build: update security Actions and public contracts

[dependabot]

Summary

• update every CodeQL Action step to v4.37.4 with an immutable pin
• update OpenSSF Scorecard to v2.4.4 with an immutable pin
• refresh REST and MCP public contract counts
• validate local .github files during pull request checks
• keep stale count detection aligned with the current MCP contract

Validation

• GITHUB_TOKEN=$(gh auth token) node scripts/check-public-contract.mjs
• git diff --check

The public contract check covers all 19 public Xquik-dev repositories.

Note

Update security GitHub Actions versions and public contract counts

• Updates github/codeql-action from v4.37.2 to v4.37.4 in both codeql.yml and scorecard.yml, and bumps ossf/scorecard-action from v2.4.3 to v2.4.4.
• Updates public contract counts in profile/README.md: REST API operations 127→128, MCP catalog routes 119→120, MCP responses 118→119.
• Updates the stale copy detection regex in check-public-contract.mjs to match 119 catalog routes and adds local filesystem reads for the .github repo instead of fetching over HTTP.

^{Macroscope summarized 7d46db1.}

Summary by CodeRabbit

• Chores

  • Updated pinned security and code analysis workflow actions to newer versions.
  • Improved validation of public contract metadata and local workflow file checks.

• Documentation

  • Updated published API and MCP operation counts to reflect the latest available routes and operations.

[coderabbitai]

📝 Walkthrough

Walkthrough

The pull request updates pinned GitHub Actions, refreshes public REST and MCP contract counts, and changes the contract checker to read local .github files directly.

Changes

Workflow and public contract updates

Layer / File(s)	Summary
Update pinned workflow actions .github/workflows/codeql.yml, .github/workflows/scorecard.yml	The workflows use CodeQL action v4.37.4 and Scorecard action v2.4.4.
Synchronize public contract counts and checks profile/README.md, scripts/check-public-contract.mjs	The documented counts and stale-copy detection use the updated contract values. The checker reads local .github files from the filesystem.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• Xquik-dev/.github#11: Updates the pinned CodeQL action version in the CodeQL workflow.
• Xquik-dev/.github#13: Updates the pinned Scorecard action version in the Scorecard workflow.

Suggested reviewers: furkanerday, kriptoburak

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the security action updates and public contract changes in the pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dependabot/github_actions/github/codeql-action/upload-sarif-4.37.3

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/scorecard.yml:
- Line 44: Align the CodeQL action version with the PR objective: if upgrading
from v4.37.2 to v4.37.3, replace the upload-sarif pin in both workflows with
commit e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81; otherwise update the objective
and related version references to v4.37.4.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 22d97a9e-85dd-4438-b531-b99839e91a60

📥 Commits

Reviewing files that changed from the base of the PR and between 4e8233b and 7d46db1.

📒 Files selected for processing (4)

• .github/workflows/codeql.yml
• .github/workflows/scorecard.yml
• profile/README.md
• scripts/check-public-contract.mjs

[kriptoburak]

Audited and validated. This consolidates the current stable CodeQL and Scorecard pins, synchronizes public contract counts, and makes the contract checker validate the PR workspace. The contract check passes across all 19 public repositories.

[furkanerday]

Reviewed the complete current diff, public-contract changes, workflow permissions, immutable Action pins, PR conversation, resolved thread, required checks, repository policies, and DCO trailers. The CodeQL and Scorecard SHAs match the stated upstream releases, least-privilege and security-upload gates remain intact, the live OpenAPI/MCP counts agree with the contract check, and the exact independence notice remains unchanged. All required checks are green and no actionable thread remains.