48 open Dependabot PRs re-introduce the codeql-action v4.38.1 startup-killer, and the dependabot.yml ignore rule is being bypassed in 15 repos

[hyperpolymath]

48 open Dependabot PRs each re-introduce the estate-wide CodeQL startup-killer, and the ignore rule meant to stop them is being bypassed

Measured 2026-09-23. Two findings, the second more serious than the first.

1. The population

github/codeql-action v4.38.1 (1c5b675653bb5c22dbe9b12b556ec555138e09fd) is rejected by
GitHub at workflow startup — startup_failure, zero jobs, no logs — wherever it is used, in
tag or SHA form. That is the finding of nexia-list#100, which rolled the estate back to v4.38.0
(b96794f015dfd88f77b49b1c93e0fa7110f94c63), and it is why standards#1005 AC2 re-pinned 40 repos.

There are currently 48 open Dependabot PRs across 46 repositories that would put v4.38.1 back.
Merging any one of them kills CodeQL (and, where it shares the pin, Hypatia) on that repo. Verified
by diffing each of the 73 open Dependabot PRs in both orgs for the 4.38.1 SHA or version string —
48 hits, listed at the bottom.

This is live: awesome-nickel#78 is startup_failure on codeql.yml right now, at signed commit
39d49911, for exactly this reason.

2. The ignore rule does not hold — this is the part that needs a decision

nexia-list#100 added a dependabot.yml ignore rule as the recurrence cure, and that pattern was
propagated to 15 repos. It is not working. Of the 46 affected repos:

	n
no codeql-action entry in dependabot.yml at all	31
has a full-hold ignore rule and was bumped anyway	15

All 15 carry an unqualified - dependency-name: "github/codeql-action" (no versions: — the
strongest form), and in all 15 that rule predates the PR that bypassed it. Four of them by far
too long for scheduling lag to explain:

repo	rule landed	bypassing PR raised	gap
julia-professional-registry	2026-09-22T12:23:32Z	#101 2026-09-23T07:25:15Z	19h
nexia-list	2026-09-22T11:40:33Z	#107 2026-09-23T03:08:23Z	15.5h
blocky-writer	2026-09-22T12:21:28Z	#69 2026-09-22T23:42:32Z	11h
hypatia	2026-09-22T12:01:25Z	#854 2026-09-22T21:15:17Z	9h

nexia-list is the clearest case because it has already escalated once: a versions: ["4.38.1"]
rule was bypassed in #101, so #104 replaced it with the unqualified full hold — and #107 bypassed
that too, 15.5 hours later, swapping the SHA to 4.38.1 while preserving the inline comment that
says 4.38.1 is blocked estate-wide.

Leading hypothesis: update-level ignore is not honoured inside a groups: update

Stated as a hypothesis because I have not isolated it with a control, but the evidence lines up
cleanly in both directions:

• All 15 bypasses in rule-protected repos are grouped updates (bump the actions group…).
  Both nexia-list bypasses (policy: Guix primary + sealed-container escape; retire Nix-mirror-everywhere #101, Wave 2: Nix-mirror retirement (LowLevel.jl…a2ml-rs) #107) are grouped.
• All 6 singleton bypasses (bump github/codeql-action from 4.38.0 to 4.38.1) come from repos
  with no ignore rule — so they are unprotected, not evidence against the rule working.

Every one of these configs has the same shape: a group with patterns: ["*"] alongside an
update-level ignore. If the hypothesis holds, the cure is to take the dependency out of the group
rather than to keep strengthening the ignore:

groups:
  actions:
    patterns: ["*"]
    exclude-patterns: ["github/codeql-action*"]

Acceptance criteria

• AC1 — Confirm or refute the grouping hypothesis with a single control: add
  exclude-patterns to one rule-protected repo (nexia-list is the natural choice, having
  already failed twice) and observe whether the next daily run still raises the bump.
• AC2 — Apply the confirmed cure to the 15 repos that have a full-hold rule today.
• AC3 — Apply it to the 31 repos with no rule at all. These are currently unprotected
  by anything except the lock-sync gate.
• AC4 — Decide the disposition of the 48 open PRs. They cannot simply be left: several
  are grouped updates carrying wanted bumps alongside the poisoned one. Options are close-all,
  or rebase-with-codeql-reverted. This is an owner call, not a sweep I should choose.
• AC5 — Add a standing note to the pin policy that github/codeql-action is held at
  v4.38.0 (b96794f0…) until upstream clears 4.38.1, with a named revisit trigger rather than
  a nightly one.

What is already working, and should not be changed

The lock-sync recurrence gate shipped by the lock campaign catches these correctly.
On awesome-nickel#78 the check actions.lock is in sync with the workflow YAML is FAILURE —
a real Dependabot PR in the wild, caught by the gate exactly as designed. That is the campaign's
recurrence criterion satisfied on live traffic rather than a synthetic case. The gate is the reason
these 48 PRs are visibly red rather than quietly mergeable.

All 48 PRs (repo#number)

hyperpolymath/airborne-submarine-squadron#108
hyperpolymath/anvomidav#87
hyperpolymath/awesome-nickel#78
hyperpolymath/Axiology.jl#67
hyperpolymath/bgp-backbone-lab#102
hyperpolymath/bitfuckit#73
hyperpolymath/blocky-writer#69
hyperpolymath/boj-server-cartridges#148
hyperpolymath/BowtieRisk.jl#56
hyperpolymath/casket-ssg#102
hyperpolymath/Causals.jl#57
hyperpolymath/claude-gecko-browser-extension#109
hyperpolymath/claude-gecko-browser-extension#110
hyperpolymath/dotmatrix-fileprinter#82
hyperpolymath/ensaid-spec#37
hyperpolymath/Exnovation.jl#59
hyperpolymath/gitbot-fleet#562
hyperpolymath/git-reticulator#115
hyperpolymath/HackenbushGames.jl#54
hyperpolymath/hypatia#854
hyperpolymath/hyperpolymath.github.io#42
hyperpolymath/ipv6-site-enforcer#99
hyperpolymath/JuliaForChildren.jl#25
hyperpolymath/julia-professional-registry#101
hyperpolymath/KnotTheory.jl#87
hyperpolymath/marches#32
hyperpolymath/megadog#71
hyperpolymath/network-outpost#29
hyperpolymath/nexia-list#107
hyperpolymath/pow-the-game#101
hyperpolymath/qubes-sdp#78
hyperpolymath/raze-tui#135
hyperpolymath/robodog-defensive-systems-lab#146
hyperpolymath/self-destructing-git-garbage#25
hyperpolymath/Skein.jl#55
hyperpolymath/social-media-polygraph#107
hyperpolymath/tangle#126
hyperpolymath/the-metadatastician#47
hyperpolymath/thunderbird-template-reloaded#172
hyperpolymath/thunderbird-template-reloaded#173
hyperpolymath/verisimdb#284
hyperpolymath/verisimdb-data#144
hyperpolymath/zerostep#97
metadatastician/canonical-ums#20
metadatastician/cleave#40
metadatastician/common-signal#6
metadatastician/pong-ping#8
metadatastician/sim-public-relations#25

🤖 Generated with Claude Code

https://claude.ai/code/session_01X3hgXxWm6umMgZkjYyHnnm