[actions] Update GitHub Actions versions - 2026-09-25

[github-actions]

GitHub Actions Updates - 2026-09-25

This PR updates GitHub Actions versions in .github/aw/actions-lock.json to their latest compatible releases.

📦 Actions Updated (full list)

Actions Updated

• github/codeql-action/upload-sarif: v4.38.1 → v4.38.2
• ruby/setup-ruby: v1.326.0 → v1.327.0

Summary

• Total actions updated: 2
• Update command: gh aw update
• Workflow lock files: Not included (will be regenerated on next compile)

Notes

• All action updates respect semantic versioning and maintain compatibility
• Actions are pinned to commit SHAs for security
• Workflow .lock.yml files are excluded from this PR and will be regenerated during the next compilation
• Two actions (actions/gh-drives-preview/checkout and actions/gh-drives-preview/commit) could not be checked because the upstream repository has no releases or tags; this is a pre-existing condition unrelated to this update
• The update run also detected SHA/version mismatches for several other already-pinned actions (actions-ecosystem/action-add-labels, actions/github-script, actions/upload-code-coverage, anchore/sbom-action, haskell-actions/setup, safedep/pmg) during post-update validation; these were not part of this update's changes and are left untouched pending separate investigation

Testing

The updated actions will be automatically used in workflow compilations. No manual testing required.

---

This PR was automatically created by the Daily Workflow Updater workflow.

Generated by 🔧 Daily Workflow Updater · copilot · auto · 25 AIC · ⌖ 7.7 AIC · ⊞ 7.8K · ◷

• expires on Sep 25, 2026, 11:11 PM UTC-08:00

---

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 40.6 AIC · ⌖ 8.3 AIC · ⊞ 9.2K · ◷
_{Comment /souschef to run again}

---

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 20.4 AIC · ⌖ 8.92 AIC · ⊞ 9.2K · ◷
_{Comment /souschef to run again}

[gh-aw-bot]

@copilot There is still forward progress needed on this PR.

• Please refresh the branch if needed and then run the pr-finisher skill after reviewing the current head and any pending maintainer follow-ups.
• A branch refresh was requested from sous-chef for this run: https://github.com/github/gh-aw/actions/runs/36110171020

Generated by 👨🍳 PR Sous Chef
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 40.6 AIC · ⌖ 8.3 AIC · ⊞ 9.2K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot There is still forward progress needed on this PR.

• Please refresh the branch if needed and then run the pr-finisher skill after reviewing the current head and any pending maintainer foll...

Ran the pr-finisher pass on the current head.

• Branch refresh — not needed: the branch is 0 commits behind origin/main (1 ahead).
• Changes pushed — the action-lock update was not fully propagated. Synced .github/aw/actions-lock.json into the generated pkg/actionpins/data/action_pins.json and pkg/workflow/data/action_pins.json, and recompiled the three affected lock files (daily-malicious-code-scan, daily-semgrep-scan, smoke-claude) so github/codeql-action/upload-sarif@v4.38.2 is actually used.
• Checks (local) — make fmt, make lint, and make agent-report-progress (impacted unit tests + lock-file sync check) all pass.
• Checks (CI) — ❓ stale: agent pushes do not trigger workflows, so CI needs a maintainer re-trigger (close/reopen, workflow_dispatch, or a maintainer push) before merge.
• Reviews — no unresolved review threads.

No gh pr merge was run. Ready for human review and a CI re-trigger.

[gh-aw-bot]

@copilot Please review the current PR state, address any unresolved feedback or failing checks, refresh the branch if needed, and continue with the pr-finisher skill.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 24.8 AIC · ⌖ 8.56 AIC · ⊞ 9.2K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot Please review the current PR state, address any unresolved feedback or failing checks, refresh the branch if needed, and continue with the pr-finisher skill.

Generated by [👨‍🍳 PR...

Completed another pr-finisher pass on head 4934caf. No new changes were required.

• Branch refresh — not needed: 0 commits behind origin/main (2 ahead).
• Reviews — ✅ no reviews and no unresolved review threads on the PR.
• Checks (CI) — ❓ not failing. All seven runs on this branch (CGO, CWI, Content Moderation, AI Moderator, Agentic Commands) concluded action_required, i.e. they are queued awaiting maintainer approval rather than reporting a failure. There are no failing logs to root-cause.
• Checks (local) — ✅ re-verified: make recompile produces no diff, so all 298 lock files are in sync with their markdown sources and with the updated action pins. make fmt / make lint / impacted unit tests passed in the prior pass on this same head and nothing has changed since.
• Mergeable — ✅ open, not draft, no conflicts, working tree clean with nothing unpushed.

Hand-off: the CI runs need a maintainer to approve the pending workflow runs (the action_required state) — this is not something the agent can trigger. The pre-existing items already noted in the PR description (unreleased actions/gh-drives-preview/* actions, and SHA/version mismatches for other pinned actions) remain out of scope; there is no build target that gates on them.

No gh pr merge was run.

[gh-aw-bot]

@copilot The branch looks clean, but the pending action_required workflow runs still need maintainer approval. Please summarize any remaining maintainer-only cleanup and continue with the pr-finisher skill if anything changed.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 21.3 AIC · ⌖ 8.5 AIC · ⊞ 9.6K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot The branch looks clean, but the pending action_required workflow runs still need maintainer approval. Please summarize any remaining maintainer-only cleanup and continue with the `pr-finish...

Re-ran the pr-finisher pass. Nothing changed since the last one, so no new commit was pushed.

Verified unchanged at head 4934caf:

• Branch: 0 behind / 2 ahead of origin/main; working tree clean, nothing unpushed.
• Reviews: no reviews, no review threads.
• Diff scope confirmed minimal — 6 files, and the only actions-lock.json entries touched are the two intended ones (github/codeql-action/upload-sarif, ruby/setup-ruby).
• CI: unchanged. CGO and CWI sit at action_required on the current head; Content Moderation, AI Moderator, and Agentic Commands are action_required on the older dbf68a8. No failures anywhere.

Remaining maintainer-only cleanup:

1. Approve the pending workflow runs. mergeable_state is blocked because the five action_required runs have never been allowed to start. A maintainer must approve them from the PR checks panel. Note that the three runs still pinned to dbf68a8 predate my sync commit — approving them alone would validate a stale head, so re-running CI against 4934caf (close/reopen or workflow_dispatch) is the cleaner path.
2. Review approval. gh-aw-bot is the requested reviewer and no review has been submitted; this also contributes to the blocked state.
3. Pre-existing pin mismatches (separate PR, not a blocker here). The SHA/version mismatches flagged during the original update run are untouched by this PR. Several are internal repos the updater cannot resolve (actions/upload-code-coverage, actions/gh-drives-preview/*, the latter pinned to main with no releases/tags). No build or lint target gates on them, so they do not block this merge — they need a maintainer to decide whether to re-pin or leave as-is.

No gh pr merge was run. Everything actionable from the agent side is complete.