GeezerVison

Backport of #27531 to release/v7.4.21

Triggered by Aditya Patwardhan (@adityapatwardhan) on behalf of @app/dependabot

Original CL Label: CL-BuildPackaging

/cc @PowerShell/powershell-maintainers

Impact

REQUIRED: Choose either Tooling Impact or Customer Impact (or both). At least one checkbox must be selected.

Tooling Impact

• Required tooling change
• Optional tooling change (include reasoning)

Updates the CodeQL init, analyze, and SARIF upload actions used by release-branch security analysis to the approved 4.36.0 revision.

Customer Impact

• Customer reported
• Found internally

Regression

REQUIRED: Check exactly one box.

• Yes
• No

This is not a regression.

Testing

Validated with git diff --check and reviewed the final commit diff: exactly three CodeQL action references (init, analyze, and upload-sarif) move to the intended pinned revision. Workflow execution will be validated by backport CI.

Risk

REQUIRED: Check exactly one box.

• High
• Medium
• Low

High risk under repository guidance because this changes security-analysis workflow infrastructure. Scope is limited to pinned CodeQL action revisions already merged and exercised on master.

Merge Conflicts

Both workflow files conflicted because release/v7.4.21 carried older pinned CodeQL revisions and the dependency chain also requires the setup-dotnet update from #27539. The #27539 backport commit was stacked first. Conflicts were resolved by preserving each release workflow's structure and replacing only the three CodeQL action SHAs with the incoming #27531 revision; final diff confirms no unrelated changes.