fix(ci): repoint codeql-action at a SHA that exists

[hyperpolymath]

github/codeql-action@29b1f65c1f735799893313399435a59f54045865 is pinned here but exists in no repository — the GitHub API returns 422 for it.

CodeQL therefore could not start: the run graph fails to build and the job reports startup_failure, so this repository has had no CodeQL scanning at all.

Repointed at 4187e74d05793876e9989daffde9c3e66b4acd07, which is what the v3 tag currently resolves to (v3.37.3), verified against the API.

Found while auditing the estate: the same non-existent SHA was pinned in 104 repositories, so CodeQL was dead across nearly all of them.

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[gitar-bot]

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

Code Review ✅ Approved 3 resolved / 3 findings

Repoints the CodeQL action at a valid SHA to restore CI scanning, but introduces three critical issues including a mislabeled guix.scm file, a conflicting license string, and an incomplete CODE_OF_CONDUCT.md template.

✅ 3 resolved

✅ Quality: guix.scm mislabeled as squisher-corpus in homebrew-tap repo

📄 guix.scm:2 📄 guix.scm:10 📄 guix.scm:14 📄 guix.scm:15 📄 guix.scm:16 📄 guix.scm:17
This PR rewrites guix.scm's identity (name, synopsis, description, home-page) from homebrew-tap to squisher-corpus, but this repository is homebrew-tap — the package now advertises the wrong project name and points home-page at a different repo. This looks like an accidental copy-paste from the squisher-corpus template and is unrelated to the stated CodeQL fix. Revert the metadata to homebrew-tap (or split into a deliberate rename commit).

✅ Quality: guix.scm license string conflicts with SPDX header

📄 guix.scm:1 📄 guix.scm:17
The (license ...) field was changed to PMPL-1.0-or-later while the file's SPDX-License-Identifier header (line 1) still declares MPL-2.0. These now disagree, giving tools and readers contradictory licensing information. Make the two consistent (update the SPDX header or revert the license string).

✅ Quality: CODE_OF_CONDUCT.md ships template block and wrong project name

📄 CODE_OF_CONDUCT.md:3-17 📄 CODE_OF_CONDUCT.md:8-13 📄 CODE_OF_CONDUCT.md:25
The new CODE_OF_CONDUCT.md still contains the TEMPLATE INSTRUCTIONS (delete this block before publishing) HTML comment and references Squisher Corpus/squisher-corpus rather than homebrew-tap. Publishing it as-is leaks the template scaffolding and names the wrong project. Delete the instruction block and replace the project-name/repo references with homebrew-tap before merging.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.