fix(ci): repoint codeql-action at a SHA that exists

[hyperpolymath]

github/codeql-action@29b1f65c1f735799893313399435a59f54045865 is pinned here but exists in no repository — the GitHub API returns 422 for it.

CodeQL therefore could not start: the run graph fails to build and the job reports startup_failure, so this repository has had no CodeQL scanning at all.

Repointed at 4187e74d05793876e9989daffde9c3e66b4acd07, which is what the v3 tag currently resolves to (v3.37.3), verified against the API.

Found while auditing the estate: the same non-existent SHA was pinned in 104 repositories, so CodeQL was dead across nearly all of them.

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[gitar-bot]

CI failed: Multiple CI job failures due to a missing requirements.txt file, a malformed Cargo.lock file with duplicate entries and unresolved dependencies, and a governance violation from a banned ReScript file.

Overview

Analysis of 7 CI logs across 5 unique failure templates revealed configuration errors, build errors, and dependency issues. The failures stem from missing configuration/dependency files (requirements.txt), malformed lockfiles (Cargo.lock), and repository policy violations (banned ReScript file).

Failures

Missing Requirements File (confidence: high)

• Type: configuration
• Affected jobs: 90323410795, 90323410823, 90323410759, 90323410785
• Related to change: yes
• Root cause: The workflow attempts to install dependencies using pip install -r requirements.txt, but requirements.txt does not exist in the repository root.
• Suggested fix: Add requirements.txt to the repository root or update the workflow to point to the correct dependency file path.

Malformed Cargo.lock & Unresolved Dependencies (confidence: high)

• Type: build
• Affected jobs: 90323488207, 90323488234
• Related to change: yes
• Root cause: The Cargo.lock file is malformed (package prettyplease specified twice) and contains an unresolvable dependency (r-efi 5.3.0), causing cargo metadata parsing errors and cargo-audit panics.
• Suggested fix: Regenerate the lockfile locally by running cargo generate-lockfile or cargo update, then commit the updated Cargo.lock.

Banned Language File Compliance Failure (confidence: high)

• Type: build
• Affected jobs: 90323413075
• Related to change: yes
• Root cause: Hypatia compliance check detected a ReScript file (web/src/WasmLoader.res), which violates the banned language policy (cicd_rules/banned_language_file).
• Suggested fix: Remove or convert web/src/WasmLoader.res to AffineScript, or add a proper inline pragma/exemption if intentional.

Summary

• Change-related failures: 3 root-cause failure categories affecting all 7 failed logs (missing requirements.txt, malformed Cargo.lock, and banned ReScript governance violation).
• Infrastructure/flaky failures: 0 infrastructure or flaky failures.
• Recommended action: Rebuild and clean up Cargo.lock, add or correct requirements.txt, and address or exempt the banned ReScript file before re-running CI.

Code Review ✅ Approved

Repoints the CodeQL workflow action to a valid, verified SHA to restore functional security scanning. No issues found.

Auto-approved and auto-merge armed: No blocking issues found.
Please see Auto-approve Docs for details on setting custom approval criteria. — merges when pipeline and required approvals pass.

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[gitar-bot]

⚠️ Gitar auto-approved this PR but could not enable auto-merge: auto-merge is disabled for this repository — enable "Allow auto-merge" in the repository settings.

[gitar-bot]

Gitar has auto-approved this PR and enabled auto-merge (configure)