fix(ci): repoint codeql-action at a SHA that exists

[hyperpolymath]

github/codeql-action@29b1f65c1f735799893313399435a59f54045865 is pinned here but exists in no repository — the GitHub API returns 422 for it.

CodeQL therefore could not start: the run graph fails to build and the job reports startup_failure, so this repository has had no CodeQL scanning at all.

Repointed at 4187e74d05793876e9989daffde9c3e66b4acd07, which is what the v3 tag currently resolves to (v3.37.3), verified against the API.

Found while auditing the estate: the same non-existent SHA was pinned in 104 repositories, so CodeQL was dead across nearly all of them.

---

Summary by Gitar

• CI enhancements:
  • Added new CodeQL workflow with pinned codeql-action versions
  • Updated workflow permissions across multiple pipeline configurations
• Chores:
  • Updated guix.scm package definition for squisher-corpus
  • Removed redundant governance documentation files

_{This will update automatically on new commits.}

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[gitar-bot]

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

CI failed: CI failures caused by a duplicate recipe in the Justfile, a trust manifest checksum mismatch, and a Hypatia governance violation for banned ReScript files.

Overview

Multiple distinct CI checks failed across the build jobs: a Justfile compilation error due to a duplicate recipe definition, a component trust manifest checksum mismatch, and a Hypatia governance check failure detecting banned ReScript source files.

Failures

Justfile Duplicate Recipe Definition (confidence: high)

• Type: build
• Affected jobs: 90325052053
• Related to change: yes
• Root cause: The recipe trust-verify is defined twice in the Justfile (first on line 60, and again on line 76).
• Suggested fix: Remove or rename one of the duplicate trust-verify recipe definitions in the Justfile.

Trust Manifest Checksum Mismatch (confidence: high)

• Type: test
• Affected jobs: 90325052102
• Related to change: yes
• Root cause: Computed checksums for 7 components did not match the expected values in .trust/trust-manifest.sha256 during scripts/run-must-gates.sh execution.
• Suggested fix: Update the trust manifests (.trust/trust-manifest.sha256) to reflect correct file checksums or regenerate them locally before committing.

Hypatia Governance Banned Language Violation (confidence: high)

• Type: tooling
• Affected jobs: 90325055318
• Related to change: yes
• Root cause: Tracked ReScript files (vext/vext-tools/src/hooks/Git.res) were detected, which violate project governance rules banning ReScript in favor of AffineScript.
• Suggested fix: Remove or rewrite the banned ReScript file in AffineScript, or add a proper exemption comment / entry in .hypatia-ignore if permitted.

Summary

• Change-related failures: 3 failures (Justfile duplicate recipe, trust manifest checksum mismatch, and Hypatia governance banned file violation)
• Infrastructure/flaky failures: 0
• Recommended action: Fix the duplicate recipe in the Justfile, update or regenerate the component trust manifests, and address or exempt the banned ReScript files.

Code Review ✅ Approved 2 resolved / 2 findings

Updates CodeQL action workflows to use a valid SHA and bumps the squisher-corpus dependency, but guix.scm mislabels the repository and contains a license mismatch.

✅ 2 resolved

✅ Bug: guix.scm mislabels the vexometer repo as squisher-corpus

📄 guix.scm:2 📄 guix.scm:10 📄 guix.scm:14-16
In the vexometer repository, guix.scm now sets name, synopsis, description and home-page to "squisher-corpus" (home-page points at github.com/hyperpolymath/squisher-corpus). The "update guix.scm from squisher-corpus" commit copied another project's definition wholesale, so guix shell -f guix.scm builds a package identifying as the wrong project. Restore the vexometer identity (name "vexometer", matching synopsis/description, and home-page https://github.com/hyperpolymath/vexometer).

✅ Quality: License mismatch: SPDX header MPL-2.0 vs license field PMPL-1.0-or-later

📄 guix.scm:1 📄 guix.scm:17
guix.scm's SPDX header (line 1) still declares MPL-2.0 while the package license field (line 17) now reads "PMPL-1.0-or-later". These two license declarations in the same file contradict each other, which will confuse license tooling and downstream consumers. Reconcile the header and the license field to the repository's actual license.

Tip

Comment Gitar fix CI to trigger a fix.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}