fix(ci): repoint codeql-action at a SHA that exists

[hyperpolymath]

github/codeql-action@29b1f65c1f735799893313399435a59f54045865 is pinned here but exists in no repository — the GitHub API returns 422 for it.

CodeQL therefore could not start: the run graph fails to build and the job reports startup_failure, so this repository has had no CodeQL scanning at all.

Repointed at 4187e74d05793876e9989daffde9c3e66b4acd07, which is what the v3 tag currently resolves to (v3.37.3), verified against the API.

Found while auditing the estate: the same non-existent SHA was pinned in 104 repositories, so CodeQL was dead across nearly all of them.

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[gitar-bot]

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

CI failed: CI workflow check failed because an action in `.github/workflows/secret-scan.yml` is pinned to a branch name (`@main`) instead of a full 40-character commit SHA.

Overview

1 finding(s) across 2 log(s) analyzed. The CI failed due to a workflow policy violation requiring all GitHub Actions to be pinned by their full 40-character commit SHA.

Failures

Unpinned GitHub Action (confidence: high)

• Type: configuration
• Affected jobs: 90323546780, 90323547399
• Related to change: yes
• Root cause: The workflow file .github/workflows/secret-scan.yml uses an unpinned reference (trufflesecurity/trufflehog@main) on line 24, violating the repository's policy.
• Suggested fix: Update .github/workflows/secret-scan.yml to pin trufflesecurity/trufflehog@main to a specific 40-character commit SHA instead of @main.

Summary

• Change-related failures: 1 configuration failure due to unpinned GitHub Actions.
• Infrastructure/flaky failures: 0 failures.
• Recommended action: Update the action reference in .github/workflows/secret-scan.yml to use a valid 40-character commit SHA.

Code Review ✅ Approved 2 resolved / 2 findings

Repoints the CodeQL action to a valid SHA to restore security scanning, but introduces incorrect package metadata identifying the repository as squisher-corpus and contains a license header mismatch.

✅ 2 resolved

✅ Bug: guix.scm now identifies flat-mate as "squisher-corpus"

📄 guix.scm:2 📄 guix.scm:10 📄 guix.scm:14 📄 guix.scm:15 📄 guix.scm:16
The package definition for this repo (flat-mate) was overwritten with a different project's identity: name, synopsis, description, and home-page all now read "squisher-corpus" (home-page points to github.com/hyperpolymath/squisher-corpus). This appears to be an accidental copy from another repo (commit "update guix.scm from squisher-corpus") and makes guix shell -f guix.scm build a mislabeled package pointing at the wrong upstream. Restore the flat-mate name, synopsis, description, and home-page.

✅ Quality: License mismatch: SPDX header MPL-2.0 vs license field PMPL-1.0

📄 guix.scm:1 📄 guix.scm:17
Line 1 declares SPDX-License-Identifier: MPL-2.0 but the package license field was changed to PMPL-1.0-or-later (palimpsest-license). These two contradict each other and, combined with the squisher-corpus rename, likely reflect an unintended cross-repo copy. Reconcile the license so the SPDX header and the package license agree with flat-mate's actual license.

Tip

Comment Gitar fix CI to trigger a fix.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}