fix(ci): refresh remaining CodeQL action pins

Coverage: 94.97% (was 94.97%)

Author: ihor-sokoliuk

.github/workflows/docker-publish.yml

@@ -60,7 +60,7 @@ jobs:
           exit-code: '1'
 
       - name: Upload Trivy scan results to Security tab
-        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         if: always()
         with:
           sarif_file: 'trivy-results.sarif'

.github/workflows/docker-rebuild.yml

@@ -105,7 +105,7 @@ jobs:
           exit-code: '1'
 
       - name: Upload Trivy scan results to Security tab
-        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         if: always()
         with:
           sarif_file: 'trivy-results.sarif'

__tests__/unit/documentation.test.ts

@@ -396,6 +396,8 @@ export async function runTests(): Promise<TestResult> {
     assertCiCommonJob(ci);
     assertCodeqlActionPins(codeql);
     assertCodeqlActionPins(scorecard);
+    assertCodeqlActionPins(dockerPublish);
+    assertCodeqlActionPins(dockerRebuild);
     assertDockerLoginPin(dockerPublish);
     assertDockerLoginPin(dockerRebuild);
     assertDependabotUnpdfPolicy(dependabot);