ci: update codeql-action v2→v3 and checkout v3→v4

[TimeToBuildBob]

Summary

Fixes the failing Analyze (python) (CodeQL) CI check.

codeql-action v2 was deprecated on 2025-01-10 (GitHub changelog), causing the check to fail with:

##[error]CodeQL Action major versions v1 and v2 have been deprecated.
Please update all occurrences of the CodeQL Action in your workflow files to v3.

Changes

• github/codeql-action/init@v2 → @v3
• github/codeql-action/autobuild@v2 → @v3
• github/codeql-action/analyze@v2 → @v3
• actions/checkout@v3 → @v4 (v3 also deprecated)

This unblocks the CodeQL check on the open privacy filter PR (#135) and all future PRs.

[greptile-apps]

Greptile Summary

Updates the CodeQL workflow to supported major versions of GitHub’s checkout and CodeQL actions, restoring the Python security analysis job.

• Upgrades actions/checkout from v3 to v4.
• Upgrades CodeQL init, autobuild, and analysis steps from v2 to v3.

Confidence Score: 5/5

The PR appears safe to merge and restores the CodeQL workflow using the supported action majors.

The changes are limited to compatible major-version updates for checkout and CodeQL actions, with the workflow’s execution and permission model otherwise unchanged.

Important Files Changed

Filename	Overview
.github/workflows/codeql.yml	The workflow’s four action references are upgraded without changing its triggers, permissions, query suite, or analysis category.

_{Reviews (1): Last reviewed commit: "ci: update codeql-action v2→v3 and check..." | Re-trigger Greptile}

[TimeToBuildBob]

CI is green across CodeQL, typecheck, and all three platform test jobs; Greptile also reviewed the current head at 5/5. Bob has pull-only access here, so this is ready for maintainer review and merge.

[TimeToBuildBob]

CI-green and mergeable (Greptile 5/5) — waiting only on a maintainer click.

This PR is ready to merge, but the bot has pull-only access to this repo and can't self-merge — surfacing it here so it isn't lost. The monitoring loop will stop re-flagging it now that this note is posted.

[TimeToBuildBob]

🤖 AI code review

This PR updates the CodeQL workflow to use newer action versions: actions/checkout from v3 to v4, and github/codeql-action/init, autobuild, and analyze from v2 to v3. The change is limited to the .github/workflows/codeql.yml file and is intended to fix the deprecated action error in CI.

Safe to merge — no P0/P1 findings

Confidence 5/5

✅ No findings. The diff looks correct to me on this pass.

Files changed (1) — the diff as I read it

• .github/workflows/codeql.yml — Updates actions/checkout from v3 to v4 and all three github/codeql-action steps from v2 to v3.

_{Reviewed 4b758a4a37b0 · openrouter/deepseek/deepseek-v4-flash-0731 · llm engine · 7s · about this reviewer}

_{Maintainer commands}

_{@TimeToBuildBob review (own line) — fresh review · @TimeToBuildBob fix — a worker acts on the findings. Once per comment; 👀 = received.}

[TimeToBuildBob]

AI review 5/5 on 4b758a4, no findings. Self-merge not eligible here (cross-repo / pull-only). Waiting for human review or merge.