From 7f94f4d0736a7eccb8c5e52b01d537a4c489e973 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 28 Jul 2026 19:37:32 +0100 Subject: [PATCH] fix(ci): actually repoint codeql-action at a SHA that exists github/codeql-action@29b1f65c1f735799893313399435a59f54045865 exists in no repository -- the GitHub API returns 422 -- so CodeQL could not build its run graph and reported startup_failure in 0 seconds. This repository has had no CodeQL scanning at all. Repointed at 4187e74d05793876e9989daffde9c3e66b4acd07, what the v3 tag resolves to (v3.37.3), verified against the API. Supersedes an earlier attempt that branched from the local checkout's HEAD rather than origin/main. Where the two had drifted, that commit carried an unrelated diff and left the workflow untouched, so the fix appeared to land while main still pinned the dead SHA. Co-Authored-By: Claude Opus 5 Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> --- .github/workflows/codeql.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 6487389..8c3c43a 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -38,11 +38,11 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@29b1f65c1f735799893313399435a59f54045865 # v3 + uses: github/codeql-action/init@4187e74d05793876e9989daffde9c3e66b4acd07 # v3 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@29b1f65c1f735799893313399435a59f54045865 # v3 + uses: github/codeql-action/analyze@4187e74d05793876e9989daffde9c3e66b4acd07 # v3 with: category: "/language:${{ matrix.language }}"