fix(ci): repoint codeql-action at a SHA that exists - #48
Conversation
github/codeql-action@29b1f65 is pinned here but exists in no repository -- the GitHub API returns 422 for it. CodeQL therefore could not start: the run graph fails to build and the job reports startup_failure, so this repository has had no CodeQL scanning at all. Repointed at 4187e74d05793876e9989daffde9c3e66b4acd07, which is what the v3 tag currently resolves to (v3.37.3), verified against the API. Found while auditing the estate: the same non-existent SHA is pinned in over 100 repositories, so CodeQL is dead across nearly all of them. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
CI failed: CodeQL analysis failed because it was configured to analyze JavaScript/TypeScript, but the repository contains no source code for those languages.Overview1 CodeQL failure found due to a configuration mismatch where JavaScript/TypeScript analysis was run on a repository lacking JS/TS source files. FailuresCodeQL JavaScript Analysis Failure (confidence: high)
Summary
Code Review ✅ ApprovedRepoints the CodeQL action to a valid SHA to restore security scanning across the repository, alongside standard CI workflow permission updates and package definitions. No issues found.
Tip Comment OptionsAuto-apply is off → Gitar will not commit updates to this branch. Comment with these commands to change the behavior for this request:
Was this helpful? React with 👍 / 👎 | Gitar |
|
|
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
|
1 participant
github/codeql-action@29b1f65c1f735799893313399435a59f54045865is pinned here but exists in no repository — the GitHub API returns 422 for it.CodeQL therefore could not start: the run graph fails to build and the job reports
startup_failure, so this repository has had no CodeQL scanning at all.Repointed at
4187e74d05793876e9989daffde9c3e66b4acd07, which is what thev3tag currently resolves to (v3.37.3), verified against the API.Found while auditing the estate: the same non-existent SHA was pinned in 104 repositories, so CodeQL was dead across nearly all of them.
Summary by Gitar
actions: readpermission across workflow filesguix.scmpackage definition and removed duplicateGOVERNANCE.adocfileThis will update automatically on new commits.