GeezerVison

Backport of #27531 to release/v7.6.7

Triggered by Aditya Patwardhan (@adityapatwardhan) on behalf of @app/dependabot

Original CL Label: CL-BuildPackaging

/cc @PowerShell/powershell-maintainers

Impact

REQUIRED: Choose either Tooling Impact or Customer Impact (or both). At least one checkbox must be selected.

Tooling Impact

• Required tooling change
• Optional tooling change (include reasoning)

Updates the pinned github/codeql-action dependency used by the CodeQL analysis and scorecards workflows so the release branch uses the approved action revision.

Customer Impact

• Customer reported
• Found internally

Regression

REQUIRED: Check exactly one box.

• Yes
• No

This is not a regression.

Testing

The original Dependabot change updates the pinned github/codeql-action SHA in the CodeQL analysis and scorecards workflows. The backport was verified by comparing the resolved staged diff with the original PR diff and confirming that all three action references use the intended SHA with no remaining conflict markers. CI will provide release-branch workflow validation.

Risk

REQUIRED: Check exactly one box.

• High
• Medium
• Low

High risk because this changes security-analysis CI workflow dependencies used by CodeQL and scorecards. The change is narrowly scoped to three pinned action references, preserves the release-branch workflow structure, and exactly matches the SHA selected by the merged original PR.

Merge Conflicts

Conflicts occurred in .github/workflows/analyze-reusable.yml and .github/workflows/scorecards.yml because the release branch pinned an older CodeQL action SHA than master. Resolved by preserving the release-branch workflow structure and replacing only the three CodeQL action SHAs with the SHA from PR #27531. The resolved staged diff was compared with the original PR diff, and both files were checked for remaining conflict markers.