fix(ci): repoint codeql-action at a SHA that exists

[hyperpolymath]

github/codeql-action@29b1f65c1f735799893313399435a59f54045865 is pinned here but exists in no repository — the GitHub API returns 422 for it.

CodeQL therefore could not start: the run graph fails to build and the job reports startup_failure, so this repository has had no CodeQL scanning at all.

Repointed at 4187e74d05793876e9989daffde9c3e66b4acd07, which is what the v3 tag currently resolves to (v3.37.3), verified against the API.

Found while auditing the estate: the same non-existent SHA was pinned in 104 repositories, so CodeQL was dead across nearly all of them.

[gitar-bot]

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

CI failed: Test failure in the project configuration suite where guix.scm defines the package as 'squisher-corpus' instead of 'supernorma'.

Overview

1 test failure found in the CI run due to a mismatch between package definition in guix.scm and test expectations for the SuperNorma project.

Failures

guix.scm Package Definition Test Failure (confidence: high)

• Type: test
• Affected jobs: 90324748673
• Related to change: yes
• Root cause: The integration test Project Configuration > guix.scm > should exist and define supernorma package failed because guix.scm defines a package named 'squisher-corpus' instead of 'supernorma', causing the string assertion for 'SuperNorma' to fail.
• Suggested fix: Update guix.scm to define the package name as 'supernorma' with synopsis and description matching the SuperNorma project, or update the integration test expectations in tests/integration/Config_test.res to match the expected package name.

Summary

• Change-related failures: 1 test failure in the configuration test suite (guix.scm package name mismatch).
• Infrastructure/flaky failures: 0 failures.
• Recommended action: Update guix.scm or the corresponding test expectations so that the package definition matches the expected 'supernorma' project metadata.

Code Review ✅ Approved 2 resolved / 2 findings

Updates CodeQL actions to SHA-pinned v3 and syncs estate-wide security compliance, but the guix.scm license constructor is called with the wrong arity and package metadata refers to squisher-corpus instead of supernorma.

✅ 2 resolved

✅ Bug: guix.scm license constructor called with wrong arity

📄 guix.scm:17-18
The <license> record constructor from (guix licenses) requires 3 arguments (name, uri, comment), but here it is invoked with only 2 ("PMPL-1.0-or-later" and the URL). Evaluating this file will raise a wrong-number-of-arguments error, so guix shell -f guix.scm fails to load. Add the missing comment argument, e.g. ((@@ (guix licenses) license) "PMPL-1.0-or-later" "https://github.com/hyperpolymath/palimpsest-license" "Palimpsest license").

✅ Quality: guix.scm renamed to squisher-corpus inside supernorma repo

📄 guix.scm:1-2 📄 guix.scm:10 📄 guix.scm:15-16
The package name, synopsis, description, and home-page now all reference "squisher-corpus" while this file lives in the supernorma repository, and the SPDX header declares MPL-2.0 while the package's license field declares PMPL-1.0. This looks like content copied from another repo without adjusting identifiers; verify the name/home-page and license header are intended for this repo to avoid confusing metadata.

Tip

Comment Gitar fix CI to trigger a fix.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE