fix(ci): codeql-action v4.38.1 -> v4.38.0 SHA pin + dependabot hold (estate-wide startup_failure)

[hyperpolymath]

Summary

Estate-wide incident: github/codeql-action v4.38.1 fails GitHub workflow startup on every repo that took it — CodeQL/Hypatia runs die with startup_failure, zero jobs dispatched, no error text in any API surface. The evidence chain (full detail: nexia-list#100):

repo	ref	status
nexia-list	@v4.38.1 tag (via dependabot #94)	🔴 startup_failure → fixed by rollback #100 (merged)
hypatia	@1c5b675 (4.38.1 SHA)	🔴
vexometer	@v4.38.1	🔴 (since Sep-21)
rsr-template-repo	@1c5b675	🔴
affinescript / boj-server / deed-ecosystem	≤ v4.38.0	✅ green

The v4.38.1 tag exists (peels to 1c5b675) and byte-identical workflow content runs under a fresh path — so the failure is the version value itself at GitHub's start-validation layer, not content, permissions (probes with security-events start fine), or the default-setup conflict.

Changes here

• codeql-reusable.yml, hypatia-scan-reusable.yml: codeql-action/* re-pinned 1c5b675 (v4.38.1) → b96794f0 (v4.38.0 commit; wrong # v3 comments corrected to # v4.38.0).
• actions.lock: re-keyed to the v4.38.0 SHA entries (dependabot bumped the reusable pins without regenerating the lock).
• dependabot.yml: full hold on github/codeql-action — scoped versions: ignores do NOT hold for this bot path (nexia-list#101 re-raised the bump in SHA form within an hour, copying the inline warning comment verbatim while swapping the SHA).

Follow-ups

Consumer rollbacks shipped in the same batch: nexia-list (merged ✅), hypatia, vexometer, rsr-template-repo, metadatastician/burble (each with the same dependabot hold). Reconsider the hold when upstream clears v4.38.1 or a newer release verifies green on one canary repo.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 3d3a46eb-913b-4dd1-a5eb-eefec2866397

📥 Commits

Reviewing files that changed from the base of the PR and between 1b05681 and 48f7238.

📒 Files selected for processing (2)

• .github/dependabot.yml
• .github/workflows/codeql.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (13)

• GitHub Check: governance / Code quality + docs
• GitHub Check: governance / Language / package anti-pattern policy
• GitHub Check: governance / Well-Known (RFC 9116 + RSR)
• GitHub Check: governance / Licence consistency
• GitHub Check: governance / Workflow security linter
• GitHub Check: governance / Security policy checks
• GitHub Check: governance / Guix primary / Nix fallback policy
• GitHub Check: spark-theatre-gate / SPARK Theatre Gate
• GitHub Check: governance / Trusted-base reduction policy
• GitHub Check: scan / gitleaks
• GitHub Check: hypatia / Hypatia Neurosymbolic Analysis
• GitHub Check: analyze (actions, none)
• GitHub Check: build

🔇 Additional comments (2)

.github/workflows/codeql.yml (1)

48-48: LGTM!

Also applies to: 54-54

.github/dependabot.yml (1)

12-18: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Maintenance
  • Updated automated security analysis workflows to use a validated CodeQL action version.
  • Prevented automatic updates to the CodeQL action until newer versions pass workflow-startup validation.
  • Existing analysis languages, build settings and reporting categories remain unchanged.

Walkthrough

The CodeQL workflow now uses the pinned v4.38.0 action. Dependabot ignores updates for github/codeql-action, including the blocked v4.38.1 release.

Changes

CodeQL action pinning

Layer / File(s)	Summary
Pin CodeQL action and suppress updates .github/workflows/codeql.yml, .github/dependabot.yml	The workflow uses github/codeql-action v4.38.0 for initialisation and analysis. Dependabot ignores updates for this dependency.

Priority: ⬆️ High

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 48f72

CodeQL remains pinned while Dependabot updates are held, avoiding the reported failing release; the change is ready to merge with normal checks.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the CodeQL rollback from v4.38.1 to v4.38.0 and the Dependabot hold. It is specific to the main changes.
Description check	✅ Passed	The description directly explains the startup failures, the rollback, the SHA pin changes, and the Dependabot hold. It matches the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the workflow line
v4.38.0 now stays in time
Dependabot waits by the gate
While CodeQL runs at a steady rate
No surprise updates cross the wire}

_{Comment @coderabbitai help to get the list of available commands.}

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR