fix(ci): stabilize codeql and scorecard

.github/actions/setup-bun/action.yml

@@ -6,4 +6,9 @@ runs:
     - uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 # v2.0.2
     - name: Install deps (frozen)
       shell: bash
-      run: bun install --frozen-lockfile
+      run: |
+        if [ -f package.json ]; then
+          bun install --frozen-lockfile
+        else
+          echo "Skipping bun install: package.json not found."
+        fi

.github/workflows/codeql.yml

@@ -43,7 +43,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-        - language: javascript-typescript
+        - language: actions
           build-mode: none
         # CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'rust', 'swift'
         # Use `c-cpp` to analyze code written in C, C++ or both

.github/workflows/lint.yml

@@ -10,5 +10,5 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
-      - uses: listee-dev/listee-ci/.github/actions/setup-bun@bc6b8ec0818a0e52fdfbe3571ffde0678d628e31
+      - uses: listee-dev/listee-ci/.github/actions/setup-bun@c8346825c9f76c2b3c21e9b4a04fbb9a4c3c5c4c
       - run: bun x biome ci .

.github/workflows/oss-scorecard.yml

@@ -75,6 +75,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@530eb0ed8e1f00b4c982fe83c0126591f9f43df2 # v3.25.4
+        uses: github/codeql-action/upload-sarif@5d5cd550d3e189c569da8f16ea8de2d821c9bf7a # v3.31.2
         with:
           sarif_file: results.sarif

.github/workflows/release.yml

@@ -19,7 +19,7 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
-      - uses: listee-dev/listee-ci/.github/actions/setup-bun@bc6b8ec0818a0e52fdfbe3571ffde0678d628e31
+      - uses: listee-dev/listee-ci/.github/actions/setup-bun@c8346825c9f76c2b3c21e9b4a04fbb9a4c3c5c4c
       - name: Install dependencies
         run: bun install --frozen-lockfile
       - name: Install latest npm

.github/workflows/test.yml

@@ -10,7 +10,7 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
-      - uses: listee-dev/listee-ci/.github/actions/setup-bun@bc6b8ec0818a0e52fdfbe3571ffde0678d628e31
+      - uses: listee-dev/listee-ci/.github/actions/setup-bun@c8346825c9f76c2b3c21e9b4a04fbb9a4c3c5c4c
       - name: Bun build
         run: bun run build
       - name: Bun test

.github/workflows/typecheck.yml

@@ -10,6 +10,6 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
-      - uses: listee-dev/listee-ci/.github/actions/setup-bun@bc6b8ec0818a0e52fdfbe3571ffde0678d628e31
+      - uses: listee-dev/listee-ci/.github/actions/setup-bun@c8346825c9f76c2b3c21e9b4a04fbb9a4c3c5c4c
       - name: TypeScript (noEmit fallback)
         run: bun x tsc -b || bun x tsc --noEmit