chore(deps): bump github/codeql-action/upload-sarif

Bumps the gha-minor group with 1 update: [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).


Updates `github/codeql-action/upload-sarif` from 4.38.0 to 4.38.2
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/b96794f015dfd88f77b49b1c93e0fa7110f94c63...2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2)

---
updated-dependencies:
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.38.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gha-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/scorecard.yml

@@ -60,6 +60,6 @@ jobs:
           retention-days: 5
 
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           sarif_file: results.sarif

plugins/gh/README.md

@@ -18,5 +18,3 @@ plugin is loaded, which is usually when you start up a new terminal emulator.
 The cache is stored at:
 
 - `$ZSH_CACHE_DIR/completions/_gh` completions script
-
-If an update fails, the last successfully generated completion script is kept.

plugins/gh/gh.plugin.zsh

@@ -13,12 +13,6 @@ fi
 
 zmodload -F zsh/files b:zf_mv
 () {
-  local completion_file="$ZSH_CACHE_DIR/completions/_gh"
-  local completion_tmp="${completion_file}.$$.${RANDOM}"
-
-  if gh completion --shell zsh >| "$completion_tmp" && [[ -s "$completion_tmp" ]]; then
-    zf_mv -f -- "$completion_tmp" "$completion_file"
-  fi
-
-  command rm -f -- "$completion_tmp"
+  local TMPPREFIX="$ZSH_CACHE_DIR/completions/_gh"
+  zf_mv -f -- =( gh completion --shell zsh ) "$TMPPREFIX"
 } &|