fix(ci): repoint codeql-action at a SHA that exists

[hyperpolymath]

github/codeql-action@29b1f65c1f735799893313399435a59f54045865 is pinned here but exists in no repository — the GitHub API returns 422 for it.

CodeQL therefore could not start: the run graph fails to build and the job reports startup_failure, so this repository has had no CodeQL scanning at all.

Repointed at 4187e74d05793876e9989daffde9c3e66b4acd07, which is what the v3 tag currently resolves to (v3.37.3), verified against the API.

Found while auditing the estate: the same non-existent SHA was pinned in 104 repositories, so CodeQL was dead across nearly all of them.

---

Summary by Gitar

• CI and workflows:
  • Updated guix.scm package definition for squisher-corpus and changed license
  • Added explicit actions: read permissions across workflow files
  • Removed duplicate GOVERNANCE.adoc documentation file

_{This will update automatically on new commits.}

[gitar-bot]

💡 Quality: License mismatch: SPDX header MPL-2.0 vs field PMPL-1.0-or-later

The SPDX header on line 1 still declares MPL-2.0, while the package license field was changed to PMPL-1.0-or-later. These now disagree, which confuses license tooling and downstream consumers. Make the SPDX identifier and the license field consistent (and confirm which license actually applies to this repo).

_{Was this helpful? React with 👍 / 👎}

[gitar-bot]

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

CI failed: 3 CI failures due to configuration issues: a CodeQL analysis failure from missing JavaScript/TypeScript source files, an unpinned action reference in workflow validation, and a duplicate CLI flag passed to TruffleHog.

Overview

Three distinct configuration and setup issues caused CI jobs to fail across the workflow suite, including a CodeQL language mismatch, an unpinned GitHub action reference violating repository security policy, and a duplicate argument error in the TruffleHog security scanner.

Failures

CodeQL Database Finalization Failure (confidence: high)

• Type: configuration
• Affected jobs: 90324943700
• Related to change: yes
• Root cause: The CodeQL workflow is configured to analyze JavaScript/TypeScript (languages: javascript-typescript), but the repository contains no valid JavaScript/TypeScript source files, causing database finalization to fail with exit code 32.
• Suggested fix: Update the CodeQL workflow configuration to specify the correct programming languages present in the repository instead of javascript-typescript.

Unpinned Action in Workflow Validation (confidence: high)

• Type: configuration
• Affected jobs: 90324946249
• Related to change: yes
• Root cause: The workflow file .github/workflows/secret-scanner.yml uses an unpinned action reference (uses: trufflesecurity/trufflehog@main) on line 24, violating the repository's SHA-pinning policy.
• Suggested fix: Update .github/workflows/secret-scanner.yml to pin trufflesecurity/trufflehog@main to a full 40-character commit SHA.

TruffleHog Duplicate Flag Error (confidence: high)

• Type: configuration
• Affected jobs: 90324946106
• Related to change: no
• Root cause: The TruffleHog action is configured with extra_args: --only-verified --fail, but the action implicitly supplies the --fail flag, causing a duplicate flag error (trufflehog: error: flag 'fail' cannot be repeated).
• Suggested fix: Remove --fail from extra_args in the TruffleHog action step configuration.

Summary

• Change-related failures: 2 failures (CodeQL analysis failing due to empty/absent JS/TS files, and an unpinned action in .github/workflows/secret-scanner.yml failing policy checks)
• Infrastructure/flaky failures: 0 infrastructure or flaky failures
• Recommended action: Update the CodeQL workflow languages, pin the TruffleHog action reference to a full commit SHA in secret-scanner.yml, and remove the duplicate --fail flag from the TruffleHog action configuration.

Code Review 👍 Approved with suggestions 1 resolved / 2 findings

Pins the CodeQL action to a valid SHA and updates estate-wide security compliance, but renames the guix.scm package to squisher-corpus and introduces an SPDX license mismatch.

💡 Quality: License mismatch: SPDX header MPL-2.0 vs field PMPL-1.0-or-later

📄 guix.scm:1 📄 guix.scm:17

The SPDX header on line 1 still declares MPL-2.0, while the package license field was changed to PMPL-1.0-or-later. These now disagree, which confuses license tooling and downstream consumers. Make the SPDX identifier and the license field consistent (and confirm which license actually applies to this repo).

✅ 1 resolved

✅ Bug: guix.scm renamed to wrong project 'squisher-corpus'

📄 guix.scm:2 📄 guix.scm:10 📄 guix.scm:14 📄 guix.scm:15 📄 guix.scm:16
This is the universal-chat-extractor repository, but the package definition was rewritten to name/synopsis/description/home-page squisher-corpus (matching commit 863d4dd "update guix.scm from squisher-corpus"). This looks like an errant copy from another repo: guix shell -f guix.scm now builds a package pointing at github.com/hyperpolymath/squisher-corpus instead of this repo. Restore the universal-chat-extractor name, synopsis, description, and home-page.

🤖 Prompt for agents

Code Review: Pins the CodeQL action to a valid SHA and updates estate-wide security compliance, but renames the guix.scm package to squisher-corpus and introduces an SPDX license mismatch.

1. 💡 Quality: License mismatch: SPDX header MPL-2.0 vs field PMPL-1.0-or-later
   Files: guix.scm:1, guix.scm:17

   The SPDX header on line 1 still declares `MPL-2.0`, while the package `license` field was changed to `PMPL-1.0-or-later`. These now disagree, which confuses license tooling and downstream consumers. Make the SPDX identifier and the license field consistent (and confirm which license actually applies to this repo).

Tip

Comment Gitar fix CI to trigger a fix.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}