ci: bump github/codeql-action from 4.37.7 to 4.37.8

[dependabot]

Bumps github/codeql-action from 4.37.7 to 4.37.8.

Release notes

Sourced from github/codeql-action's releases.

v4.37.8

No user facing changes.

Changelog

Sourced from github/codeql-action's changelog.

4.37.8 - 21 Aug 2026

No user facing changes.

Commits

• db488dd Merge pull request #4102 from github/update-v4.37.8-9ee088e13
• 1845f5b Update changelog for v4.37.8
• 9ee088e Merge pull request #4080 from github/henrymercer/studious-giggle
• 1aef003 Address review feedback on overlay disk flags
• 508b83b Merge main into overlay minimum disk feature branch
• d97b342 Merge pull request #4098 from github/mbg/permission-error-as-configuration-error
• 47fa622 Make EACCES a ConfigurationError
• 45693cc Refactor ENOSPC check into isDiskConfigurationError function
• c2fd8f5 Merge pull request #4081 from github/mario-campos/version-cache-to-disk
• c56f48e Log unexpected conditions during caching CLI output
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: ci. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[helebest]

Automated Review — Step 1: Code Review

Change: Bumps github/codeql-action from v4.37.7 → v4.37.8 (patch) in .github/workflows/codeql.yml, updating both the init and analyze action refs consistently.

• Consistency: ✅ PR description matches the diff exactly — a single-line version bump applied identically to both action references (init and analyze).
• Correctness: ✅ No logic changes; this is a pinned-version bump for a first-party GitHub Action (CI tooling only, not an application dependency).
• Conventions: ✅ Follows the repo's existing pattern of pinning codeql-action by exact version tag.
• Security: ✅ Reviewed upstream changelog (github/codeql-action 4.37.8, 21 Aug 2026) — "No user facing changes." No CVEs or breaking changes noted between 4.37.7 and 4.37.8.
• Effectiveness: ✅ Achieves the stated purpose (keeps CodeQL action current).
• Test coverage: N/A — workflow-only change with no functional/application code touched; no test cases are applicable.

Step 2: Regression Verification

Ran the workspace test suite (uv sync && uv run pytest) against the PR branch. Test collection fails with ModuleNotFoundError for dikw_converter_epub, dikw_converter_example, and pytest_httpx (mineru). Verified this is pre-existing on main as well (same errors, same packages) — unrelated to this PR's diff, which touches only .github/workflows/codeql.yml. No regression introduced by this change.

Proceeding to Step 3 (CI monitoring).

---

Generated by Claude Code

[helebest]

Step 3: CI Monitoring

All checks completed successfully:

• test (3.12) — success
• test (3.13) — success
• analyze — success
• CodeQL — success

PR is mergeable (clean), no conflicts.

Step 4: Merge

All review, regression, and CI checks passed. Proceeding with squash merge.

---

Generated by Claude Code