Update github actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
github/codeql-action	action	patch	v4.38.0 → v4.38.1
open-telemetry/shared-workflows	workflow	minor	v0.14.0 → v0.16.0

---

Release Notes

github/codeql-action (github/codeql-action)

v4.38.1

Compare Source

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #​4146

open-telemetry/shared-workflows (open-telemetry/shared-workflows)

v0.16.0

Compare Source

What's Changed

• Promote pull request dashboard to v0.15.0 by @​otelbot-shared-workflows[bot] in #​402
• add changelog workflow by @​codeboten in #​404

Full Changelog: open-telemetry/shared-workflows@v0.15.0...v0.16.0

v0.15.0

Compare Source

What's Changed

• Clarify unresolved reviewer feedback badge by @​trask in #​375
• Add PR dashboard to ecosystem-explorer by @​jaydeluca in #​379
• Separate pull request dashboard delivery state by @​trask in #​383
• Collect organization-wide GitHub Actions queue data by @​trask in #​377
• Route stable dashboard queue work through promoted workflows by @​trask in #​384
• Backfill GitHub Actions queue data to January 2026 by @​trask in #​385
• Improve pull request dashboard failure recovery by @​trask in #​388
• Retry truncated GitHub API responses by @​trask in #​392

New Contributors

• @​jaydeluca made their first contribution in #​379

Full Changelog: open-telemetry/shared-workflows@v0.14.0...v0.15.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 07:59 AM, only on Tuesday (* 0-7 * * 2)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[Copilot]

Copilot review overview

🟢 Approval recommended

All reviewed workflow updates have no unresolved blocking issues.

Review effort: Lite
Findings: None

What changed in this PR

Updates pinned GitHub Actions and shared workflows used by repository maintenance and security jobs.

Changes:

• Upgrades CodeQL Action from v4.38.0 to v4.38.1.
• Upgrades shared workflows from v0.14.0 to v0.16.0.

File	Description
.github/​workflows/​zizmor.yml	Updates the Zizmor workflow pin.
.github/​workflows/​ossf-scorecard.yml	Updates Scorecard and notification workflow pins.
.github/​workflows/​issue-management-stale-action.yml	Updates failure notification workflow pin.
.github/​workflows/​fossa.yml	Updates failure notification workflow pin.
.github/​workflows/​codeql.yml	Updates CodeQL and notification workflow pins.
.github/​workflows/​auto-update-semconv.yml	Updates failure notification workflow pin.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.