[actions] Update GitHub Actions versions - 2026-09-20

[github-actions]

GitHub Actions Updates - 2026-09-20

This PR updates GitHub Actions versions in .github/aw/actions-lock.json to their latest compatible releases.

📦 Actions Updated (full list)

Actions Updated

• github/codeql-action/upload-sarif: v4.38.0 → v4.38.1

Summary

• Total actions updated: 1
• Update command: gh aw update
• Workflow lock files: Not included (will be regenerated on next compile)

Notes

• All action updates respect semantic versioning and maintain compatibility
• Actions are pinned to commit SHAs for security
• Workflow .lock.yml files are excluded from this PR and will be regenerated during the next compilation

Testing

The updated actions will be automatically used in workflow compilations. No manual testing required.

---

This PR was automatically created by the Daily Workflow Updater workflow.

Generated by 🔧 Daily Workflow Updater · copilot · auto · 21.7 AIC · ⌖ 8.06 AIC · ⊞ 7.8K · ◷

• expires on Sep 20, 2026, 11:05 PM UTC-08:00

---

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 22.1 AIC · ⊞ 9.6K · ◷
_{Comment /souschef to run again}

---

Run: https://github.com/github/gh-aw/actions/runs/35505738412

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 21.5 AIC · ⊞ 9.6K · ◷
_{Comment /souschef to run again}

---

Run: https://github.com/github/gh-aw/actions/runs/35516088659

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 18.8 AIC · ⊞ 9.6K · ◷
_{Comment /souschef to run again}

[gh-aw-bot]

@copilot This PR still needs forward progress before a maintainer can merge it.

Please refresh the branch if needed, verify the dependency-update change and checks, and then run the pr-finisher skill before handing back to maintainers.

Run: https://github.com/github/gh-aw/actions/runs/35496676349

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 22.1 AIC · ⊞ 9.6K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot This PR still needs forward progress before a maintainer can merge it.

Please refresh the branch if needed, verify the dependency-update change and checks, and then run the pr-finisher ski...

Completed in f46e6c4: confirmed the branch already contains the current main, verified the v4.38.1 action SHA, regenerated embedded pins and the three affected workflow locks, and passed local format, lint, test, compile, and secret checks. Final code review found no issues; CodeQL timed out and requires CI/human re-trigger verification.

[gh-aw-bot]

@copilot This PR still needs forward progress before a maintainer can merge it.

Please refresh the branch if needed, summarize the current verification state, and run the pr-finisher skill before handing the PR back to maintainers.

Run: https://github.com/github/gh-aw/actions/runs/35502046922

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 22.5 AIC · ⊞ 9.6K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot This PR still needs forward progress before a maintainer can merge it.

Please refresh the branch if needed, summarize the current verification state, and run the pr-finisher skill before h...

Re-ran pr-finisher on f46e6c4. The branch remains current with main and clean; formatting, lint, impacted unit tests, the full short test suite, and recompilation of all 299 workflows pass. The Sous Chef run completed all 10 jobs successfully; its blocked github.com request was a non-failing firewall warning unrelated to this dependency update. Current-head CWI/CGO records are policy-gated (action_required) with zero jobs and no failure logs. No additional code changes are needed; maintainer approval/check re-trigger remains.

[gh-aw-bot]

@copilot The branch and validation look complete. Please summarize the remaining blocker precisely for maintainers (for example required approval or gated workflow state), avoid another no-op refresh, and use the pr-finisher skill only if there is new actionable change.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• github.com
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"
    - "registry.npmjs.org"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 32.3 AIC · ⊞ 9.6K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot The branch and validation look complete. Please summarize the remaining blocker precisely for maintainers (for example required approval or gated workflow state), avoid another no-op refresh,...

No code change or branch refresh is needed. GitHub reports the PR as blocked: gh-aw-bot is still the requested reviewer and no review has been submitted. In addition, current-head CWI and CGO are action_required; both created zero jobs and have no failure logs, so a maintainer must authorize those gated workflow runs. The latest Sous Chef run succeeded, the branch is clean/current, and prior local validation is complete.

[github-actions]

Thanks for the automated update! This PR looks great — the GitHub Actions versions are pinned correctly and aligned with the project's dependency maintenance workflow.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by ✅ Contribution Check · copilot · auto · 66.9 AIC · ⌖ 8.38 AIC · ⊞ 9.2K · ◷

[gh-aw-bot]

@copilot Please refresh this PR for maintainer review: update the branch if needed, address any remaining review feedback or failed checks, and run the pr-finisher skill before handing back. Run: https://github.com/github/gh-aw/actions/runs/35516088659

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 18.8 AIC · ⊞ 9.6K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot Please refresh this PR for maintainer review: update the branch if needed, address any remaining review feedback or failed checks, and run the pr-finisher skill before handing back. Run: ht...

Ran pr-finisher on the unchanged f46e6c4 head. The branch is clean, two commits ahead of—and not behind—current main; there are no review threads or submitted reviews. The latest Sous Chef run passed all 10 jobs. CWI and CGO remain action_required, each with zero jobs and no failure logs, so they require maintainer authorization rather than a code fix. GitHub still reports the PR as blocked because gh-aw-bot is the requested reviewer and has not approved. Prior local format, lint, test, and 299-workflow compilation results remain valid for this unchanged head.

[gh-aw-bot]

@copilot This PR appears blocked only on maintainer review rather than code or branch work. Please summarize the current ready-to-merge verification state for maintainers and only run pr-finisher again if there is new actionable change. Run: https://github.com/github/gh-aw/actions/runs/35520322593

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 29.7 AIC · ⊞ 9.6K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot This PR appears blocked only on maintainer review rather than code or branch work. Please summarize the current ready-to-merge verification state for maintainers and only run pr-finisher ag...

Ready for maintainer review on f46e6c4: the working tree is clean; the dependency pin, embedded datasets, and affected workflow locks are synchronized; prior format, lint, full short tests, secret scan, and compilation of all 299 workflows passed. There are no review threads. The latest Sous Chef run passed all 10 jobs. The only remaining gates are human: gh-aw-bot is still the requested reviewer, and CWI/CGO remain action_required with zero jobs and no failure logs. No new actionable change exists, so pr-finisher was not rerun.

[gh-aw-bot]

@copilot This PR appears blocked only on maintainer review rather than code or branch work. Please summarize the current ready-to-merge verification state for maintainers and only run pr-finisher again if there is new actionable change.

Run: https://github.com/github/gh-aw/actions/runs/35523489687

Generated by 👨‍🍳 PR Sous Chef · pi · gpt54 · 23.6 AIC · ⊞ 9.6K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot This PR appears blocked only on maintainer review rather than code or branch work. Please summarize the current ready-to-merge verification state for maintainers and only run pr-finisher ag...

Ready for maintainer review on unchanged f46e6c4: the branch and working tree are clean; dependency pins and generated workflow locks are synchronized; format, lint, full short tests, secret scanning, and all 299 workflow compilations passed; and no review threads remain. The latest Sous Chef run succeeded. GitHub still marks the PR blocked because gh-aw-bot approval is outstanding, while CWI/CGO remain authorization-gated (action_required, zero jobs, no failure logs). No new actionable code or branch work exists, so pr-finisher was not rerun.