fix(ci): repoint codeql-action at a SHA that exists - #142
Merged
Conversation
github/codeql-action@29b1f65 is pinned here but exists in no repository -- the GitHub API returns 422 for it. CodeQL therefore could not start: the run graph fails to build and the job reports startup_failure, so this repository has had no CodeQL scanning at all. Repointed at 4187e74d05793876e9989daffde9c3e66b4acd07, which is what the v3 tag currently resolves to (v3.37.3), verified against the API. Found while auditing the estate: the same non-existent SHA is pinned in over 100 repositories, so CodeQL is dead across nearly all of them. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
Code Review ✅ ApprovedRepoints the CodeQL action at a valid, existing SHA to restore broken security scanning workflows across the repository. No issues found.
OptionsAuto-apply is off → Gitar will not commit updates to this branch. Comment with these commands to change the behavior for this request:
Was this helpful? React with 👍 / 👎 | Gitar |
|
|
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| @@ -0,0 +1 @@ | |||
| Subproject commit 03921529b45f16ee21a5c4a903935f0d22433665 | |||
hyperpolymath
added a commit
that referenced
this pull request
Jul 28, 2026
…s live on main) (#143) ## Urgent: a licence misstatement is currently live on the public default branch `guix.scm` on `main` declares this repository as **`squisher-corpus`** under **`PMPL-1.0-or-later`**. It is neither — this is `maa-framework`, MPL-2.0. ```diff - (name "squisher-corpus") + (name "maa-framework") - (synopsis "squisher-corpus") + (synopsis "maa-framework") - (home-page ".../hyperpolymath/squisher-corpus") + (home-page ".../hyperpolymath/maa-framework") - "PMPL-1.0-or-later" + "MPL-2.0" ``` Restored verbatim from `7b6a293`, the last commit where it was correct. **One file, six lines.** ## How it got here An automated sweep on **2026-07-26 ~16:00 BST** copied `hyper-repos/squisher-corpus/guix.scm` **byte-for-byte** into a large number of estate repos rather than generating one per repo. The sweep's own commit message names the bug: `chore: update guix.scm from squisher-corpus`. In this repo it first appeared as local commit `f06ea94`, which was dropped on 2026-07-27 — `origin/main` was still clean at `7b6a293` at that point. **It reached `origin/main` anyway, via #142** (`fix(ci): repoint codeql-action at a SHA that exists`), a CI fix that swept up an unrelated dirty working-tree file. This is the `commit -a` on a dirty tree hazard. ## Why this matters beyond cosmetics 1. **Identity** — the package advertises the wrong name and home-page. 2. **Licence** — MPL-2.0 was replaced with `PMPL-1.0-or-later` on a public default branch. `absolute-zero/.claude/CLAUDE.md` lists `PMPL-1.0` / `PMPL-1.0-or-later` as **BANNED** ("License: MPL-2.0 only"), so this is a policy violation as well as a factual error. ## Scope check `.editorconfig` and `aletheia/.editorconfig` on `main` are **clean** — `guix.scm` is the only affected file in this repository. ## Wider context (not fixed here) A scan of **279 repos against their ORIGIN refs** finds **65 clobbered `guix.scm` files across 52 repositories**, including `standards`. An earlier scan against local working trees reported only 9 — it undercounted roughly 6× because repos whose local checkout lags origin were invisible to it. Tracked separately; this PR fixes only this repository. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
hyperpolymath
added a commit
that referenced
this pull request
Jul 29, 2026
…ut (#145) ## The last red check on `main` `.claude/worktrees/maa-ci-repair` is committed on `main` as a **gitlink** (mode `160000`, pointing at `0392152`) with **no matching entry in `.gitmodules`**. Git treats that as an unmapped submodule and refuses: ``` ##[error]fatal: No url found for submodule path '.claude/worktrees/maa-ci-repair' in .gitmodules ##[error]The process '/usr/bin/git' failed with exit code 128 ``` That is the **OSSF Scorecard** failure on `main`. It dies during checkout, **before running a single scorecard probe** — so the red tick says nothing about this repo's actual security posture. It also breaks any `git clone --recurse-submodules` and any `actions/checkout` with `submodules: true`. ## Where it came from A Claude Code worktree is local scratch and must never be tracked. It was committed by accident in **#142** (`fix(ci): repoint codeql-action at a SHA that exists`) — the same `commit -a`-on-a-dirty-tree that carried the `squisher-corpus` `guix.scm` clobber onto `main` (fixed separately in #143). One careless `-a`, two unrelated defects. ## Why this shape matters **This repo has been bitten by exactly this before.** Commit `639f389` (2026-02-21) left `aletheia` as a gitlink with no `.gitmodules` entry. A gitlink *without* its mapping resolves to a silently-empty directory — git's quietest failure mode — and that one went unnoticed for over a month until the pointer was swept away and 361 files were vendored in its place. ## Fix - `git rm --cached .claude/worktrees/maa-ci-repair` — index only, contents untouched on disk - add `.claude/worktrees/` to `.gitignore` so it cannot recur ## Verification ``` $ git submodule status 87902bb770e767c10e065d9ac75d111e80a01be1 absolute-zero (heads/main) # exit 0 $ git check-ignore -v .claude/worktrees/maa-ci-repair .gitignore:136:.claude/worktrees/ .claude/worktrees/maa-ci-repair ``` Only `absolute-zero` remains, which is the one genuine submodule and is correctly mapped. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
github/codeql-action@29b1f65c1f735799893313399435a59f54045865is pinned here but exists in no repository — the GitHub API returns 422 for it.CodeQL therefore could not start: the run graph fails to build and the job reports
startup_failure, so this repository has had no CodeQL scanning at all.Repointed at
4187e74d05793876e9989daffde9c3e66b4acd07, which is what thev3tag currently resolves to (v3.37.3), verified against the API.Found while auditing the estate: the same non-existent SHA was pinned in 104 repositories, so CodeQL was dead across nearly all of them.