[hyperpolymath]

Summary

Clears the last failure in Governance / Actions lockfile verify, which has been red on main since before #8. codeql.yml called github/codeql-action at a bare commit SHA. The gate flags that as sha-as-ref, the one finding it does not accept. The same reference was also broken at runtime: with no subpath it runs the repository root of codeql-action, which is a stub that prints "This is a stub" and exits 1. That is why both runs this workflow ever made (5 Oct) failed.

Changes

• codeql.yml: the two steps call github/codeql-action/init@v4.38.0 and github/codeql-action/analyze@v4.38.0. This is the same release as before. 4.38.1 stays held, per dependabot.yml and nexia-list#100.
• actions.lock:
  • codeql.yml now lists github/codeql-action@v4.38.0.
  • A new dependency record pins that tag to commit b96794f0 (owner 9919, repo 259445878), so a moved tag is refused at startup. git ls-remote confirms refs/tags/v4.38.0^{} is b96794f015dfd88f77b49b1c93e0fa7110f94c63.
  • The record keyed by the bare SHA is removed, because nothing else references it. The cdf488f5 record stays, because a standards dependency still reaches it.
• dependabot.yml: the hold comment said "SHA-pinned"; it now says where the commit is held.

RSR Quality Checklist

Required

• Tests pass: scripts/check-lock-sync.sh reports the lock in sync and transitively closed, exit 0.
• Code is formatted (lock keys stay in LC_ALL=C order)
• Linter is clean: scripts/check-action-pinning.js reports all action refs pinned; actionlint is clean on codeql.yml.
• No banned language patterns
• No unsafe blocks without // SAFETY: comments (none touched)
• No banned functions (none touched)
• SPDX license headers present on all new/modified source files (headers unchanged)
• No secrets, credentials, or .env files included

As Applicable

• .machine_readable/descriptiles/STATE.a2ml updated (not applicable: CI configuration only)
• Documentation updated for user-facing changes (not applicable)
• CHANGELOG or release notes updated (not applicable)

Testing

• Locally: the three checks above.
• On this PR: Governance / Actions lockfile verify should go green, with only the "Accepted reusable-workflow lock coverage" lines left in its log. Every other workflow should start as it did on main at 759b651.
• The CodeQL workflow itself is disabled_manually in this repository's Actions settings, along with about 25 others since 6 Oct. So this PR does not run it. Re-enable it in the Actions tab if you want the scan; it should then run instead of hitting the stub.

The commit is SSH-signed. The branch name is this session's work branch, restarted from main after #8 merged.

🤖 Generated with Claude Code

https://claude.ai/code/session_01MF5GeeBBDF6sUzr6pZTjWV

---

Generated by Claude Code

[coderabbitai]

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Free
• Run ID: 632e75ca-b0c8-4d5f-926c-359bbab92691

📥 Commits

Reviewing files that changed from the base of the PR and between 759b651 and c582fce.

⛔ Files ignored due to path filters: 1

• .github/workflows/actions.lock is excluded by !**/*.lock

📒 Files selected for processing: 2

• .github/dependabot.yml
• .github/workflows/codeql.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated the CodeQL workflow to use version 4.38.0 for its separate initialization and analysis steps.
  • Updated the workflow’s version note to identify the pinned release and the file recording the pin.
  • No changes to application features or behaviour are indicated.

The CodeQL workflow now uses separate init and analyze actions at v4.38.0. The Dependabot hold comment identifies the pinned commit and .github/workflows/actions.lock.

Changes: CodeQL action reference update

Layer / File(s)	Summary
Update CodeQL action references and hold note .github/workflows/codeql.yml, .github/dependabot.yml	The workflow replaces the combined action with separate init and analyze actions at v4.38.0. The Dependabot hold comment identifies commit b96794f0 and .github/workflows/actions.lock.

Estimated code review effort: 1 (Trivial) | ~4 minutes

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Essentials by visiting https://app.coderabbit.ai/settings/billing.

_{A rabbit checks the workflow line,
Two CodeQL steps now run in time.
The pin note names its commit clear,
A lock file marks the reference here.
Soft paws approve the tidy change.}

_{Comment @coderabbitai help to get the list of available commands.}