fix(ci): codeql-action v4.38.1 -> v4.38.0 SHA pin + dependabot hold (estate-wide startup_failure)

[hyperpolymath]

Summary

Estate-wide incident: github/codeql-action v4.38.1 fails GitHub workflow startup on every repo that took it — CodeQL/Hypatia runs die with startup_failure, zero jobs dispatched, no error text via the API. Full investigation + evidence chain: nexia-list#100.

Changes

• codeql-action/* refs (tag @v4.38.1 or SHA 1c5b675…) re-pinned to the v4.38.0 commit b96794f015dfd88f77b49b1c93e0fa7110f94c63 (green on deed-ecosystem; satisfies SHA-pin policy).
• actions.lock re-keyed where present (dependabot bumps uses: without regenerating the lock → governance linter failure).
• dependabot.yml: full hold on github/codeql-action — scoped versions: ignores do NOT hold on this path (nexia-list#101 re-raised the bump in SHA form within an hour, copying the inline warning comment verbatim while swapping the SHA).

Canonical fix at the estate origin: standards#973. Batch-mates: nexia-list#100 (merged), hypatia#828, vexometer#90, rsr-template-repo#191, empty-linter#99, modshells#119, plasma-parser-writer#98, robodog-defensive-systems-lab#145, twingate-helm-deploy#138, wokelang#147, laniakea#91, maa-framework#198, methodologies#92, rpa-elysium#134, scripts#136, universal-chat-extractor#165, verisimdb#280. Lift the hold once upstream clears 4.38.1 or a canary verifies green.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 870595ba-6910-4871-adfd-3084707fa947

📥 Commits

Reviewing files that changed from the base of the PR and between 2e7693d and 6e01d36.

📒 Files selected for processing (2)

• .github/dependabot.yml
• .github/workflows/codeql.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (32)

• GitHub Check: Repo Integrity Guard
• GitHub Check: governance / Well-Known (RFC 9116 + RSR)
• GitHub Check: governance / Exemption ratchet
• GitHub Check: governance / Licence consistency
• GitHub Check: governance / Debt ratchet
• GitHub Check: governance / Actions lockfile verify
• GitHub Check: governance / Language / package anti-pattern policy
• GitHub Check: governance / Allowlist Preflight
• GitHub Check: governance / Guix packaging policy (Nix retired)
• GitHub Check: governance / Trusted-base reduction policy
• GitHub Check: governance / Workflow security linter
• GitHub Check: governance / Code quality + docs
• GitHub Check: governance / Security policy checks
• GitHub Check: governance / Live Actions policy (credentialed advisory)
• GitHub Check: governance / Check Workflow Staleness
• GitHub Check: hypatia / Hypatia Neurosymbolic Analysis
• GitHub Check: scan / gitleaks
• GitHub Check: scan / rust-secrets
• GitHub Check: scan / shell-secrets
• GitHub Check: Build Pages artifact
• GitHub Check: Identify PRs passed CICD
• GitHub Check: Empty-linter (invisible characters)
• GitHub Check: Validate DEED manifests
• GitHub Check: Groove manifest check
• GitHub Check: Validate K9 contracts
• GitHub Check: build · test · clippy (robot-repo-automaton)
• GitHub Check: build · test · clippy (rhodibot)
• GitHub Check: build · test · clippy (shared-context)
• GitHub Check: GSBot build, tests and dependency security
• GitHub Check: build · test · clippy (dashboard)
• GitHub Check: Dispatch path and outcome contracts
• GitHub Check: E2E tests

🔇 Additional comments (2)

.github/workflows/codeql.yml (1)

51-51: LGTM!

Also applies to: 57-57

.github/dependabot.yml (1)

18-24: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated the code scanning workflow to use a validated, securely pinned action version.
  • Prevented automatic updates to a currently incompatible action release, helping maintain reliable workflow validation.
  • No user-facing functionality or application behaviour has changed.

Walkthrough

The CodeQL workflow now uses the v4.38.0 commit SHA. Dependabot ignores CodeQL action updates while v4.38.1 fails workflow-startup validation.

Changes

CodeQL version hold

Layer / File(s)	Summary
Pin CodeQL and block automatic updates .github/workflows/codeql.yml, .github/dependabot.yml	The workflow pins github/codeql-action to the v4.38.0 commit SHA. Dependabot ignores updates for this action and records the v4.38.1 validation failure.

Priority: ⬆️ High

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix · Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to 6e01d

The rollback avoids the reported workflow-startup failure while preserving a controlled CodeQL version hold; the change is ready to merge.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarises the rollback to the v4.38.0 SHA and the Dependabot hold for the estate-wide CodeQL startup failure.
Description check	✅ Passed	The description directly explains the estate-wide startup failure, the SHA rollback, lock-file updates, and the Dependabot hold.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit pins the CodeQL trail,
SHA-bound steps remain in place,
Dependabot waits at the gate,
Until the next green release,
Workflows start on steady ground.}

_{Comment @coderabbitai help to get the list of available commands.}