fix(ci): codeql-action v4.38.1 -> v4.38.0 SHA pin + dependabot hold (estate-wide startup_failure)

[hyperpolymath]

Summary

Estate-wide incident: github/codeql-action v4.38.1 fails GitHub workflow startup on every repo that took it — CodeQL/Hypatia runs die with startup_failure, zero jobs dispatched, no error text via the API. Full investigation + evidence chain: nexia-list#100.

Changes

• codeql-action/* refs (tag @v4.38.1 or SHA 1c5b675…) re-pinned to the v4.38.0 commit b96794f015dfd88f77b49b1c93e0fa7110f94c63 (green on deed-ecosystem; satisfies SHA-pin policy).
• actions.lock re-keyed where present (dependabot bumps uses: without regenerating the lock → governance linter failure).
• dependabot.yml: full hold on github/codeql-action — scoped versions: ignores do NOT hold on this path (nexia-list#101 re-raised the bump in SHA form within an hour, copying the inline warning comment verbatim while swapping the SHA).

Canonical fix at the estate origin: standards#973. Batch-mates: nexia-list#100 (merged), hypatia#828, vexometer#90, rsr-template-repo#191, empty-linter#99, modshells#119, plasma-parser-writer#98, robodog-defensive-systems-lab#145, twingate-helm-deploy#138, wokelang#147, laniakea#91, maa-framework#198, methodologies#92, rpa-elysium#134, scripts#136, universal-chat-extractor#165, verisimdb#280. Lift the hold once upstream clears 4.38.1 or a canary verifies green.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 83bac0b8-0a92-4491-b276-1d4fdcaae6a9

📥 Commits

Reviewing files that changed from the base of the PR and between c743ca8 and fe3301f.

📒 Files selected for processing (2)

• .github/dependabot.yml
• .github/workflows/codeql.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (34)

• GitHub Check: governance / Trusted-base reduction policy
• GitHub Check: governance / Guix primary / Nix fallback policy
• GitHub Check: governance / Workflow security linter
• GitHub Check: governance / Security policy checks
• GitHub Check: governance / Code quality + docs
• GitHub Check: governance / Well-Known (RFC 9116 + RSR)
• GitHub Check: governance / Language / package anti-pattern policy
• GitHub Check: governance / Check Workflow Staleness
• GitHub Check: hypatia / Hypatia Neurosymbolic Analysis
• GitHub Check: governance / Licence consistency
• GitHub Check: scan / shell-secrets
• GitHub Check: scan / rust-secrets
• GitHub Check: scan / gitleaks
• GitHub Check: rust-ci / Detect Cargo.toml
• GitHub Check: Validate DEED manifests
• GitHub Check: Empty-linter (invisible characters)
• GitHub Check: Validate K9 contracts
• GitHub Check: Validate eclexiaiser manifest
• GitHub Check: Groove manifest check
• GitHub Check: analyze (actions, none)
• GitHub Check: reuse-lint
• GitHub Check: openssf-compliance
• GitHub Check: Derive matrix from echidna provers.a2ml
• GitHub Check: Root workspace tests
• GitHub Check: E2E structural validation
• GitHub Check: panic-attack assail
• GitHub Check: Dependency audit
• GitHub Check: recompute-wasm — clippy / tests
• GitHub Check: Hypatia neurosymbolic scan
• GitHub Check: Aspect tests
• GitHub Check: idris2 0.8.0 --build vclut-core
• GitHub Check: attest — clippy / tests
• GitHub Check: vcltotal-parse — panic-free / clippy / tests
• GitHub Check: reuse-lint

🔇 Additional comments (2)

.github/workflows/codeql.yml (1)

45-45: LGTM!

Also applies to: 51-51

.github/dependabot.yml (1)

49-54: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated the CodeQL workflow to use the pinned v4.38.0 release.
  • Prevented automated dependency updates from moving CodeQL beyond the approved version.

Walkthrough

The CodeQL workflow now uses the v4.38.0 commit for its init and analyze steps. Dependabot ignores updates for github/codeql-action and documents the reason for this restriction.

Changes

CodeQL action version control

Layer / File(s)	Summary
Pin CodeQL action and suppress updates .github/workflows/codeql.yml, .github/dependabot.yml	The workflow changes both CodeQL action pins from the v3 commit to the v4.38.0 commit. Dependabot ignores updates for github/codeql-action. The existing workflow inputs remain unchanged.

Priority: ⬆️ High

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix · Severity of issue fixed: High

Merge Risk: ⚪ Minimal · up to fe330

The workflow is pinned to CodeQL v4.38.0 and Dependabot is held from reintroducing the failing update. No actionable merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the CodeQL action rollback, SHA pin update, and Dependabot hold. It is specific to the main changes.
Description check	✅ Passed	The description includes the required Summary and Changes sections and gives clear incident context, implementation details, references, and rollback conditions. The Testing and Screenshots sections c…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the action pin,
The workflow starts with care.
Dependabot waits outside,
While v4.38.0 stays there.
Code paths remain precise and clear.}

_{Comment @coderabbitai help to get the list of available commands.}