chore: update github-actions #338

	name: CodeQL

	# Static analysis via GitHub's CodeQL. Runs on every push to main, on
	# every PR targeting main, and weekly to pick up new query updates from
	# the GitHub Security Lab against unchanged code.
	#
	# Replaces the GitHub-managed "Default setup" — same analysis (Go +
	# Actions, default query suite, remote threat model) but committed as
	# a workflow so we get:
	# - concurrency cancellation (a fresh push cancels in-flight runs)
	# - SHA-pinned actions (Renovate-tracked, satisfies Scorecard's
	# Pinned-Dependencies and SAST checks)
	# - explicit path filtering (skip dev/ and test/ noise)

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]
	schedule:
	- cron: "23 5 * * 1"

	permissions: {}

	concurrency:
	group: codeql-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	analyze:
	name: Analyze (${{ matrix.language }})
	runs-on: ubuntu-latest
	timeout-minutes: 30
	permissions:
	security-events: write # upload SARIF
	packages: read # read deps from GHCR if any
	contents: read
	strategy:
	fail-fast: false
	matrix:
	language: [actions, go]
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
	- uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
	if: matrix.language == 'go'
	with:
	go-version-file: go.mod

	- uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4
	with:
	languages: ${{ matrix.language }}
	config-file: ./.github/codeql/codeql-config.yml

	- uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4
	with:
	category: "/language:${{ matrix.language }}"

Provide feedback