fix(ci): codeql-action v4.38.1 -> v4.38.0 SHA pin + dependabot hold (estate-wide startup_failure)

[hyperpolymath]

Summary

Estate-wide incident: github/codeql-action v4.38.1 fails GitHub workflow startup on every repo that took it — CodeQL/Hypatia runs die with startup_failure, zero jobs dispatched, no error text via the API. Full investigation + evidence chain: nexia-list#100.

Changes

• codeql-action/* refs (tag @v4.38.1 or SHA 1c5b675…) re-pinned to the v4.38.0 commit b96794f015dfd88f77b49b1c93e0fa7110f94c63 (green on deed-ecosystem; satisfies SHA-pin policy).
• actions.lock re-keyed where present (dependabot bumps uses: without regenerating the lock → governance linter failure).
• dependabot.yml: full hold on github/codeql-action — scoped versions: ignores do NOT hold on this path (nexia-list#101 re-raised the bump in SHA form within an hour, copying the inline warning comment verbatim while swapping the SHA).

Canonical fix at the estate origin: standards#973. Batch-mates: nexia-list#100 (merged), hypatia#828, vexometer#90, rsr-template-repo#191, empty-linter#99, modshells#119, plasma-parser-writer#98, robodog-defensive-systems-lab#145, twingate-helm-deploy#138, wokelang#147, laniakea#91, maa-framework#198, methodologies#92, rpa-elysium#134, scripts#136, universal-chat-extractor#165, verisimdb#280. Lift the hold once upstream clears 4.38.1 or a canary verifies green.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: ec6d72de-7ffd-45b4-9d38-1f50cf4e1c9c

📥 Commits

Reviewing files that changed from the base of the PR and between 8d83459 and aed3412.

📒 Files selected for processing (3)

• .github/dependabot.yml
• .github/workflows/codeql.yml
• .github/workflows/hypatia-scan.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (23)

• GitHub Check: scan / shell-secrets
• GitHub Check: scan / gitleaks
• GitHub Check: scan / rust-secrets
• GitHub Check: governance / Actions lockfile verify
• GitHub Check: governance / Trusted-base reduction policy
• GitHub Check: governance / Licence consistency
• GitHub Check: governance / Exemption ratchet
• GitHub Check: governance / Workflow security linter
• GitHub Check: governance / Debt ratchet
• GitHub Check: governance / Language / package anti-pattern policy
• GitHub Check: governance / Allowlist Preflight
• GitHub Check: governance / Well-Known (RFC 9116 + RSR)
• GitHub Check: governance / Code quality + docs
• GitHub Check: governance / Check Workflow Staleness
• GitHub Check: governance / Live Actions policy (credentialed advisory)
• GitHub Check: governance / Guix packaging policy (Nix retired)
• GitHub Check: governance / Security policy checks
• GitHub Check: Detect relevant changes
• GitHub Check: Shim drift check
• GitHub Check: Detect relevant changes
• GitHub Check: validate
• GitHub Check: Active orchestration adapter
• GitHub Check: Detect relevant changes

🧰 Additional context used

🪛 YAMLlint (1.37.1)

.github/dependabot.yml

[error] 21-21: too many blank lines (1 > 0)

(empty-lines)

🔇 Additional comments (2)

.github/workflows/codeql.yml (1)

47-47: LGTM!

Also applies to: 52-52

.github/workflows/hypatia-scan.yml (1)

238-238: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Pinned CodeQL workflow actions to a verified commit for more predictable security scanning.
  • Configured automated dependency updates to defer CodeQL action upgrades until newer versions are validated.

Walkthrough

The pull request pins CodeQL actions to the v4.38.0 commit SHA and prevents Dependabot from proposing updates for github/codeql-action. The existing workflow inputs remain unchanged.

Changes

CodeQL action stability

Layer / File(s)	Summary
Pin CodeQL actions and update policy .github/workflows/codeql.yml, .github/workflows/hypatia-scan.yml, .github/dependabot.yml	The workflows use the v4.38.0 commit SHA. Dependabot ignores github/codeql-action updates because v4.38.1 fails workflow-startup validation.

Priority: ⬆️ High

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to aed34

The action pinning and Dependabot hold have no established material merge risk.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the rollback to the v4.38.0 SHA pin and the Dependabot hold. It accurately describes the estate-wide startup failure.
Description check	✅ Passed	The description explains the incident, changes, rationale, references, and rollback condition. It does not include the template's Schema-validation note or explicitly mark the no-manifest checkbox, bu…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the workflow pin,
The trusted SHA is locked in.
Dependabot waits beside the gate,
While CodeQL runs at version eight.
The SARIF path stays clear and bright.}

_{Comment @coderabbitai help to get the list of available commands.}