fix(ci): repoint codeql-action at a SHA that exists

[hyperpolymath]

github/codeql-action@29b1f65c1f735799893313399435a59f54045865 is pinned here but exists in no repository — the GitHub API returns 422 for it.

CodeQL therefore could not start: the run graph fails to build and the job reports startup_failure, so this repository has had no CodeQL scanning at all.

Repointed at 4187e74d05793876e9989daffde9c3e66b4acd07, which is what the v3 tag currently resolves to (v3.37.3), verified against the API.

Found while auditing the estate: the same non-existent SHA was pinned in 104 repositories, so CodeQL was dead across nearly all of them.

[gitar-bot]

CI failed: CI failed because the compliance check detected pinned version strings in load-bearing documentation files (README.md and RSR_COMPLIANCE.md).

Overview

1 CI failure found due to a configuration and standards compliance policy check ([R5b]) failing on documentation version strings.

Failures

Documentation Version String Compliance Failure (confidence: high)

• Type: configuration
• Affected jobs: 90323782770
• Related to change: yes
• Root cause: The repository compliance check [R5b] disallows pinned version strings in load-bearing documentation files (README.md and RSR_COMPLIANCE.md), requiring versions to be maintained exclusively via CHANGELOG.md and package manifests.
• Suggested fix: Remove the pinned version lines from README.md and RSR_COMPLIANCE.md and defer versioning to package manifests and changelogs.

Summary

• Change-related failures: 1 failure due to documentation compliance check [R5b] detecting pinned versions in README.md and RSR_COMPLIANCE.md.
• Infrastructure/flaky failures: None.
• Recommended action: Remove the embedded version strings from the affected documentation files to satisfy the estate-wide security and compliance standards.

Code Review ✅ Approved

Repoints the CodeQL action to a valid commit SHA to restore broken security scanning pipelines. No issues found.

Auto-approved and auto-merge armed: No blocking issues found.
Please see Auto-approve Docs for details on setting custom approval criteria. — merges when pipeline and required approvals pass.

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[gitar-bot]

⚠️ Gitar auto-approved this PR but could not enable auto-merge: auto-merge is disabled for this repository — enable "Allow auto-merge" in the repository settings.

[gitar-bot]

Gitar has auto-approved this PR and enabled auto-merge (configure)

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE