fix(ci): repoint codeql-action at a SHA that exists

[hyperpolymath]

github/codeql-action@29b1f65c1f735799893313399435a59f54045865 is pinned here but exists in no repository — the GitHub API returns 422 for it.

CodeQL therefore could not start: the run graph fails to build and the job reports startup_failure, so this repository has had no CodeQL scanning at all.

Repointed at 4187e74d05793876e9989daffde9c3e66b4acd07, which is what the v3 tag currently resolves to (v3.37.3), verified against the API.

Found while auditing the estate: the same non-existent SHA was pinned in 104 repositories, so CodeQL was dead across nearly all of them.

---

Summary by Gitar

• CI updates:
  • Repointed codeql-action to a valid SHA across workflows
  • Added actions: read permission to workflow files
• Project configuration:
  • Updated guix.scm metadata for squisher-corpus
• Cleanup:
  • Removed duplicate GOVERNANCE.adoc file

_{This will update automatically on new commits.}

[gitar-bot]

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

CI failed: CodeQL analysis failed because the repository contains no JavaScript/TypeScript source files to analyze, causing the scanner to exit with code 32.

Overview

1 failure found across 1 analyzed log, caused by a CodeQL configuration error when attempting to scan a repository without matching source files.

Failures

CodeQL Analysis Configuration Error (confidence: high)

• Type: configuration
• Affected jobs: 90324393072
• Related to change: yes
• Root cause: The CodeQL workflow is configured to analyze 'javascript-typescript' with build-mode: none, but the repository contains no valid JavaScript/TypeScript source files (only configuration/metadata files), causing CodeQL to fail with exit code 32.
• Suggested fix: Update the CodeQL workflow configuration in .github/workflows/codeql.yml to remove the unsupported language or add appropriate source files.

Summary

• Change-related failures: 1 CodeQL configuration failure due to missing source files for the scanned language.
• Infrastructure/flaky failures: None
• Recommended action: Review and update the CodeQL workflow configuration to match the repository's contents.

Code Review✅ Approved2 resolved / 2 findings

Updates CodeQL actions to a valid SHA and cleans up repository metadata, but guix.scm incorrectly points to the squisher-corpus project and contains a license declaration that contradicts its SPDX header.

✅ 2 resolved

✅ Bug: guix.scm repointed to wrong project (squisher-corpus)

📄 guix.scm:2📄 guix.scm:10📄 guix.scm:14📄 guix.scm:15📄 guix.scm:16
This is the polysafe-gitfixer repository, but guix.scm now identifies the package as "squisher-corpus" in its name, synopsis, description, and home-page (which points to github.com/hyperpolymath/squisher-corpus). This appears to be an accidental copy of another repo's package definition (commit "chore: update guix.scm from squisher-corpus") and is unrelated to the CodeQL fix this PR describes. Revert the identity fields back to polysafe-gitfixer.

✅ Quality: License declaration contradicts SPDX header in guix.scm

📄 guix.scm:1📄 guix.scm:17-18
Line 1 declares SPDX-License-Identifier: MPL-2.0, but the guix license field was changed to PMPL-1.0-or-later pointing at palimpsest-license. These two contradict each other, so tooling that reads either field will get inconsistent licensing info. Reconcile the header and the guix license field to the project's actual license (likely MPL-2.0 for this repo).

Tip

Comment Gitar fix CI to trigger a fix.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}