GeezerVison

Backport of #27531 to release/v7.5.12

Triggered by Aditya Patwardhan (@adityapatwardhan) on behalf of @app/dependabot

Original CL Label: CL-BuildPackaging

/cc @PowerShell/powershell-maintainers

Impact

REQUIRED: Choose either Tooling Impact or Customer Impact (or both). At least one checkbox must be selected.

Tooling Impact

• Required tooling change
• Optional tooling change (include reasoning)

Optional CI tooling update that brings the reviewed CodeQL action release to the 7.5 release branch while retaining immutable commit pinning.

Customer Impact

• Customer reported
• Found internally

Regression

REQUIRED: Check exactly one box.

• Yes
• No

This is not a regression.

Testing

The conflicts were resolved by applying the same action SHA used in the merged 7.4 backport. The final diff passes git diff --check, has no conflict markers, leaves a clean worktree, and was reviewed to confirm only the three intended CodeQL action references changed.

Risk

REQUIRED: Check exactly one box.

• High
• Medium
• Low

Medium risk because this updates the pinned CodeQL action used for security analysis. The resolution changes only three action references, matches the merged 7.4 backport, and preserves exact commit pinning.

Merge Conflicts

Conflicts occurred in .github/workflows/analyze-reusable.yml and .github/workflows/scorecards.yml because release/v7.5.12 pinned an older CodeQL action commit than the original PR's base. Resolved by updating only the init, analyze, and upload-sarif references to the incoming reviewed SHA, matching the already merged 7.4 backport while preserving the release workflow structure.