fix(ci): repoint codeql-action at a SHA that exists

[hyperpolymath]

github/codeql-action@29b1f65c1f735799893313399435a59f54045865 is pinned here but exists in no repository — the GitHub API returns 422 for it.

CodeQL therefore could not start: the run graph fails to build and the job reports startup_failure, so this repository has had no CodeQL scanning at all.

Repointed at 4187e74d05793876e9989daffde9c3e66b4acd07, which is what the v3 tag currently resolves to (v3.37.3), verified against the API.

Found while auditing the estate: the same non-existent SHA was pinned in 104 repositories, so CodeQL was dead across nearly all of them.

[gitar-bot]

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

CI failed: CI governance check failed due to a banned ReScript file (`provenance/crates/protocol-squisher-rescript-analyzer/tests/interop_test.res`) being tracked without an exemption.

Overview

1 CI job failure found related to repository governance rules prohibiting ReScript files.

Failures

Banned ReScript File Detected (confidence: high)

• Type: tooling
• Affected jobs: 90324469268
• Related to change: no
• Root cause: The cicd_rules/banned_language_file governance check detected a tracked ReScript file (provenance/crates/protocol-squisher-rescript-analyzer/tests/interop_test.res), which violates the project's policy against ReScript.
• Suggested fix: Remove the ReScript file, rewrite it in AffineScript, or add a # hypatia:ignore cicd_rules/banned_language_file pragma / entry in .hypatia-ignore if the file is intentionally present.

Summary

• Change-related failures: 0
• Infrastructure/flaky failures: 0
• Recommended action: Address the governance policy violation by either removing or ignoring the detected ReScript file in the repository.

Code Review ✅ Approved 4 resolved / 4 findings

Updates the CodeQL action SHA and updates governance and security compliance files. However, the changes introduce an incorrect project identity in guix.scm, conflicting license headers, and unedited template blocks in SECURITY.md and CODE_OF_CONDUCT.md.

✅ 4 resolved

✅ Bug: guix.scm rewritten with wrong project identity (squisher-corpus)

📄 provenance/guix.scm:2 📄 provenance/guix.scm:10 📄 provenance/guix.scm:14-16
This PR is on the protocol-squisher repo, but guix.scm now names the package, synopsis, description, and home-page as "squisher-corpus" (per commit "update guix.scm from squisher-corpus"). This looks like cross-repo contamination that mislabels this package's identity and points its home-page at the wrong repository. Restore the protocol-squisher values (name, synopsis, description, home-page) unless the repository was genuinely renamed.

✅ Quality: License header (MPL-2.0) contradicts license field (PMPL-1.0-or-later)

📄 provenance/guix.scm:1 📄 provenance/guix.scm:17
The SPDX header on line 1 still declares MPL-2.0, but the package license field was changed to "PMPL-1.0-or-later". These now disagree, creating an ambiguous/contradictory license declaration for the package. Reconcile the two so the SPDX identifier and the declared license match.

✅ Quality: Published SECURITY.md/CODE_OF_CONDUCT.md still contain template blocks

📄 SECURITY.md:3-17 📄 SECURITY.md:63 📄 CODE_OF_CONDUCT.md:3-17
Both new files retain the "TEMPLATE INSTRUCTIONS (delete this block before publishing)" comment blocks, and SECURITY.md still lists the PGP fingerprint as TBD. Publishing these as-is exposes unfinished template scaffolding to users and provides a non-actionable fingerprint. Remove the instruction blocks and fill in (or drop) the PGP fingerprint before merging.

✅ Quality: Autobuild step is a no-op for build-mode: none

📄 .github/workflows/codeql.yml:41-42
The matrix analyzes only the actions language with build-mode: none, for which the Autobuild step performs nothing and is unnecessary per CodeQL guidance. It's harmless but adds a confusing pointless step; consider removing the Autobuild step for this build-mode-none configuration.

Tip

Comment Gitar fix CI to trigger a fix.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.