fix(ci): repoint codeql-action at a SHA that exists

[hyperpolymath]

github/codeql-action@29b1f65c1f735799893313399435a59f54045865 is pinned here but exists in no repository — the GitHub API returns 422 for it.

CodeQL therefore could not start: the run graph fails to build and the job reports startup_failure, so this repository has had no CodeQL scanning at all.

Repointed at 4187e74d05793876e9989daffde9c3e66b4acd07, which is what the v3 tag currently resolves to (v3.37.3), verified against the API.

Found while auditing the estate: the same non-existent SHA was pinned in 104 repositories, so CodeQL was dead across nearly all of them.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[gitar-bot]

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

CI failed: CI governance check failed because banned ReScript files (such as ui/src/HarApi.res) were detected in the repository.

Overview

1 CI failure encountered during the governance check step due to the presence of banned language files (.res ReScript files).

Failures

Banned ReScript Files Detected (confidence: high)

• Type: tooling
• Affected jobs: 90323637441
• Related to change: yes
• Root cause: The repository includes ReScript files (e.g., ui/src/HarApi.res), which violate the cicd_rules/banned_language_file governance rule requiring AffineScript instead.
• Suggested fix: Migrate or remove the banned ReScript files, or declare an exemption via .hypatia-ignore or an inline # hypatia:ignore cicd_rules/banned_language_file pragma if intentional.

Summary

• Change-related failures: 1 governance failure due to banned ReScript files in the codebase.
• Infrastructure/flaky failures: None.
• Recommended action: Remove, migrate, or properly exempt the banned ReScript files (ui/src/HarApi.res) so the governance check passes.

Code Review ✅ Approved 3 resolved / 3 findings

Updates the CodeQL action reference to a valid commit SHA, but the changes introduce metadata misidentifying the repository as squisher-corpus in guix.scm, license header contradictions, and unremoved placeholders in the Code of Conduct.

✅ 3 resolved

✅ Bug: guix.scm mislabels git-scripts as squisher-corpus

📄 guix.scm:2 📄 guix.scm:10 📄 guix.scm:14-16
This is the git-scripts repository, but the guix package definition was overwritten with squisher-corpus metadata: name, synopsis, description and home-page all now point at a different project (https://github.com/hyperpolymath/squisher-corpus). guix shell -f guix.scm will build a package with the wrong identity and a home-page that doesn't correspond to this repo. Restore the git-scripts name/synopsis/description/home-page values.

✅ Quality: guix.scm license contradicts file's SPDX header

📄 guix.scm:1 📄 guix.scm:17
The SPDX header on line 1 declares MPL-2.0, but the package's license field was changed to PMPL-1.0-or-later. These two license declarations now conflict, which is misleading for downstream consumers and license tooling. Reconcile them so the SPDX header and the license field state the same license.

✅ Quality: CODE_OF_CONDUCT.md ships unremoved template block/placeholders

📄 CODE_OF_CONDUCT.md:3-17 📄 CODE_OF_CONDUCT.md:25 📄 CODE_OF_CONDUCT.md:313
The published Code of Conduct still contains the TEMPLATE INSTRUCTIONS comment block (which itself says "delete this block before publishing") and refers to "Squisher Corpus"/"squisher-corpus" rather than git-scripts, including a Discussions link pointing at the wrong repository. Remove the instruction block and replace the project name and repo links with git-scripts values before this file goes live.

Tip

Comment Gitar fix CI to trigger a fix.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}