fix(ci): repoint codeql-action at a SHA that exists

[hyperpolymath]

github/codeql-action@29b1f65c1f735799893313399435a59f54045865 is pinned here but exists in no repository — the GitHub API returns 422 for it.

CodeQL therefore could not start: the run graph fails to build and the job reports startup_failure, so this repository has had no CodeQL scanning at all.

Repointed at 4187e74d05793876e9989daffde9c3e66b4acd07, which is what the v3 tag currently resolves to (v3.37.3), verified against the API.

Found while auditing the estate: the same non-existent SHA was pinned in 104 repositories, so CodeQL was dead across nearly all of them.

---

Summary by Gitar

• Security and governance:
  • Added estate-wide SECURITY.md policy and removed duplicate governance documentation
  • Updated workflow permissions across multiple CI configurations for security compliance

_{This will update automatically on new commits.}

[gitar-bot]

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

Code Review ✅ Approved 2 resolved / 2 findings

Updates CI workflows and governance files for security compliance, but the new SECURITY.md is an uncustomized template and CodeQL is misconfigured to only scan actions instead of the core parser source.

✅ 2 resolved

✅ Security: SECURITY.md is an uncustomized template for the wrong project

📄 SECURITY.md:3-17 📄 SECURITY.md:43 📄 SECURITY.md:63 📄 SECURITY.md:206 📄 SECURITY.md:325 📄 SECURITY.md:374 📄 SECURITY.md:386-388
The new SECURITY.md still contains the template instruction block ("delete this block before publishing") and references the wrong project throughout: it names the project "Squisher Corpus" and points every vulnerability-reporting link at github.com/hyperpolymath/squisher-corpus (e.g. the advisory link at line 43, scope at line 206, advisories/discussions at lines 325, 374, 386–388), not this repository (tree-sitter-k9). The PGP fingerprint is also left as TBD, so the verification steps at lines 63–70 cannot be followed. A security policy that routes reporters to a different/nonexistent repo can cause vulnerability reports to be lost or misdirected. Replace the placeholders with the correct repo name/URLs and real PGP fingerprint, and delete the template comment block.

✅ Quality: CodeQL only scans 'actions', not the C/Rust/JS source

📄 .github/workflows/codeql.yml:27-30
The workflow matrix analyzes only language: actions, but this repo ships C (src/parser.c, bindings/node/binding.cc), Rust (bindings/rust), and JavaScript/TypeScript (index.js, tests/*.ts) that CodeQL can scan. The PR's stated goal is to restore CodeQL coverage that was dead, yet this configuration leaves the actual parser/binding code unscanned. Add matrix entries for the source languages (e.g. c-cpp and javascript-typescript, plus rust if desired) so security analysis covers the code, not just the workflow files.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud