fix(ci): repoint codeql-action at a SHA that exists

[hyperpolymath]

github/codeql-action@29b1f65c1f735799893313399435a59f54045865 is pinned here but exists in no repository — the GitHub API returns 422 for it.

CodeQL therefore could not start: the run graph fails to build and the job reports startup_failure, so this repository has had no CodeQL scanning at all.

Repointed at 4187e74d05793876e9989daffde9c3e66b4acd07, which is what the v3 tag currently resolves to (v3.37.3), verified against the API.

Found while auditing the estate: the same non-existent SHA was pinned in 104 repositories, so CodeQL was dead across nearly all of them.

---

Summary by Gitar

• CI enhancements:
  • Added explicit actions: read permissions to multiple GitHub Action workflows
• Package updates:
  • Updated guix.scm package metadata from php-aegis to squisher-corpus

_{This will update automatically on new commits.}

[gitar-bot]

CI failed: CI failures across multiple jobs due to PHPStan configuration syntax errors, PHPUnit test and assertion errors, code style violations in PHP CS Fixer, and a misconfigured CodeQL workflow targeting JavaScript on a PHP repository.

Overview

Multiple distinct failures were encountered across the CI jobs, spanning test execution, static analysis configuration, code style checks, and code scanning workflow settings.

Failures

PHPUnit Test Failures & Errors (confidence: high)

• Type: test
• Affected jobs: 90324771233
• Related to change: unclear
• Root cause: The test suite encountered 5 errors (such as unknown named parameter $httpsOnly and invalid IRI exceptions) along with 33 assertion failures in sanitizer, validator, and adapter tests.
• Suggested fix: Review and correct the failing assertions and method signatures/parameters in the test suite and corresponding source files.

PHPStan Configuration Error (confidence: high)

• Type: configuration
• Affected jobs: 90324771237
• Related to change: unclear
• Root cause: The phpstan.neon configuration file contains an unexpected configuration item (parameters › memoryLimit).
• Suggested fix: Update phpstan.neon to remove or correct the invalid configuration parameter syntax.

Code Style & CS Fixer Violations (confidence: high)

• Type: tooling
• Affected jobs: 90325683344, 90324771250
• Related to change: yes
• Root cause: php-cs-fixer and critical CI checks found formatting and style violations across multiple project files.
• Suggested fix: Run vendor/bin/php-cs-fixer fix locally, review changes, and commit the formatting fixes.

CodeQL Configuration Error (confidence: high)

• Type: configuration
• Affected jobs: 90324343739
• Related to change: yes
• Root cause: The CodeQL workflow was configured to analyze javascript-typescript on a pure PHP repository containing no JavaScript or TypeScript code, causing a fatal exit code 32.
• Suggested fix: Update .github/workflows/codeql.yml to target php instead of javascript-typescript.

Summary

• Change-related failures: 3 (Code style violations, PHP CS Fixer diffs, and CodeQL language misconfiguration)
• Infrastructure/flaky failures: 0
• Recommended action: Update the CodeQL workflow language to PHP, fix the formatting/style issues with PHP CS Fixer, correct the PHPStan configuration, and investigate the failing PHPUnit tests.

Code Review ✅ Approved

Repoints the CodeQL action at a valid SHA and adds explicit workflow permissions across multiple GitHub Action workflows. No issues found.

Auto-approved and auto-merge armed: No blocking issues found.
Please see Auto-approve Docs for details on setting custom approval criteria. — merges when pipeline and required approvals pass.

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[gitar-bot]

⚠️ Gitar auto-approved this PR but could not enable auto-merge: auto-merge is disabled for this repository — enable "Allow auto-merge" in the repository settings.

[gitar-bot]

Gitar has auto-approved this PR and enabled auto-merge (configure)

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE