build: update security Actions

[dependabot]

Summary

• update OpenSSF Scorecard to v2.4.4 with an immutable pin
• update every CodeQL Action step to v4.37.4 with one consistent immutable pin
• replace 3 split updates that produced mixed-version CodeQL failures

Validation

• npm ci
• npm test
• npm run check:reproducible
• npm run check-versions
• npm audit --audit-level=moderate
• git diff --check

All 16 tests pass. Package archives remain reproducible. Audit reports 0 vulnerabilities.

Note

Update CodeQL and Scorecard GitHub Actions to latest patch versions

Bumps github/codeql-action from v4.37.1 to v4.37.4 in both codeql.yml and scorecard.yml, and updates ossf/scorecard-action from v2.4.3 to v2.4.4 in scorecard.yml.

^{Macroscope summarized db66278.}

Summary by CodeRabbit

• Chores
  • Updated security scanning and code analysis workflows to newer action versions.
  • Maintained existing workflow settings and behavior.

[greptile-apps]

PR author is in the excluded authors list.

[coderabbitai]

📝 Walkthrough

Walkthrough

The GitHub workflows now use Scorecard v2.4.4 and CodeQL actions v4.37.4. Workflow settings remain unchanged.

Changes

GitHub workflow action updates

Layer / File(s)	Summary
Update pinned security actions .github/workflows/codeql.yml, .github/workflows/scorecard.yml	The workflows update the pinned Scorecard action from v2.4.3 to v2.4.4 and the CodeQL actions from v4.37.1 to v4.37.4.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• Xquik-dev/x-twitter-scraper#29: Updates the same CodeQL SARIF upload action reference.
• Xquik-dev/x-twitter-scraper#30: Updates the same CodeQL initialization action reference.

Suggested reviewers: furkanerday, kriptoburak

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the security action updates in the pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dependabot/github_actions/ossf/scorecard-action-2.4.4

---

_{Comment @coderabbitai help to get the list of available commands.}

[kriptoburak]

Audited and validated. This consolidates the stable CodeQL and Scorecard action pins. All 16 tests, reproducibility checks, version checks, and the dependency audit pass.

[furkanerday]

DCO blocker on the current head: human-authored merge commit db66278 (Burak Bayır burakbayir1@gmail.com) has no author-matching Signed-off-by trailer. The GitHub GPG signature does not satisfy the repository DCO requirement. Please amend or recreate that contributor commit with the contributor's own Signed-off-by line and re-push it; a later commit cannot cure the missing trailer. The workflow diff, immutable Action pins, permissions, required checks, and other commit trailers are otherwise clean. The new head must be reviewed again after the history changes.