fix(ci): repoint codeql-action at a SHA that exists

[hyperpolymath]

github/codeql-action@29b1f65c1f735799893313399435a59f54045865 is pinned here but exists in no repository — the GitHub API returns 422 for it.

CodeQL therefore could not start: the run graph fails to build and the job reports startup_failure, so this repository has had no CodeQL scanning at all.

Repointed at 4187e74d05793876e9989daffde9c3e66b4acd07, which is what the v3 tag currently resolves to (v3.37.3), verified against the API.

Found while auditing the estate: the same non-existent SHA was pinned in 104 repositories, so CodeQL was dead across nearly all of them.

---

Summary by Gitar

• CI/CD updates:
  • Updated codeql.yml workflow actions to use a valid codeql-action SHA 4187e74d05793876e9989daffde9c3e66b4acd07
  • Added actions: read permission to pages.yml workflow
  • Added Dependabot configuration file dependabot.yml for multi-ecosystem updates
• Security and documentation:
  • Added comprehensive SECURITY.md, CODE_OF_CONDUCT.md, and CONTRIBUTING.md policy files
  • Removed duplicate GOVERNANCE.md file

_{This will update automatically on new commits.}

[gitar-bot]

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

CI failed: CodeQL Analysis failed with a configuration error because an advanced workflow configuration was used while GitHub's default CodeQL setup is already enabled on the repository.

Overview

1 configuration error found in the CodeQL Analysis workflow due to a conflict between GitHub's default CodeQL setup and an advanced custom workflow configuration.

Failures

CodeQL Configuration Conflict (confidence: high)

• Type: configuration
• Affected jobs: 90324207500
• Related to change: yes
• Root cause: CodeQL analyses from advanced configurations cannot be processed when the default setup is enabled on the repository.
• Suggested fix: Disable CodeQL default setup in the repository's GitHub security settings, or remove the custom workflow file if relying entirely on default setup.

Summary

• Change-related failures: 1 configuration error (CodeQL advanced workflow vs. default setup conflict)
• Infrastructure/flaky failures: 0
• Recommended action: Review the repository's security settings on GitHub and either disable CodeQL default setup or adjust the workflow configuration to avoid the conflict.

Code Review ✅ Approved 3 resolved / 3 findings

Updates the CodeQL action SHA, adds security policies, and introduces Dependabot configuration, but the CONTRIBUTING.md file is truncated and the governance templates contain incorrect repository placeholders for 'squisher-corpus'.

✅ 3 resolved

✅ Quality: CONTRIBUTING.md is malformed/truncated markdown

📄 CONTRIBUTING.md:1-15 📄 CONTRIBUTING.md:111-116
The file opens at line 1 with # Clone the repository (rendered as an H1 heading, not a shell comment) and line 16 has a closing code fence with no matching opening fence — the top of the document (title, intro, and the openingbash fence) is missing. It also ends at line 116 with [optional footer] inside an unclosed code fence. As written, GitHub will render this file garbled. Restore the missing header/opening fence and close the trailing code block.

✅ Quality: dependabot.yml enables ecosystems the repo may not use

📄 .github/dependabot.yml:29-43
The config unconditionally enables cargo, mix, npm, pip, and nix ecosystems. For any ecosystem lacking a manifest in the repo, Dependabot logs recurring update-job errors (visible under Insights > Dependency graph > Dependabot). The template comment already advises removing unused ecosystems — trim the list to those actually present (e.g. github-actions plus the languages this repo builds) to avoid noise.

✅ Security: Security/CoC docs point to wrong repo (squisher-corpus placeholders)

📄 SECURITY.md:8-14 📄 SECURITY.md:43-46 📄 SECURITY.md:206 📄 SECURITY.md:325 📄 SECURITY.md:386-387 📄 CODE_OF_CONDUCT.md:8-14 📄 CODE_OF_CONDUCT.md:25 📄 CODE_OF_CONDUCT.md:313 📄 CONTRIBUTING.md:2-3 📄 CONTRIBUTING.md:89-92
These templates were committed with placeholders unresolved: they reference project "Squisher Corpus" and repo hyperpolymath/squisher-corpus, but this repository is network-outpost. Vulnerability-reporting links such as https://github.com/hyperpolymath/squisher-corpus/security/advisories/new therefore send reporters to the wrong (likely nonexistent) repository, and the PGP fingerprint is left as TBD. Replace all placeholders with the real project name, repo path, and key fingerprint (or remove the PGP section), and delete the TEMPLATE INSTRUCTIONS comment blocks before publishing.

Tip

Comment Gitar fix CI to trigger a fix.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud