fix(ci): repoint codeql-action at a SHA that exists

[hyperpolymath]

github/codeql-action@29b1f65c1f735799893313399435a59f54045865 is pinned here but exists in no repository — the GitHub API returns 422 for it.

CodeQL therefore could not start: the run graph fails to build and the job reports startup_failure, so this repository has had no CodeQL scanning at all.

Repointed at 4187e74d05793876e9989daffde9c3e66b4acd07, which is what the v3 tag currently resolves to (v3.37.3), verified against the API.

Found while auditing the estate: the same non-existent SHA was pinned in 104 repositories, so CodeQL was dead across nearly all of them.

[gitar-bot]

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

CI failed: 3 CI failures: a CodeQL analysis failure from missing JavaScript/TypeScript source files, a security policy check failure from potential hardcoded secrets in the codebase, and a Rust compilation error in the fslint-core benchmark due to a missing Clone implementation on PluginLoader.

Overview

Three distinct job failures occurred across the CI pipeline: CodeQL analysis failed due to an empty or missing JavaScript/TypeScript codebase under the requested language matrix, a security compliance check failed due to potential hardcoded secrets detected by grep, and a Rust benchmark failed to compile because PluginLoader does not implement Clone.

Failures

CodeQL Language Configuration Error (confidence: high)

• Type: build
• Affected jobs: 90323518297
• Related to change: yes
• Root cause: The repository does not contain any valid or non-empty JavaScript/TypeScript source files for CodeQL to process under the javascript-typescript language configuration, causing the build/finalize step to exit with code 32.
• Suggested fix: Remove javascript-typescript from the languages matrix in .github/workflows/codeql.yml if the repository does not contain JavaScript/TypeScript code, or add appropriate source files to the repository.

Security Policy Check Failure (confidence: high)

• Type: tooling
• Affected jobs: 90323521537
• Related to change: yes
• Root cause: A custom security check script in CI detected potential hardcoded secrets matching the regex pattern for API keys, secret keys, or passwords.
• Suggested fix: Examine the files in the repository to ensure no actual secrets or API keys are hardcoded. If the match is a false positive (e.g., test mocks or placeholders), update the grep exclusion filter in the workflow or remove the offending pattern.

Rust Benchmark Compilation Error (confidence: high)

• Type: build
• Affected jobs: 90324090206
• Related to change: unclear
• Root cause: In crates/fslint-core/benches/scanner_benchmark.rs, loader.clone() is called, but the struct PluginLoader does not implement or derive the Clone trait (error[E0599]).
• Suggested fix: Add #[derive(Clone)] to the PluginLoader struct definition in fslint-core, or refactor the benchmark to avoid cloning PluginLoader.

Summary

• Change-related failures: 2 failures (CodeQL language configuration error and security policy check failure)
• Infrastructure/flaky failures: 0 failures
• Recommended action: Update the CodeQL workflow languages matrix or add JS/TS source files, review and clear any hardcoded secrets flagged by the security scan (or adjust exclusions), and fix the missing Clone implementation on PluginLoader in the Rust codebase.

Code Review ✅ Approved 2 resolved / 2 findings

Updates CodeQL actions and Guix environment configurations for security compliance, but the guix.scm mislabels the repository and top-level workflow permissions fail to reach the analyze job.

✅ 2 resolved

✅ Bug: guix.scm mislabels filesoup repo as squisher-corpus

📄 guix.scm:2 📄 guix.scm:10 📄 guix.scm:14-17
This is the filesoup repo (Cargo/stapeln.toml name = "filesoup", LICENSE = MPL-2.0), but the synced guix.scm now declares name/synopsis/description/home-page as "squisher-corpus" and license "PMPL-1.0-or-later". This makes guix shell -f guix.scm build the wrong package identity and contradicts the file's own SPDX-License-Identifier: MPL-2.0 header on line 1. Revert these fields to filesoup/MPL-2.0.

✅ Bug: actions:read added at top level never reaches analyze job

📄 .github/workflows/codeql.yml:20-22 📄 .github/workflows/codeql.yml:28-30
Job-level permissions completely replace (not merge with) workflow-level permissions in GitHub Actions. The newly added top-level actions: read is therefore dropped for the analyze job, whose explicit block only grants contents: read and security-events: write — the exact job CodeQL runs in. Add actions: read to the job-level permissions block on lines 28-30 so the intended grant actually applies.

Tip

Comment Gitar fix CI to trigger a fix.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}