fix(ci): repoint codeql-action at a SHA that exists

[hyperpolymath]

github/codeql-action@29b1f65c1f735799893313399435a59f54045865 is pinned here but exists in no repository — the GitHub API returns 422 for it.

CodeQL therefore could not start: the run graph fails to build and the job reports startup_failure, so this repository has had no CodeQL scanning at all.

Repointed at 4187e74d05793876e9989daffde9c3e66b4acd07, which is what the v3 tag currently resolves to (v3.37.3), verified against the API.

Found while auditing the estate: the same non-existent SHA was pinned in 104 repositories, so CodeQL was dead across nearly all of them.

[gitar-bot]

CI failed: CI failed due to repository governance policy violations: pinned version strings in load-bearing documentation and banned ReScript files detected.

Overview

CI checks failed across two jobs due to strict repository governance policies: Finding 1 caught pinned version strings in load-bearing documentation (R5b check), and Finding 2 detected banned language files (cicd_rules/banned_language_file check for ReScript files).

Failures

Pinned Version Strings in Documentation (confidence: high)

• Type: build
• Affected jobs: 90324549848
• Related to change: unclear
• Root cause: Files CODE_OF_CONDUCT.md and RSR_COMPLIANCE.md contain explicit pinned version strings (e.g. **Version**: 1.0.0), violating the R5b documentation policy.
• Suggested fix: Remove the embedded version strings from the documentation files and defer versioning history to CHANGELOG.md or package manifests.

Banned Language File Check Failed (confidence: high)

• Type: build
• Affected jobs: 90324550096
• Related to change: unclear
• Root cause: The governance check script detected non-exempt ReScript files (rescript_modules/lib/ocaml/PatternGenerator.res), which violate the banned language rule.
• Suggested fix: Remove the offending ReScript files or declare an appropriate exemption via .hypatia-ignore or an inline pragma if intentional.

Summary

• Change-related failures: 2 build failures caused by repository governance and policy checks (pinned documentation versions and banned language files).
• Infrastructure/flaky failures: 0
• Recommended action: Remove or update the violating documentation version strings and banned ReScript files to comply with repository standards.

Code Review ✅ Approved

Repoints CodeQL actions at a valid SHA to restore CI scanning. No issues found.

Auto-approved and auto-merge armed: No blocking issues found.
Please see Auto-approve Docs for details on setting custom approval criteria. — merges when pipeline and required approvals pass.

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[gitar-bot]

⚠️ Gitar auto-approved this PR but could not enable auto-merge: auto-merge is disabled for this repository — enable "Allow auto-merge" in the repository settings.

[gitar-bot]

Gitar has auto-approved this PR and enabled auto-merge (configure)