CodeQL fails on every run: analyze bumped to v4.38.2 while init/autobuild stay on v4.36.2 #2940

Impact

Every CodeQL run fails on main and on every PR. The four most recent runs on main failed, including d7ac8dcd, and so did PR #2615's run. All three Analyze jobs (go, javascript, typescript) end with a configuration error, so code scanning is not analysing anything. Alerts can be neither raised nor cleared until this is fixed.

Evidence

.github/workflows/codeql.yml mixes action versions:

init:      github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e      # v4.36.2
autobuild: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
analyze:   github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2   # v4.38.2

Dependabot #2895 bumped only analyze. The analyze step refuses the configuration that the older init wrote:

##[error]Loaded a configuration file for version '4.36.2', but running version '4.38.2'
CodeQL job status was configuration error.

Fix

Pin init, autobuild and analyze to the same commit, either all v4.38.2 or all v4.36.2, as #1495 did when it bumped all three together. A Dependabot groups entry for github/codeql-action/* would stop the sub-actions drifting apart again.

Why tracked separately

Found while checking CI for #2615 (metadata request caching), which does not touch workflows. The failure reproduces on main without that PR.