Marc-André Bombeck 290ce3441a Bump every codeql-action reference together ...

Dependabot treats `init`, `analyze` and `upload-sarif` as separate
dependencies, so it raised `init` to 4.37.7 in one PR and left `analyze` on
4.37.6 in the same workflow. The action refuses that pairing outright:
"Loaded a configuration file for version '4.37.7', but running version
'4.37.6'", and the CodeQL job failed on the very PR doing the bump.

All five pinned references move together here: init and analyze in
codeql.yml, and the three upload-sarif steps in scorecard.yml and trivy.yml.
The commit SHA is the one the v4.37.7 tag dereferences to, which is also the
SHA both Dependabot PRs pin.

2026-08-16 17:58:49 +02:00

..

ISSUE_TEMPLATE

feat(integrations): remove the moodLog integration

2026-07-25 11:36:18 +02:00

workflows

Bump every codeql-action reference together

2026-08-16 17:58:49 +02:00

dependabot.yml

chore(github): expand dependabot to GitHub Actions + Docker

2026-05-10 15:23:17 +02:00

FUNDING.yml

docs: README presentation polish + community-file gaps

2026-06-05 03:01:36 +02:00

PULL_REQUEST_TEMPLATE.md

docs: PR template targets main — the develop branch was retired

2026-07-14 10:36:25 +02:00