v0.10.1, the first transitively git-dep-free release...
• 4413bbd fix: install from the signed tarball, not a git dep npm 12 blocks (#15)
• 29dd3be fix: default truecopy-ref to v0.10.0, not a two-minor-old scanner (#13)
• 504a978 chore(deps): bump the actions group with 3 updates (#12)
• dfc4f1c chore(deps): bump the actions group with 3 updates (#11)
• 8b57af9 docs: point OpenSSF Scorecard badge at api.scorecard.dev (#10)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[sprayberry-reviewer]

Deterministic approval — no LLM reviewed this diff.

Classified low-risk: non-major dependency bump by dependabot[bot] (2 file(s)).

This repository requires an approving review before auto-merge can proceed, so this
approval exists to satisfy that gate without spending a full Code Reviewer execution
on a diff whose risk is provable from the file list alone. This approval satisfies ONLY
the review requirement — the merge still separately requires green CI, which this sweep
does not and cannot short-circuit.

Anything outside the docs allowlist, any major dependency bump, any non-Dependabot
dependency change, and any unknown diff keep the full reviewer path.