[efegokdemir]

Summary

Pin the CodeQL steps to immutable v4.39.1, batch CodeQL Dependabot updates weekly, and patch the vulnerable transitive undici dependency bundled in the Action.

Motivation

The workflows used CodeQL v4.38.2 and checked Actions updates monthly. npm audit also found vulnerable undici 6.29.0 under the development-only @actions/core dependency tree; the published Action uses the checked-in bundle, so the bundle needs rebuilding with the patched version.

Changes

• Pin init, analyze and upload-sarif to commit 9b3254085494b55a0f7c4c2b3d2d52cc712ce370 (v4.39.1).
• Run GitHub Actions dependency updates weekly and group github/codeql-action/*. The npm update policy remains monthly.
• Update the lockfile to undici 6.29.1 and rebuild dist/action/index.js.

Tests performed

Passed: npm ci --ignore-scripts, npm run build, npm test, npm run coverage, npm run lint, npm run package:check, npm run package:smoke, npm run action:check, both full and production npm audit, npm run format:check, actionlint, and YAML/Dependabot configuration checks.

Compatibility

No CLI, report, public API, or Action input/output contract changed. The Node.js engine floor and CI matrix remain unchanged.

Security and privacy

The audit finding is cleared by the patched transitive dependency and rebuilt Action bundle. No credentials, telemetry, Shopify network calls, or unsafe shell interpolation were added.

Shopify source/evidence

N/A.

Release impact

This is an unreleased workflow and bundled dependency maintenance change. The package version remains 0.7.0; no tag or npm publish is part of this PR.

Checklist

• The change is focused and the docs/examples match the implementation.
• Relevant regression tests and checks are recorded above.
• The generated Action distribution is up to date.
• No sensitive or unlicensed third-party material was added.