fix(ci): codeql-action v4.38.1 -> v4.38.0 SHA pin + dependabot hold (estate-wide startup_failure)

[hyperpolymath]

Summary

Estate-wide incident: github/codeql-action v4.38.1 fails GitHub workflow startup on every repo that took it — CodeQL/Hypatia runs die with startup_failure, zero jobs dispatched, no error text in any API surface. The evidence chain (full detail: nexia-list#100):

repo	ref	status
nexia-list	@v4.38.1 tag (via dependabot #94)	🔴 startup_failure → fixed by rollback #100 (merged)
hypatia	@1c5b675 (4.38.1 SHA)	🔴
vexometer	@v4.38.1	🔴 (since Sep-21)
rsr-template-repo	@1c5b675	🔴
affinescript / boj-server / deed-ecosystem	≤ v4.38.0	✅ green

The v4.38.1 tag exists (peels to 1c5b675) and byte-identical workflow content runs under a fresh path — so the failure is the version value itself at GitHub's start-validation layer, not content, permissions (probes with security-events start fine), or the default-setup conflict.

Changes here

• codeql-reusable.yml, hypatia-scan-reusable.yml: codeql-action/* re-pinned 1c5b675 (v4.38.1) → b96794f0 (v4.38.0 commit; wrong # v3 comments corrected to # v4.38.0).
• actions.lock: re-keyed to the v4.38.0 SHA entries (dependabot bumped the reusable pins without regenerating the lock).
• dependabot.yml: full hold on github/codeql-action — scoped versions: ignores do NOT hold for this bot path (nexia-list#101 re-raised the bump in SHA form within an hour, copying the inline warning comment verbatim while swapping the SHA).

Follow-ups

Consumer rollbacks shipped in the same batch: nexia-list (merged ✅), hypatia, vexometer, rsr-template-repo, metadatastician/burble (each with the same dependabot hold). Reconsider the hold when upstream clears v4.38.1 or a newer release verifies green on one canary repo.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: a1b29a19-a002-4dd2-930f-ecc5798489a7

📥 Commits

Reviewing files that changed from the base of the PR and between c5d9b61 and a8060db.

📒 Files selected for processing (2)

• .github/dependabot.yml
• .github/workflows/codeql.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (15)

• GitHub Check: scan / gitleaks
• GitHub Check: scan / rust-secrets
• GitHub Check: governance / Well-Known (RFC 9116 + RSR)
• GitHub Check: governance / Allowlist Preflight
• GitHub Check: governance / Guix packaging policy (Nix retired)
• GitHub Check: governance / Security policy checks
• GitHub Check: governance / Language / package anti-pattern policy
• GitHub Check: governance / Workflow security linter
• GitHub Check: governance / Licence consistency
• GitHub Check: governance / Check Workflow Staleness
• GitHub Check: hypatia / Hypatia Neurosymbolic Analysis
• GitHub Check: Empty-linter (invisible characters)
• GitHub Check: Validate DEED manifests
• GitHub Check: analyze (javascript-typescript, none)
• GitHub Check: analyze (actions, none)

🔇 Additional comments (2)

.github/workflows/codeql.yml (1)

41-41: LGTM!

Also applies to: 46-46

.github/dependabot.yml (1)

18-18: LGTM!

Also applies to: 19-25

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated the automated security analysis workflow to use CodeQL version 4.38.0.
  • Pinned the security analysis tooling to maintain consistent scan behaviour.
  • Held automatic updates for this tooling until a later review.

Walkthrough

The CodeQL workflow now pins github/codeql-action to v4.38.0 for its init and analyze steps. Dependabot now ignores updates to this action.

Changes

CodeQL Action update

Layer / File(s)	Summary
Update and hold the CodeQL Action pin .github/workflows/codeql.yml, .github/dependabot.yml	Both CodeQL steps use the v4.38.0 commit. Dependabot ignores github/codeql-action updates and records the version hold.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to a8060

CodeQL scanning remains pinned to the intended stable version while automated updates are held, with no remaining merge-blocking risk identified.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the CodeQL action rollback, SHA pin change, Dependabot hold, and startup failure issue.
Description check	✅ Passed	The description directly explains the v4.38.1 startup failure, the rollback to v4.38.0, and the Dependabot hold.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the CodeQL pin
v4.38.0 now starts to win
Dependabot waits beside the gate
Two workflow steps share the state
No newer hop is taken in}

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud