Update github/codeql-action action to v4 (#11)

renovate[bot] · web-flow · commit a3995de7315c · 2025-10-22T12:00:14.000+02:00
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [github/codeql-action](https://redirect.github.com/github/codeql-action) | action | major | `v3.30.2` -> `v4.30.9` | --- ### Release Notes <details> <summary>github/codeql-action (github/codeql-action)</summary> ### [`v4.30.9`](https://redirect.github.com/github/codeql-action/releases/tag/v4.30.9) [Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.30.8...v4.30.9) ### CodeQL Action Changelog See the [releases page](https://redirect.github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. #### 4.30.9 - 17 Oct 2025 - Update default CodeQL bundle version to 2.23.3. [#&#8203;3205](https://redirect.github.com/github/codeql-action/pull/3205) - Experimental: A new `setup-codeql` action has been added which is similar to `init`, except it only installs the CodeQL CLI and does not initialize a database. Do not use this in production as it is part of an internal experiment and subject to change at any time. [#&#8203;3204](https://redirect.github.com/github/codeql-action/pull/3204) See the full [CHANGELOG.md](https://redirect.github.com/github/codeql-action/blob/v4.30.9/CHANGELOG.md) for more information. ### [`v4.30.8`](https://redirect.github.com/github/codeql-action/releases/tag/v4.30.8) [Compare Source](https://redirect.github.com/github/codeql-action/compare/v4.30.7...v4.30.8) ### CodeQL Action Changelog See the [releases page](https://redirect.github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. #### 4.30.8 - 10 Oct 2025 No user facing changes. See the full [CHANGELOG.md](https://redirect.github.com/github/codeql-action/blob/v4.30.8/CHANGELOG.md) for more information. ### [`v4.30.7`](https://redirect.github.com/github/codeql-action/releases/tag/v4.30.7) [Compare Source](https://redirect.github.com/github/codeql-action/compare/v3.30.9...v4.30.7) ##### CodeQL Action Changelog See the [releases page](https://redirect.github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. ##### 4.30.7 - 06 Oct 2025 - \[v4+ only] The CodeQL Action now runs on Node.js v24. [#&#8203;3169](https://redirect.github.com/github/codeql-action/pull/3169) See the full [CHANGELOG.md](https://redirect.github.com/github/codeql-action/blob/v4.30.7/CHANGELOG.md) for more information. ### [`v3.30.9`](https://redirect.github.com/github/codeql-action/compare/v3.30.8...v3.30.9) [Compare Source](https://redirect.github.com/github/codeql-action/compare/v3.30.8...v3.30.9) ### [`v3.30.8`](https://redirect.github.com/github/codeql-action/releases/tag/v3.30.8) [Compare Source](https://redirect.github.com/github/codeql-action/compare/v3.30.7...v3.30.8) ##### CodeQL Action Changelog See the [releases page](https://redirect.github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. ##### 3.30.8 - 10 Oct 2025 No user facing changes. See the full [CHANGELOG.md](https://redirect.github.com/github/codeql-action/blob/v3.30.8/CHANGELOG.md) for more information. ### [`v3.30.7`](https://redirect.github.com/github/codeql-action/releases/tag/v3.30.7) [Compare Source](https://redirect.github.com/github/codeql-action/compare/v3.30.6...v3.30.7) ##### CodeQL Action Changelog See the [releases page](https://redirect.github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. ##### 3.30.7 - 06 Oct 2025 No user facing changes. See the full [CHANGELOG.md](https://redirect.github.com/github/codeql-action/blob/v3.30.7/CHANGELOG.md) for more information. ### [`v3.30.6`](https://redirect.github.com/github/codeql-action/releases/tag/v3.30.6) [Compare Source](https://redirect.github.com/github/codeql-action/compare/v3.30.5...v3.30.6) ##### CodeQL Action Changelog See the [releases page](https://redirect.github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. ##### 3.30.6 - 02 Oct 2025 - Update default CodeQL bundle version to 2.23.2. [#&#8203;3168](https://redirect.github.com/github/codeql-action/pull/3168) See the full [CHANGELOG.md](https://redirect.github.com/github/codeql-action/blob/v3.30.6/CHANGELOG.md) for more information. ### [`v3.30.5`](https://redirect.github.com/github/codeql-action/releases/tag/v3.30.5) [Compare Source](https://redirect.github.com/github/codeql-action/compare/v3.30.4...v3.30.5) ##### CodeQL Action Changelog See the [releases page](https://redirect.github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. ##### 3.30.5 - 26 Sep 2025 - We fixed a bug that was introduced in `3.30.4` with `upload-sarif` which resulted in files without a `.sarif` extension not getting uploaded. [#&#8203;3160](https://redirect.github.com/github/codeql-action/pull/3160) See the full [CHANGELOG.md](https://redirect.github.com/github/codeql-action/blob/v3.30.5/CHANGELOG.md) for more information. ### [`v3.30.4`](https://redirect.github.com/github/codeql-action/releases/tag/v3.30.4) [Compare Source](https://redirect.github.com/github/codeql-action/compare/v3.30.3...v3.30.4) ### CodeQL Action Changelog See the [releases page](https://redirect.github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. #### 3.30.4 - 25 Sep 2025 - We have improved the CodeQL Action's ability to validate that the workflow it is used in does not use different versions of the CodeQL Action for different workflow steps. Mixing different versions of the CodeQL Action in the same workflow is unsupported and can lead to unpredictable results. A warning will now be emitted from the `codeql-action/init` step if different versions of the CodeQL Action are detected in the workflow file. Additionally, an error will now be thrown by the other CodeQL Action steps if they load a configuration file that was generated by a different version of the `codeql-action/init` step. [#&#8203;3099](https://redirect.github.com/github/codeql-action/pull/3099) and [#&#8203;3100](https://redirect.github.com/github/codeql-action/pull/3100) - We added support for reducing the size of dependency caches for Java analyses, which will reduce cache usage and speed up workflows. This will be enabled automatically at a later time. [#&#8203;3107](https://redirect.github.com/github/codeql-action/pull/3107) - You can now run the latest CodeQL nightly bundle by passing `tools: nightly` to the `init` action. In general, the nightly bundle is unstable and we only recommend running it when directed by GitHub staff. [#&#8203;3130](https://redirect.github.com/github/codeql-action/pull/3130) - Update default CodeQL bundle version to 2.23.1. [#&#8203;3118](https://redirect.github.com/github/codeql-action/pull/3118) See the full [CHANGELOG.md](https://redirect.github.com/github/codeql-action/blob/v3.30.4/CHANGELOG.md) for more information. ### [`v3.30.3`](https://redirect.github.com/github/codeql-action/releases/tag/v3.30.3) [Compare Source](https://redirect.github.com/github/codeql-action/compare/v3.30.2...v3.30.3) ##### CodeQL Action Changelog See the [releases page](https://redirect.github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. ##### 3.30.3 - 10 Sep 2025 No user facing changes. See the full [CHANGELOG.md](https://redirect.github.com/github/codeql-action/blob/v3.30.3/CHANGELOG.md) for more information. </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/open-telemetry/sig-profiling).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
diff --git a/.github/workflows/ossf-scorecard.yml b/.github/workflows/ossf-scorecard.yml
@@ -42,6 +42,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@d3678e237b9c32a6c9bffb3315c335f976f3549f # v3.30.2
+        uses: github/codeql-action/upload-sarif@16140ae1a102900babc80a33c44059580f687047 # v4.30.9
         with:
           sarif_file: results.sarif
