fix(ci): repoint codeql-action at a SHA that exists

[hyperpolymath]

github/codeql-action@29b1f65c1f735799893313399435a59f54045865 is pinned here but exists in no repository — the GitHub API returns 422 for it.

CodeQL therefore could not start: the run graph fails to build and the job reports startup_failure, so this repository has had no CodeQL scanning at all.

Repointed at 4187e74d05793876e9989daffde9c3e66b4acd07, which is what the v3 tag currently resolves to (v3.37.3), verified against the API.

Found while auditing the estate: the same non-existent SHA was pinned in 104 repositories, so CodeQL was dead across nearly all of them.

---

Summary by Gitar

• Chores & cleanup:
  • Updated guix.scm metadata for squisher-corpus integration
  • Removed duplicate GOVERNANCE.adoc file
• Security & CI:
  • Added actions: read permission across workflow files

_{This will update automatically on new commits.}

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[gitar-bot]

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

Code Review ✅ Approved 3 resolved / 3 findings

Updates CodeQL action pinning and Guix metadata across the repository, but introduces unintended package identity changes and an SPDX-to-license header mismatch in guix.scm.

✅ 3 resolved

✅ Bug: guix.scm identity changed to unrelated 'squisher-corpus'

📄 guix.scm:2 📄 guix.scm:10 📄 guix.scm:14-16
This is the scripts repository (PR URL and target repo), but guix.scm's name, synopsis, description, and home-page were all changed to reference squisher-corpus. The home-page now points at github.com/hyperpolymath/squisher-corpus, which is a different project. This looks like accidental cross-contamination from an estate-wide update and produces a package definition that misidentifies the repo. Restore the scripts identity (name "scripts", matching synopsis/description and home-page github.com/hyperpolymath/scripts).

✅ Quality: License mismatch: SPDX header MPL-2.0 vs license field PMPL-1.0-or-later

📄 guix.scm:1 📄 guix.scm:17
Line 1 still declares SPDX-License-Identifier: MPL-2.0 while the package license field was changed to PMPL-1.0-or-later. These two license declarations now contradict each other, creating ambiguity about the actual license of the code. Update the SPDX header to match the intended license (or revert the license field) so both agree.

✅ Quality: codeql-action pinned SHA commented '# v3' loses exact version

📄 .github/workflows/codeql.yml:43 📄 .github/workflows/codeql.yml:49
The CodeQL action SHA 4187e74d... is annotated # v3 while sibling pins (e.g. checkout # v7.0.1) use the exact resolved version. Since v3 is a moving tag, this comment no longer documents which immutable release the SHA corresponds to. Per the PR description this SHA is v3.37.3, so comment it as # v3.37.3 for auditability.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}