chore(deps): bump github/codeql-action from 3.27.7 to 3.27.9 in the github-actions group #145

	name: static_analysis
	# Runs the workflow on the below events:
	# 1. on pull request raised to trunk branch.
	# 2. on push event to trunk branch.
	on:
	push:
	branches:
	- trunk
	pull_request:
	branches:
	- trunk

	permissions: # added using https://github.com/step-security/secure-workflows
	contents: read

	jobs:
	static_analysis:
	runs-on: ubuntu-latest
	strategy:
	fail-fast: false
	matrix:
	package:
	- at_cli
	- at_cram
	- at_dump_atKeys
	- at_hive_recovery
	- at_pkam
	- at_repl
	- at_ve_doctor

	steps:
	- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	- uses: dart-lang/setup-dart@e630b99d28a3b71860378cafdc2a067c71107f94 # v1.7.0
	with:
	sdk: stable
	- uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
	with:
	go-version: 'stable'
	cache-dependency-path: tools/osv-scanner/go.sum

	- name: Install dependencies and analyze in ${{ matrix.package }}
	working-directory: packages/${{ matrix.package }}
	run: \|
	dart pub get
	dart analyze

	# Runs osv-scanner to find any vulnerable Dart dependencies
	# It needs to look at pubspec.lock files, which is why it's
	# placed here, as the `dart pub get` above will create them
	- name: Run osv-scanner
	working-directory: packages/${{ matrix.package }}
	run: \|
	go install github.com/google/osv-scanner/cmd/osv-scanner@6316373e47d7e3e4b4fd3630c4bbc10987738de6 # v1.4.3
	osv-scanner --lockfile=./pubspec.lock

Provide feedback