chore: consolidate Dependabot updates and group codeql-action

[EONRaider]

Summary

Supersedes all six open Dependabot PRs — #198, #199, #204, #205, #206, #207 — and fixes the reason two of them could never go green.

Dependabot tracks github/codeql-action/init, /analyze and /upload-sarif as three separate dependencies, so it opened one PR per sub-action. analyze refuses a config file written by a different init release. From #204's Analyze (python) job:

##[error]Loaded a configuration file for version '4.37.9', but running version '4.38.1'

#206 fails the same way in reverse. Neither could merge on its own, so the bump was stuck until both landed together.

What's included

• github/codeql-action/{init,analyze,upload-sarif} 4.37.9 → 4.38.1 (1c5b675…). Covers ci: bump github/codeql-action/analyze from 4.37.9 to 4.38.1 #204, ci: bump github/codeql-action/init from 4.37.9 to 4.38.1 #206 and ci: bump github/codeql-action/upload-sarif from 4.37.9 to 4.38.1 #207.
• astral-sh/setup-uv 10.0.1 → 10.2.0 (c18668a…) in all 11 steps. Covers ci: bump astral-sh/setup-uv from 10.0.1 to 10.2.0 #205.
• hypothesis 6.167.1 → 6.168.0 and ruff 0.16.6 → 0.16.7 (chore: bump the dev-dependencies group with 2 updates #198), plus mutmut 3.7.0 → 3.8.0 (chore: bump mutmut from 3.7.0 to 3.8.0 #199). uv.lock was regenerated with uv lock --upgrade-package. Every sha256 added matches the union of the Dependabot lockfile diffs, with nothing extra.
• .github/dependabot.yml: new codeql-action group (github/codeql-action*) under github-actions, so future bumps arrive as one PR.
• tests/test_workflows.py: new TestCodeQLActionVersionLockstep. It fails the ordinary test job and names the mismatched steps whenever github/codeql-action/* steps across all workflows are pinned to more than one commit. It also asserts that codeql.yml's init and analyze steps are both found, so it can't pass on zero matches. A synthetic split-bump case shows the check can fail. Run against ci: bump github/codeql-action/analyze from 4.37.9 to 4.38.1 #204's exact split state, it fails with pinned to 2 different commits: {'cdf488f…': ['codeql.yml: init'], '1c5b675…': ['codeql.yml: analyze', 'scorecard.yml: upload-sarif']}.
• CHANGELOG.md entry under ## [Unreleased].

Verification

• uv run ruff check and uv run ruff format --check are clean (ruff 0.16.7)
• uv run mypy is clean (strict)
• uv run pytest passes locally (1164 passed, 99.95% coverage on 3.12)
• CHANGELOG.md has an entry under ## [Unreleased]
• uv lock --check is consistent; dependabot.yml parses as valid YAML

Notes

• Once this merges, Dependabot should close the six superseded PRs itself. If it doesn't, close them by hand.
• mutmut 3.8.0 is not exercised by the PR checks, only by the nightly mutation.yml. The first nightly run after merge is the real check for it.

🤖 Generated with Claude Code

https://claude.ai/code/session_0156bCnW5thBLFaLt7Nvg6d4

---

Generated by Claude Code

Summary by CodeRabbit

• Chores

  • Updated security scanning and Python setup actions used in automated workflows.
  • Grouped CodeQL action updates so they can be managed together.

• Tests

  • Added checks to catch inconsistent CodeQL action versions across workflows.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 42c189f1-dbb6-46b3-9165-73e5600e811a

📥 Commits

Reviewing files that changed from the base of the PR and between 1c279a2 and a2ce9d2.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (9)

• .github/dependabot.yml
• .github/workflows/ci.yml
• .github/workflows/codeql.yml
• .github/workflows/fuzz.yml
• .github/workflows/mutation.yml
• .github/workflows/release.yml
• .github/workflows/scorecard.yml
• CHANGELOG.md
• tests/test_workflows.py

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request updates setup-uv and CodeQL action pins in workflows. It groups CodeQL action updates in Dependabot and adds tests that check CodeQL action pin consistency across workflows.

Changes

Workflow action updates

Layer / File(s)	Summary
Update setup-uv pins .github/workflows/ci.yml, .github/workflows/fuzz.yml, .github/workflows/mutation.yml, .github/workflows/release.yml	The affected jobs now use astral-sh/setup-uv v10.2.0 instead of v10.0.1.
Align CodeQL action pins .github/dependabot.yml, .github/workflows/codeql.yml, .github/workflows/scorecard.yml, tests/test_workflows.py, CHANGELOG.md	Dependabot groups CodeQL action paths. CodeQL workflow references use v4.38.1. Tests check that CodeQL action references share a commit and detect separate pins. The Unreleased changelog records these updates.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Suggested reviewers: claude

Merge Risk: ⚪ Minimal · up to a2ce9

The dependency and workflow updates appear mergeable after normal checks; no concrete issue requiring a pre-merge fix remains.

Security Architecture Review

Security architecture risk: 🔵 Low · up to a2ce9

The update strengthens protection against incompatible CodeQL action versions without showing a new route to privileged execution. The updated third-party actions still warrant normal dependency scrutiny.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The affected execution scope is existing CI, security-scanning, and release jobs using updated action pins, not a new application or public-service entrypoint.

Trust Boundaries and Controls

• inferred — The new test inspects repository workflow files but does not invoke their actions or grant access to release execution. Existing CI test-job permissions remain read-only.

Resilience and Maintainability Implications

• inferred — Checking action pins across workflows provides earlier detection of a split CodeQL update that could interrupt analysis; enforcement at merge still depends on how CI checks are required.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 75.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 1 files. (8 skipped: 8…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main changes: consolidating Dependabot updates and grouping CodeQL action dependencies.
Description check	✅ Passed	The description follows the repository template. It explains the reason for the change, lists the included updates and tests, records verification results, and includes relevant notes and the Unreleas…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 75.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 1 files. (8 skipped: 8 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}