fix(codeql): analyse the languages this repository actually has

[hyperpolymath]

codeql database finalize was exiting 32 on every run:

CodeQL could not process any code written in JavaScript/TypeScript.

The matrix asserted javascript-typescript; this repository's languages are ruby,rust. One codeql.yml was copied estate-wide with a hard-coded JS matrix — 82 repositories carry it, and 17 of the 18 sampled have no JavaScript at all (Julia, Rust, Zig, Agda, Ada, Haskell, Elixir).

This is not only a failing check. The crash uploads no SARIF, so a code_scanning ruleset rule requiring CodeQL waits forever on "Code scanning is waiting for results from CodeQL". One fault, two symptoms — and relaxing the rule's thresholds could not have helped, because no results arrive at all.

actions is kept (or added): it is valid in every repository, since every repository has workflow files, and it keeps this workflow producing a check and a SARIF upload even where CodeQL can analyse nothing else.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[gitar-bot]

💡 Edge Case: Ruby leg rests on a single Homebrew formula

The only Ruby in the repo is packaging/homebrew/cloud-sync-tuner.rb (a Homebrew Formula class). If CodeQL's Ruby extractor treats this lone packaging file as non-substantive, the ruby matrix leg can exit 32 ("could not process any code") — the exact failure this PR fixes — and, since a leg failure means no SARIF for that language, it could re-block the code_scanning ruleset. Verify the ruby analysis actually succeeds; if the formula is the only Ruby, consider dropping the ruby leg (the actions leg already guarantees a check/SARIF).

_{Was this helpful? React with 👍 / 👎}

[gitar-bot]

⚠️ This PR is blocked due to unresolved code review findings.

_{Configure merge blocking · Maintainers can dismiss this review.}

[gitar-bot]

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

Code Review 👍 Approved with suggestions 0 resolved / 1 findings

Updates the CodeQL workflow matrix from JavaScript/TypeScript to Ruby and Rust to resolve pipeline failures and missing SARIF uploads. Consider whether analyzing Ruby is necessary given it only consists of a single Homebrew formula.

Auto-approved and auto-merge armed: No blocking issues found.
Please see Auto-approve Docs for details on setting custom approval criteria. — merges when pipeline and required approvals pass.

💡 Edge Case: Ruby leg rests on a single Homebrew formula

📄 .github/workflows/codeql.yml:35-36

The only Ruby in the repo is packaging/homebrew/cloud-sync-tuner.rb (a Homebrew Formula class). If CodeQL's Ruby extractor treats this lone packaging file as non-substantive, the ruby matrix leg can exit 32 ("could not process any code") — the exact failure this PR fixes — and, since a leg failure means no SARIF for that language, it could re-block the code_scanning ruleset. Verify the ruby analysis actually succeeds; if the formula is the only Ruby, consider dropping the ruby leg (the actions leg already guarantees a check/SARIF).

🤖 Prompt for agents

Code Review: Updates the CodeQL workflow matrix from JavaScript/TypeScript to Ruby and Rust to resolve pipeline failures and missing SARIF uploads. Consider whether analyzing Ruby is necessary given it only consists of a single Homebrew formula.

1. 💡 Edge Case: Ruby leg rests on a single Homebrew formula
   Files: .github/workflows/codeql.yml:35-36

   The only Ruby in the repo is packaging/homebrew/cloud-sync-tuner.rb (a Homebrew Formula class). If CodeQL's Ruby extractor treats this lone packaging file as non-substantive, the `ruby` matrix leg can exit 32 ("could not process any code") — the exact failure this PR fixes — and, since a leg failure means no SARIF for that language, it could re-block the code_scanning ruleset. Verify the ruby analysis actually succeeds; if the formula is the only Ruby, consider dropping the `ruby` leg (the `actions` leg already guarantees a check/SARIF).

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

---

Important

Your trial ends in 4 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more.

_{Was this helpful? React with 👍 / 👎 | Gitar}

[gitar-bot]

⚠️ Gitar auto-approved this PR but could not enable auto-merge: auto-merge is disabled for this repository — enable "Allow auto-merge" in the repository settings.

[gitar-bot]

Gitar has auto-approved this PR and enabled auto-merge (configure)