[actions] Update GitHub Actions versions - 2026-09-20

[github-actions]

GitHub Actions Updates - 2026-09-20

This PR updates GitHub Actions versions in .github/aw/actions-lock.json to their latest compatible releases.

📦 Actions Updated (full list)

Actions Updated

• github/codeql-action/upload-sarif: v4.38.0 → v4.38.1

Summary

• Total actions updated: 1
• Update command: gh aw update
• Workflow lock files: Not included (will be regenerated on next compile)

Notes

• All action updates respect semantic versioning and maintain compatibility
• Actions are pinned to commit SHAs for security
• Workflow .lock.yml files are excluded from this PR and will be regenerated during the next compilation

Testing

The updated actions will be automatically used in workflow compilations. No manual testing required.

---

This PR was automatically created by the Daily Workflow Updater workflow.

Generated by 🔧 Daily Workflow Updater · copilot · auto · 21.7 AIC · ⌖ 8.06 AIC · ⊞ 7.8K · ◷

• expires on Sep 20, 2026, 11:05 PM UTC-08:00

---

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 22.1 AIC · ⊞ 9.6K · ◷
_{Comment /souschef to run again}

---

Run: https://github.com/github/gh-aw/actions/runs/35505738412

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 21.5 AIC · ⊞ 9.6K · ◷
_{Comment /souschef to run again}

[gh-aw-bot]

@copilot This PR still needs forward progress before a maintainer can merge it.

Please refresh the branch if needed, verify the dependency-update change and checks, and then run the pr-finisher skill before handing back to maintainers.

Run: https://github.com/github/gh-aw/actions/runs/35496676349

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 22.1 AIC · ⊞ 9.6K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot This PR still needs forward progress before a maintainer can merge it.

Please refresh the branch if needed, verify the dependency-update change and checks, and then run the pr-finisher ski...

Completed in f46e6c4: confirmed the branch already contains the current main, verified the v4.38.1 action SHA, regenerated embedded pins and the three affected workflow locks, and passed local format, lint, test, compile, and secret checks. Final code review found no issues; CodeQL timed out and requires CI/human re-trigger verification.

[gh-aw-bot]

@copilot This PR still needs forward progress before a maintainer can merge it.

Please refresh the branch if needed, summarize the current verification state, and run the pr-finisher skill before handing the PR back to maintainers.

Run: https://github.com/github/gh-aw/actions/runs/35502046922

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 22.5 AIC · ⊞ 9.6K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot This PR still needs forward progress before a maintainer can merge it.

Please refresh the branch if needed, summarize the current verification state, and run the pr-finisher skill before h...

Re-ran pr-finisher on f46e6c4. The branch remains current with main and clean; formatting, lint, impacted unit tests, the full short test suite, and recompilation of all 299 workflows pass. The Sous Chef run completed all 10 jobs successfully; its blocked github.com request was a non-failing firewall warning unrelated to this dependency update. Current-head CWI/CGO records are policy-gated (action_required) with zero jobs and no failure logs. No additional code changes are needed; maintainer approval/check re-trigger remains.

[gh-aw-bot]

@copilot The branch and validation look complete. Please summarize the remaining blocker precisely for maintainers (for example required approval or gated workflow state), avoid another no-op refresh, and use the pr-finisher skill only if there is new actionable change.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• github.com
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"
    - "registry.npmjs.org"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 32.3 AIC · ⊞ 9.6K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot The branch and validation look complete. Please summarize the remaining blocker precisely for maintainers (for example required approval or gated workflow state), avoid another no-op refresh,...

No code change or branch refresh is needed. GitHub reports the PR as blocked: gh-aw-bot is still the requested reviewer and no review has been submitted. In addition, current-head CWI and CGO are action_required; both created zero jobs and have no failure logs, so a maintainer must authorize those gated workflow runs. The latest Sous Chef run succeeded, the branch is clean/current, and prior local validation is complete.

[github-actions]

Thanks for the automated update! This PR looks great — the GitHub Actions versions are pinned correctly and aligned with the project's dependency maintenance workflow.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by ✅ Contribution Check · copilot · auto · 66.9 AIC · ⌖ 8.38 AIC · ⊞ 9.2K · ◷