fix(ci): repoint codeql-action at a SHA that exists

[hyperpolymath]

github/codeql-action@29b1f65c1f735799893313399435a59f54045865 is pinned here but exists in no repository — the GitHub API returns 422 for it.

CodeQL therefore could not start: the run graph fails to build and the job reports startup_failure, so this repository has had no CodeQL scanning at all.

Repointed at 4187e74d05793876e9989daffde9c3e66b4acd07, which is what the v3 tag currently resolves to (v3.37.3), verified against the API.

Found while auditing the estate: the same non-existent SHA was pinned in 104 repositories, so CodeQL was dead across nearly all of them.

---

Summary by Gitar

• CI updates:
  • Updated guix.scm package definition and metadata for squisher-corpus
  • Added actions: read permission across workflow files alongside CodeQL SHA repointing

_{This will update automatically on new commits.}

[gitar-bot]

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

CI failed: CI governance gate failure due to banned ReScript source files detected in the repository.

Overview

1 log analyzed across 1 job. The CI build failed because governance checks detected tracked ReScript (.res) source files, which are banned in favor of AffineScript.

Failures

Banned Language Files Detected (confidence: high)

• Type: tooling
• Affected jobs: 90323705350
• Related to change: yes
• Root cause: The cicd_rules/banned_language_file check found tracked ReScript files (such as test/Community_test.res) violating repository language standards.
• Suggested fix: Remove or migrate the banned ReScript files to AffineScript, or add an exemption via .hypatia-ignore / an inline pragma if intentional.

Summary

• Change-related failures: 1 governance check failure due to banned ReScript source files.
• Infrastructure/flaky failures: 0
• Recommended action: Remove or migrate the banned ReScript files or declare the appropriate exemption in .hypatia-ignore.

Code Review ✅ Approved 2 resolved / 2 findings

Updates CodeQL action references to a valid SHA and adds workflow permissions, but the guix.scm update incorrectly transforms the package definition into squisher-corpus with a contradictory license header.

✅ 2 resolved

✅ Bug: guix.scm repointed to wrong package (squisher-corpus) in grim-repo

📄 guix.scm:2 📄 guix.scm:10 📄 guix.scm:14-17
This file is grim-repo's package definition, but the diff renames the package, synopsis, description, and home-page to squisher-corpus (home-page now https://github.com/hyperpolymath/squisher-corpus). This appears to be a copy-paste from another repo (commit chore: update guix.scm from squisher-corpus) and makes guix shell -f guix.scm build a package that misidentifies the repository. Restore the grim-repo name, synopsis, description, and home-page URL.

✅ Quality: License field contradicts SPDX header in guix.scm

📄 guix.scm:1 📄 guix.scm:17
The SPDX header on line 1 still declares MPL-2.0, but the diff changes the package license field to PMPL-1.0-or-later. These two license declarations now conflict, leaving the effective license of the package ambiguous. Reconcile them so the SPDX identifier and the guix license field agree.

Tip

Comment Gitar fix CI to trigger a fix.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE