fix(ci): roll back codeql-action to v4.38.0 SHA pin — resolves CodeQL/Hypatia startup_failure

[hyperpolymath]

Summary

Fixes the CodeQL Security Analysis + Hypatia Security Scan startup_failure that has blocked both workflows on main since 2026-09-22 03:06 UTC (first failing run: #94's branch; every run since).

Root cause

The grouped dependabot bump #94 moved github/codeql-action v4.38.0 → v4.38.1 in codeql.yml (init/analyze) and hypatia-scan.yml (upload-sarif). Since that merge, every run of those two workflows fails at startup (0 jobs ever dispatch — no job logs exist). The same signature now reproduces estate-wide, keyed exactly on the codeql-action version:

repo	ref	latest codeql/hypatia status
vexometer	@v4.38.1 tag	🔴 startup_failure (since 09-21)
hypatia	@1c5b675 (4.38.1 SHA)	🔴 startup_failure
rsr-template-repo	@1c5b675 (4.38.1 SHA)	🔴 startup_failure (since ~09-15)
nexia-list	@v4.38.1 tag	🔴 startup_failure (since #94)
affinescript	@v4.38.0 tag	✅ green 09-21
boj-server	@v4.34/4.38.0	✅ green 09-21
deed-ecosystem	@b96794f0 (4.38.0 SHA)	✅ green 09-21

The v4.38.1 tag object exists (peeled 1c5b675653bb…) — verified via ls-remote/API — but GitHub refuses it at workflow startup (tag and SHA form, per hypatia/rsr-template). Byte-identical replicas of the failing workflows under a new path on a scratch branch do start and execute, so the YAML/content itself is valid; v4.38.1 resolution is rejected by GitHub's actions catalog/policy layer on default-branch-evaluated runs. Exact GitHub-internal reason is not visible from the API (startup_failure runs expose no error text); the behavioural fix is unambiguous: stay on the last green release.

Changes

• codeql.yml, hypatia-scan.yml: pin codeql-action/* to @b96794f015dfd88f77b49b1c93e0fa7110f94c63 (v4.38.0, SHA-pinned — satisfies this repo's sha_pinning_required policy and matches the green deed-ecosystem configuration).
• actions.lock: re-keyed to the SHA pin. This also fixes today's Workflow security linter failure ("lock lists github/codeql-action@v4.38.0 but no workflow uses it") — dependabot bumped uses: without regenerating the lock; the estate's locked-actions gate caught it exactly as designed.
• dependabot.yml: ignore rule for github/codeql-action@4.38.1 so the daily grouped actions update can't re-merge the same broken bump overnight.

Verification

The PR itself is the live test: pull_request runs of CodeQL and Hypatia on this branch should dispatch jobs (rather than startup_failure). Watch runs above. If either still fails at startup, the remaining levers are owner-side (delete+recreate workflow files to clear the poisoned registration, or repo Settings → Code security / Actions policy review), but the version discriminator evidence says this rollback is the fix.

Follow-ups (estate-wide, not in this PR)

• Same rollback needed in vexometer, hypatia, rsr-template-repo, and any other repo that merged the 4.38.1 actions bump (dependabot auto-merge reproduced the break within hours per repo).
• Standards canonical codeql-reusable.yml / hypatia-scan-reusable.yml currently pin the 4.38.1 SHA (1c5b675…) and should be re-pinned to v4.38.0 SHA until upstream clears 4.38.1.

---

Rollback of the codeql-action portion of #94; all other bumps in #94 are untouched. See issue #49 for the CI-honesty context — this is precisely the class of failure that used to be invisible.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: d05345de-4157-4704-90bb-34facbd144e9

📥 Commits

Reviewing files that changed from the base of the PR and between 81e6716 and ae8385c.

⛔ Files ignored due to path filters (1)

• .github/workflows/actions.lock is excluded by !**/*.lock

📒 Files selected for processing (3)

• .github/dependabot.yml
• .github/workflows/codeql.yml
• .github/workflows/hypatia-scan.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (26)

• GitHub Check: scan / gitleaks
• GitHub Check: scan / rust-secrets
• GitHub Check: governance / Well-Known (RFC 9116 + RSR)
• GitHub Check: governance / Debt ratchet
• GitHub Check: governance / Workflow security linter
• GitHub Check: governance / Exemption ratchet
• GitHub Check: governance / Code quality + docs
• GitHub Check: governance / Trusted-base reduction policy
• GitHub Check: governance / Licence consistency
• GitHub Check: scan / shell-secrets
• GitHub Check: governance / Security policy checks
• GitHub Check: 🔴 GATE: CI honesty self-test (fail fixtures)
• GitHub Check: 🔴 GATE: Empty-linter (invisible characters)
• GitHub Check: governance / Allowlist Preflight
• GitHub Check: governance / Guix packaging policy (Nix retired)
• GitHub Check: governance / Check Workflow Staleness
• GitHub Check: Validate K9 contracts
• GitHub Check: 🟡 CHECK: Groove manifest check
• GitHub Check: governance / Language / package anti-pattern policy
• GitHub Check: governance / Live Actions policy (credentialed advisory)
• GitHub Check: Hypatia Neurosymbolic Analysis
• GitHub Check: analyze (javascript-typescript, none)
• GitHub Check: wasm build
• GitHub Check: analyze (rust, none)
• GitHub Check: fmt + clippy + test
• GitHub Check: rescript + wasm + bun test + bundle

⚠️ CI failures not shown inline (17)

GitHub Actions: ui-ci / 0_rescript + wasm + bun test + bundle.txt: fix(ci): roll back codeql-action to v4.38.0 SHA pin — resolves CodeQL/Hypatia startup_failure

Conclusion: failure

View job details

##[group]Run bun run build:res
 �[36;1mbun run build:res�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 $ cd ui && bunx rescript
 >>>> Start compiling
 >>>> Finish compiling (exit: 2)
 Error: /home/runner/work/nexia-list/nexia-list/ui/rescript.json: No such file or directory
 ##[error]Process completed with exit code 2.

---

GitHub Actions: ui-ci / rescript + wasm + bun test + bundle: fix(ci): roll back codeql-action to v4.38.0 SHA pin — resolves CodeQL/Hypatia startup_failure

Conclusion: failure

View job details

##[group]Run bun run build:res
 �[36;1mbun run build:res�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 $ cd ui && bunx rescript
 >>>> Start compiling
 >>>> Finish compiling (exit: 2)
 Error: /home/runner/work/nexia-list/nexia-list/ui/rescript.json: No such file or directory
 ##[error]Process completed with exit code 2.

---

GitHub Actions: Governance / 1_governance _ Well-Known (RFC 9116 + RSR).txt: fix(ci): roll back codeql-action to v4.38.0 SHA pin — resolves CodeQL/Hypatia startup_failure

Conclusion: failure

View job details

##[group]Run SECTXT=""
 �[36;1mSECTXT=""�[0m
 �[36;1m[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"�[0m
 �[36;1m[ -f "security.txt" ] && SECTXT="security.txt"�[0m
 �[36;1mif [ -z "$SECTXT" ]; then�[0m
 �[36;1m  echo "::warning::No security.txt found."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mgrep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }�[0m

---

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): fix(ci): roll back codeql-action to v4.38.0 SHA pin — resolves CodeQL/Hypatia startup_failure

Conclusion: failure

View job details

##[group]Run SECTXT=""
 �[36;1mSECTXT=""�[0m
 �[36;1m[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"�[0m
 �[36;1m[ -f "security.txt" ] && SECTXT="security.txt"�[0m
 �[36;1mif [ -z "$SECTXT" ]; then�[0m
 �[36;1m  echo "::warning::No security.txt found."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mgrep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }�[0m

---

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): fix(ci): roll back codeql-action to v4.38.0 SHA pin — resolves CodeQL/Hypatia startup_failure

Conclusion: failure

View job details

##[group]Run MIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5 || true)
 �[36;1mMIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5 || true)�[0m
 �[36;1mif [ -n "$MIXED" ]; then�[0m
 �[36;1m  echo "::error::Mixed content (HTTP in HTML)"�[0m

---

GitHub Actions: Governance / 2_governance _ Workflow security linter.txt: fix(ci): roll back codeql-action to v4.38.0 SHA pin — resolves CodeQL/Hypatia startup_failure

Conclusion: failure

View job details

##[group]Run SCRIPT=".standards-dupkey/tools/policy/check-workflows-parse.sh"
 �[36;1mSCRIPT=".standards-dupkey/tools/policy/check-workflows-parse.sh"�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ -f tools/policy/check-workflows-parse.sh ]; then�[0m
 �[36;1m  SCRIPT="tools/policy/check-workflows-parse.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-lint)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::workflow parser gate not found in standards@main or locally"�[0m

---

GitHub Actions: Governance / governance _ Workflow security linter: fix(ci): roll back codeql-action to v4.38.0 SHA pin — resolves CodeQL/Hypatia startup_failure

Conclusion: failure

View job details

##[group]Run SCRIPT=".standards-dupkey/tools/policy/check-workflows-parse.sh"
 �[36;1mSCRIPT=".standards-dupkey/tools/policy/check-workflows-parse.sh"�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ -f tools/policy/check-workflows-parse.sh ]; then�[0m
 �[36;1m  SCRIPT="tools/policy/check-workflows-parse.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-lint)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::workflow parser gate not found in standards@main or locally"�[0m

---

GitHub Actions: Governance / governance _ Workflow security linter: fix(ci): roll back codeql-action to v4.38.0 SHA pin — resolves CodeQL/Hypatia startup_failure

Conclusion: failure

View job details

##[group]Run # GitHub Actions REJECTS a workflow with duplicate keys: the run is
 �[36;1m# GitHub Actions REJECTS a workflow with duplicate keys: the run is�[0m
 �[36;1m# `failure` with no jobs, no log and no check run. Nothing else here�[0m
 �[36;1m# can see it, because yaml.safe_load silently keeps the LAST�[0m
 �[36;1m# duplicate and reports success — so the file "parses" and every�[0m
 �[36;1m# other lint passes. Measured 2026-08-05: nine workflows in hypatia�[0m
 �[36;1m# were dead this way, including a CodeQL workflow with zero�[0m
 �[36;1m# successful runs in its entire lifetime.�[0m
 �[36;1mset -euo pipefail�[0m
 �[36;1mSCRIPT=".standards-dupkey/scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1m# Self-hosting fallback: when THIS repository is standards, its own�[0m
 �[36;1m# working tree already holds the script, and during a rename that copy�[0m
 �[36;1m# is the only correct one — the pinned main checkout still has the old�[0m
 �[36;1m# name. Preferring the fetched copy keeps every other caller on the�[0m
 �[36;1m# canonical version.�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ -f scripts/check-workflow-duplicate-keys.sh ]; then�[0m
 �[36;1m  SCRIPT="scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-lint)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::duplicate-key checker not found — neither fetched from" \�[0m

---

GitHub Actions: Governance / 6_governance _ Code quality + docs.txt: fix(ci): roll back codeql-action to v4.38.0 SHA pin — resolves CodeQL/Hypatia startup_failure

Conclusion: failure

View job details

##[group]Run editorconfig-checker/action-editorconfig-checker@840e866d93b8e032123c23bac69dece044d4d84c
 with:
   github-***REDACTED_SECRET_ASSIGNMENT***
   version: latest
 ##[endgroup]
 Find 'latest' release
 ##[error]Error: The binary 'ec-linux-amd64*' not found

---

GitHub Actions: Governance / governance _ Code quality + docs: fix(ci): roll back codeql-action to v4.38.0 SHA pin — resolves CodeQL/Hypatia startup_failure

Conclusion: failure

View job details

##[group]Run editorconfig-checker/action-editorconfig-checker@840e866d93b8e032123c23bac69dece044d4d84c
 with:
   github-***REDACTED_SECRET_ASSIGNMENT***
   version: latest
 ##[endgroup]
 Find 'latest' release
 ##[error]Error: The binary 'ec-linux-amd64*' not found

---

GitHub Actions: Governance / governance _ Code quality + docs: fix(ci): roll back codeql-action to v4.38.0 SHA pin — resolves CodeQL/Hypatia startup_failure

Conclusion: failure

View job details

##[group]Run # Split gate (standards#505): README + LICENSE block immediately —
 �[36;1m# Split gate (standards#505): README + LICENSE block immediately —�[0m
 �[36;1m# measured 0/412 callers missing either, so arming them reds nobody.�[0m
 �[36;1m# CONTRIBUTING (54/412 missing) warns until the cutoff baked into the�[0m
 �[36;1m# script, then blocks. See scripts/check-docs-presence.sh.�[0m
 �[36;1mcp .standards-checkout/scripts/check-docs-presence.sh "$RUNNER_TEMP/"�[0m
 �[36;1mrm -rf .standards-checkout�[0m
 �[36;1mbash "$RUNNER_TEMP/check-docs-presence.sh" .�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 ##[error]Missing required documentation: CONTRIBUTING

---

GitHub Actions: Governance / 8_governance _ Guix packaging policy (Nix retired).txt: fix(ci): roll back codeql-action to v4.38.0 SHA pin — resolves CodeQL/Hypatia startup_failure

Conclusion: failure

View job details

##[group]Run # Move the checker OUT of the scanned tree and delete the standards
 �[36;1m# Move the checker OUT of the scanned tree and delete the standards�[0m
 �[36;1m# checkout before scanning: the gate walks the whole caller tree, so�[0m
 �[36;1m# a packaging file shipped inside .standards-checkout/ would satisfy�[0m
 �[36;1m# the policy on the caller's behalf (same trap as the baseline job).�[0m
 �[36;1mcp .standards-checkout/scripts/check-package-policy.sh "$RUNNER_TEMP/"�[0m
 �[36;1mrm -rf .standards-checkout�[0m
 �[36;1mbash "$RUNNER_TEMP/check-package-policy.sh" .�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 ##[error]Package policy violation: no packaging found.

---

GitHub Actions: Governance / governance _ Guix packaging policy (Nix retired): fix(ci): roll back codeql-action to v4.38.0 SHA pin — resolves CodeQL/Hypatia startup_failure

Conclusion: failure

View job details

##[group]Run # Move the checker OUT of the scanned tree and delete the standards
 �[36;1m# Move the checker OUT of the scanned tree and delete the standards�[0m
 �[36;1m# checkout before scanning: the gate walks the whole caller tree, so�[0m
 �[36;1m# a packaging file shipped inside .standards-checkout/ would satisfy�[0m
 �[36;1m# the policy on the caller's behalf (same trap as the baseline job).�[0m
 �[36;1mcp .standards-checkout/scripts/check-package-policy.sh "$RUNNER_TEMP/"�[0m
 �[36;1mrm -rf .standards-checkout�[0m
 �[36;1mbash "$RUNNER_TEMP/check-package-policy.sh" .�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 ##[error]Package policy violation: no packaging found.

---

GitHub Actions: Governance / 10_governance _ Security policy checks.txt: fix(ci): roll back codeql-action to v4.38.0 SHA pin — resolves CodeQL/Hypatia startup_failure

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mDIR=.github/canonical-references�[0m
 �[36;1mif [ ! -d "$DIR" ]; then�[0m
 �[36;1m  echo "ℹ️  [R5] no $DIR/ — skipped (repo has not opted in)"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mif ! command -v python3 >/dev/null 2>&1; then�[0m
 �[36;1m  echo "❌ [R5] python3 missing on runner — required for YAML rule parsing"�[0m
 �[36;1m  exit 2�[0m
 �[36;1mfi�[0m
 �[36;1mpython3 - <<'PY'�[0m
 �[36;1mimport os, sys, glob, subprocess�[0m
 �[36;1mtry:�[0m
 �[36;1m    import yaml�[0m
 �[36;1mexcept ImportError:�[0m
 �[36;1m    sys.exit("❌ [R5] PyYAML not installed on runner; install python3-yaml")�[0m
 �[36;1m�[0m
 �[36;1mdir_ = ".github/canonical-references"�[0m
 �[36;1mfiles = sorted(glob.glob(f"{dir_}/*.yml") + glob.glob(f"{dir_}/*.yaml"))�[0m
 �[36;1mif not files:�[0m
 �[36;1m    print(f"ℹ️  [R5] {dir_}/ has no .yml/.yaml rules — skipped")�[0m
 �[36;1m    sys.exit(0)�[0m
 �[36;1m�[0m
 �[36;1mtotal = 0�[0m
 �[36;1mfor rf in files:�[0m
 �[36;1m    with open(rf, encoding="utf-8") as fh:�[0m
 �[36;1m        cfg = yaml.safe_load(fh)�[0m
 �[36;1m    if not isinstance(cfg, dict):�[0m
 �[36;1m        print(f"❌ [R5] {rf}: top-level must be a mapping"); total += 1; continue�[0m
 �[36;1m    rid  = cfg.get("id", os.path.basename(rf))�[0m
 �[36;1m    desc = cfg.get("description", "")�[0m
 �[36;1m    pats = cfg.get("patterns") or []�[0m
 �[36;1m    canon = cfg.get("canonical_pointer", "")�[0m
 �[36;1m    scope = (cfg.get("scope") or {})�[0m
 �[36;1m    includes = scope.get("include") or []�[0m
 �[36;1m    if not pats or not includes:�[0m
 �[36;1m        print(f"❌ [R5:{rid}] missing patterns or scope.include in {rf}")�[0m
 �[36;1m        total += 1; continue�[0m
 �[36;1m    # exclude self-references�[0m
 �[36;1m    skip = set(["CHANGELOG.md", "CHANGELOG.adoc", rf])�[0m
 �[36;1m    if canon: skip.add(canon)�[0m
 �[36;1m    rule_hits = 0�[0m
 �[36;1m    for f_ in includes:�[0m
 �[36;1m        if f_ in skip or not os...

---

GitHub Actions: Governance / governance _ Security policy checks: fix(ci): roll back codeql-action to v4.38.0 SHA pin — resolves CodeQL/Hypatia startup_failure

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mDIR=.github/canonical-references�[0m
 �[36;1mif [ ! -d "$DIR" ]; then�[0m
 �[36;1m  echo "ℹ️  [R5] no $DIR/ — skipped (repo has not opted in)"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mif ! command -v python3 >/dev/null 2>&1; then�[0m
 �[36;1m  echo "❌ [R5] python3 missing on runner — required for YAML rule parsing"�[0m
 �[36;1m  exit 2�[0m
 �[36;1mfi�[0m
 �[36;1mpython3 - <<'PY'�[0m
 �[36;1mimport os, sys, glob, subprocess�[0m
 �[36;1mtry:�[0m
 �[36;1m    import yaml�[0m
 �[36;1mexcept ImportError:�[0m
 �[36;1m    sys.exit("❌ [R5] PyYAML not installed on runner; install python3-yaml")�[0m
 �[36;1m�[0m
 �[36;1mdir_ = ".github/canonical-references"�[0m
 �[36;1mfiles = sorted(glob.glob(f"{dir_}/*.yml") + glob.glob(f"{dir_}/*.yaml"))�[0m
 �[36;1mif not files:�[0m
 �[36;1m    print(f"ℹ️  [R5] {dir_}/ has no .yml/.yaml rules — skipped")�[0m
 �[36;1m    sys.exit(0)�[0m
 �[36;1m�[0m
 �[36;1mtotal = 0�[0m
 �[36;1mfor rf in files:�[0m
 �[36;1m    with open(rf, encoding="utf-8") as fh:�[0m
 �[36;1m        cfg = yaml.safe_load(fh)�[0m
 �[36;1m    if not isinstance(cfg, dict):�[0m
 �[36;1m        print(f"❌ [R5] {rf}: top-level must be a mapping"); total += 1; continue�[0m
 �[36;1m    rid  = cfg.get("id", os.path.basename(rf))�[0m
 �[36;1m    desc = cfg.get("description", "")�[0m
 �[36;1m    pats = cfg.get("patterns") or []�[0m
 �[36;1m    canon = cfg.get("canonical_pointer", "")�[0m
 �[36;1m    scope = (cfg.get("scope") or {})�[0m
 �[36;1m    includes = scope.get("include") or []�[0m
 �[36;1m    if not pats or not includes:�[0m
 �[36;1m        print(f"❌ [R5:{rid}] missing patterns or scope.include in {rf}")�[0m
 �[36;1m        total += 1; continue�[0m
 �[36;1m    # exclude self-references�[0m
 �[36;1m    skip = set(["CHANGELOG.md", "CHANGELOG.adoc", rf])�[0m
 �[36;1m    if canon: skip.add(canon)�[0m
 �[36;1m    rule_hits = 0�[0m
 �[36;1m    for f_ in includes:�[0m
 �[36;1m        if f_ in skip or not os...

---

GitHub Actions: Governance / 13_governance _ Language _ package anti-pattern policy.txt: fix(ci): roll back codeql-action to v4.38.0 SHA pin — resolves CodeQL/Hypatia startup_failure

Conclusion: failure

View job details

##[group]Run SCRIPT=".standards-checkout/tools/policy/check-language-policy.sh"
 �[36;1mSCRIPT=".standards-checkout/tools/policy/check-language-policy.sh"�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ -f tools/policy/check-language-policy.sh ]; then�[0m
 �[36;1m  SCRIPT="tools/policy/check-language-policy.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-check)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::language-policy gate not found in standards@main or locally"�[0m

---

GitHub Actions: Governance / governance _ Language _ package anti-pattern policy: fix(ci): roll back codeql-action to v4.38.0 SHA pin — resolves CodeQL/Hypatia startup_failure

Conclusion: failure

View job details

##[group]Run SCRIPT=".standards-checkout/tools/policy/check-language-policy.sh"
 �[36;1mSCRIPT=".standards-checkout/tools/policy/check-language-policy.sh"�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ -f tools/policy/check-language-policy.sh ]; then�[0m
 �[36;1m  SCRIPT="tools/policy/check-language-policy.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-check)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::language-policy gate not found in standards@main or locally"�[0m

🔇 Additional comments (3)

.github/workflows/codeql.yml (1)

47-47: LGTM!

Also applies to: 53-53

.github/workflows/hypatia-scan.yml (1)

248-248: LGTM!

.github/dependabot.yml (1)

11-17: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Pinned security scanning workflow actions to a fixed, verified version for more consistent and predictable scans.
  • Prevented automated dependency updates from proposing the excluded CodeQL version while the pin remains in place.

Walkthrough

The workflows now pin CodeQL actions to an immutable v4.38.0 commit. Dependabot ignores version 4.38.1 and documents the workflow-startup validation failure associated with that version.

Changes

CodeQL action pinning

Layer / File(s)	Summary
Pin CodeQL workflow actions .github/workflows/codeql.yml, .github/workflows/hypatia-scan.yml	The CodeQL initialisation, analysis, and SARIF upload actions now use commit b96794f015dfd88f77b49b1c93e0fa7110f94c63, annotated as v4.38.0.
Ignore the rejected Dependabot version .github/dependabot.yml	Dependabot ignores github/codeql-action version 4.38.1. A comment records the workflow-startup validation failure.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to ae838

CodeQL and Hypatia remain pinned to v4.38.0, avoiding the reported startup failure with no actionable merge-blocking risk remaining.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the rollback to the v4.38.0 SHA pin and the CodeQL/Hypatia startup failure it addresses.
Description check	✅ Passed	The description directly explains the v4.38.1 rollback, the startup failure, the Dependabot ignore rule, and the related workflow changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit pins the actions tight
At v4.38.0, clear and bright
Dependabot skips the faulty trail
The workflows start without that veil
Three small changes keep the checks in sight}

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

🔍 Hypatia Security Scan

Findings: 70 issues detected

Severity	Count
🔴 Critical	6
🟠 High	28
🟡 Medium	36

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Required workflow `scorecard.yml` is absent from .github/workflows/. The estate baseline expects it; without it this repository is unscanned for whatever that workflow covers, and its absence is silent — no job fails, because no job runs.",
    "type": "missing_workflow",
    "file": "scorecard.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Workflow executes remote script directly (curl/wget piped to shell). Download, verify checksum/signature, then execute.",
    "type": "download_then_run",
    "file": "ui-ci.yml",
    "action": "verify_download_integrity",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Job `trigger-boj` in boj-build.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": "boj-build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "trigger-boj"
  },
  {
    "reason": "Job `build` in casket-pages.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "build"
  },
  {
    "reason": "Job `deploy` in casket-pages.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "deploy"
  },
  {
    "reason": "Job `analyze` in codeql.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "analyze"
  },
  {
    "reason": "Job `a2ml-validate` in dogfood-gate.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "a2ml-validate"
  },
  {
    "reason": "Job `dogfood-summary` in dogfood-gate.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "dogfood-summary"
  },
  {
    "reason": "Job `k9-validate` in dogfood-gate.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "k9-validate"
  },
  {
    "reason": "Job `scan` in hypatia-scan.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": "hypatia-scan.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "scan"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence