[hyperpolymath]

Summary

Estate-wide incident: github/codeql-action v4.38.1 fails GitHub workflow startup on every repo that took it — CodeQL/Hypatia runs die with startup_failure, zero jobs dispatched, no error text in any API surface. The evidence chain (full detail: nexia-list#100):

repo	ref	status
nexia-list	@v4.38.1 tag (via dependabot #94)	🔴 startup_failure → fixed by rollback #100 (merged)
hypatia	@1c5b675 (4.38.1 SHA)	🔴
vexometer	@v4.38.1	🔴 (since Sep-21)
rsr-template-repo	@1c5b675	🔴
affinescript / boj-server / deed-ecosystem	≤ v4.38.0	✅ green

The v4.38.1 tag exists (peels to 1c5b675) and byte-identical workflow content runs under a fresh path — so the failure is the version value itself at GitHub's start-validation layer, not content, permissions (probes with security-events start fine), or the default-setup conflict.

Changes here

• codeql-reusable.yml, hypatia-scan-reusable.yml: codeql-action/* re-pinned 1c5b675 (v4.38.1) → b96794f0 (v4.38.0 commit; wrong # v3 comments corrected to # v4.38.0).
• actions.lock: re-keyed to the v4.38.0 SHA entries (dependabot bumped the reusable pins without regenerating the lock).
• dependabot.yml: full hold on github/codeql-action — scoped versions: ignores do NOT hold for this bot path (nexia-list#101 re-raised the bump in SHA form within an hour, copying the inline warning comment verbatim while swapping the SHA).

Follow-ups

Consumer rollbacks shipped in the same batch: nexia-list (merged ✅), hypatia, vexometer, rsr-template-repo, metadatastician/burble (each with the same dependabot hold). Reconsider the hold when upstream clears v4.38.1 or a newer release verifies green on one canary repo.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 3874ed5a-b5f0-4c64-822a-4744515f98ac

📥 Commits

Reviewing files that changed from the base of the PR and between 90b075e and fee5733.

⛔ Files ignored due to path filters (1)

• .github/workflows/actions.lock is excluded by !**/*.lock

📒 Files selected for processing (2)

• .github/dependabot.yml
• .github/workflows/codeql.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (22)

• GitHub Check: governance / Exemption ratchet
• GitHub Check: governance / Code quality + docs
• GitHub Check: governance / Debt ratchet
• GitHub Check: governance / Security policy checks
• GitHub Check: governance / Live Actions policy (credentialed advisory)
• GitHub Check: governance / Guix packaging policy (Nix retired)
• GitHub Check: governance / Workflow security linter
• GitHub Check: governance / Check Workflow Staleness
• GitHub Check: governance / Allowlist Preflight
• GitHub Check: governance / Well-Known (RFC 9116 + RSR)
• GitHub Check: governance / Licence consistency
• GitHub Check: governance / Trusted-base reduction policy
• GitHub Check: governance / Language / package anti-pattern policy
• GitHub Check: scan / rust-secrets
• GitHub Check: hypatia / Hypatia Neurosymbolic Analysis
• GitHub Check: scan / shell-secrets
• GitHub Check: scan / gitleaks
• GitHub Check: analyze (actions, none)
• GitHub Check: Empty-linter (invisible characters)
• GitHub Check: Validate DEED manifests
• GitHub Check: Validate K9 contracts
• GitHub Check: Groove manifest check

🔇 Additional comments (2)

.github/workflows/codeql.yml (1)

51-51: LGTM!

Also applies to: 57-57

.github/dependabot.yml (1)

16-23: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Pinned CodeQL workflow actions to a validated version to ensure workflow startup reliability.
  • Prevented automated update suggestions for the affected CodeQL action until a compatible version is available.

Walkthrough

The CodeQL workflow now uses the SHA for v4.38.0. Dependabot ignores updates for github/codeql-action while v4.38.1 remains blocked.

Changes

CodeQL action pinning

Layer / File(s)	Summary
Pin CodeQL actions and Dependabot updates .github/workflows/codeql.yml, .github/dependabot.yml	The workflow pins the CodeQL init and analyze actions to commit b96794f015dfd88f77b49b1c93e0fa7110f94c63. Dependabot ignores updates for github/codeql-action.

Priority: ⬆️ High

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to fee57

The rollback avoids the reported startup failures while retaining a consistent pinned action revision. No merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the CodeQL rollback, SHA pin, and Dependabot hold. It accurately reflects the main changes.
Description check	✅ Passed	The description directly explains the v4.38.1 startup failures, the rollback to v4.38.0, and the Dependabot hold. It is relevant to the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the workflow gate
SHA-pinned steps now start on time
Dependabot waits beside the crate
While v4.38.1 stays behind
The CodeQL path remains precise}

_{Comment @coderabbitai help to get the list of available commands.}