fix(ci): repoint codeql-action at a SHA that exists

[hyperpolymath]

github/codeql-action@29b1f65c1f735799893313399435a59f54045865 is pinned here but exists in no repository — the GitHub API returns 422 for it.

CodeQL therefore could not start: the run graph fails to build and the job reports startup_failure, so this repository has had no CodeQL scanning at all.

Repointed at 4187e74d05793876e9989daffde9c3e66b4acd07, which is what the v3 tag currently resolves to (v3.37.3), verified against the API.

Found while auditing the estate: the same non-existent SHA was pinned in 104 repositories, so CodeQL was dead across nearly all of them.

[gitar-bot]

CI failed: CI failed due to a Gitleaks security scan detecting 8 secrets and a governance check finding banned ReScript files in the repository.

Overview

Two change-related failures occurred across the CI run: a Gitleaks security scan failure detecting 8 sensitive secrets/leaks, and a governance compliance check failing due to the presence of banned ReScript (.res) source files.

Failures

Gitleaks Secrets Detection Failure (confidence: high)

• Type: tooling
• Affected jobs: 90324319718
• Related to change: yes
• Root cause: Gitleaks found 8 potential secrets or sensitive data items within the repository during its detection scan.
• Suggested fix: Review the Gitleaks scan output to identify the detected secrets, remove or properly redact them from the repository, or add necessary exceptions/gitleaks-ignore rules if they are false positives.

Banned Language File Governance Check Failure (confidence: high)

• Type: build
• Affected jobs: 90324326594
• Related to change: yes
• Root cause: The governance compliance check cicd_rules/banned_language_file flagged ReScript files (*.res) which are disallowed by repository standards in favor of AffineScript.
• Suggested fix: Remove or migrate the banned ReScript (.res) files to AffineScript, or add appropriate # hypatia:ignore cicd_rules/banned_language_file pragmas or .hypatia-ignore entries if intentional.

Summary

• Change-related failures: 2 failures (Gitleaks secret detection findings and banned ReScript files violating governance rules)
• Infrastructure/flaky failures: 0
• Recommended action: Clean up or remove the detected secrets flagged by Gitleaks, and either remove/migrate the banned ReScript files or apply the proper hypatia ignore pragmas.

Code Review ✅ Approved

Repoints the CodeQL action to a valid, verified SHA to restore broken security scanning workflows across the repository. No issues found.

Auto-approved and auto-merge armed: No blocking issues found.
Please see Auto-approve Docs for details on setting custom approval criteria. — merges when pipeline and required approvals pass.

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[gitar-bot]

⚠️ Gitar auto-approved this PR but could not enable auto-merge: auto-merge is disabled for this repository — enable "Allow auto-merge" in the repository settings.

[gitar-bot]

Gitar has auto-approved this PR and enabled auto-merge (configure)