fix(ci): codeql-action v4.38.1 -> v4.38.0 SHA pin + dependabot hold (estate-wide startup_failure)

[hyperpolymath]

Summary

Estate-wide incident: github/codeql-action v4.38.1 fails GitHub workflow startup on every repo that took it — CodeQL/Hypatia runs die with startup_failure, zero jobs dispatched, no error text via the API. Full investigation + evidence chain: nexia-list#100.

Changes

• codeql-action/* refs (tag @v4.38.1 or SHA 1c5b675…) re-pinned to the v4.38.0 commit b96794f015dfd88f77b49b1c93e0fa7110f94c63 (green on deed-ecosystem; satisfies SHA-pin policy).
• actions.lock re-keyed where present (dependabot bumps uses: without regenerating the lock → governance linter failure).
• dependabot.yml: full hold on github/codeql-action — scoped versions: ignores do NOT hold on this path (nexia-list#101 re-raised the bump in SHA form within an hour, copying the inline warning comment verbatim while swapping the SHA).

Canonical fix at the estate origin: standards#973. Batch-mates: nexia-list#100 (merged), hypatia#828, vexometer#90, rsr-template-repo#191, empty-linter#99, modshells#119, plasma-parser-writer#98, robodog-defensive-systems-lab#145, twingate-helm-deploy#138, wokelang#147, laniakea#91, maa-framework#198, methodologies#92, rpa-elysium#134, scripts#136, universal-chat-extractor#165, verisimdb#280. Lift the hold once upstream clears 4.38.1 or a canary verifies green.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: dd85f617-1c0c-4320-b69d-807e1b955208

📥 Commits

Reviewing files that changed from the base of the PR and between fd13c10 and 4d925f4.

📒 Files selected for processing (2)

• .github/dependabot.yml
• .github/workflows/codeql.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (14)

• GitHub Check: scan / rust-secrets
• GitHub Check: scan / shell-secrets
• GitHub Check: scan / gitleaks
• GitHub Check: governance / Language / package anti-pattern policy
• GitHub Check: governance / Workflow security linter
• GitHub Check: governance / Check Workflow Staleness
• GitHub Check: governance / Well-Known (RFC 9116 + RSR)
• GitHub Check: governance / Trusted-base reduction policy
• GitHub Check: governance / Licence consistency
• GitHub Check: governance / Code quality + docs
• GitHub Check: governance / Security policy checks
• GitHub Check: governance / Guix primary / Nix fallback policy
• GitHub Check: hypatia / Hypatia Neurosymbolic Analysis
• GitHub Check: analyze (actions, none)

🔇 Additional comments (2)

.github/workflows/codeql.yml (1)

35-35: LGTM!

Also applies to: 40-40

.github/dependabot.yml (1)

16-21: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated automated code security checks to use the latest validated analysis tooling.
  • Pinned the security analysis workflow to a verified version for more reliable workflow execution.
  • Existing scanning languages, build modes, and workflow configuration remain unchanged.

Walkthrough

The CodeQL workflow now uses the pinned v4.38.0 action. Dependabot ignores updates to github/codeql-action until the workflow-startup validation issue in v4.38.1 is resolved.

Changes

CodeQL action version control

Layer / File(s)	Summary
Pin and hold CodeQL action .github/workflows/codeql.yml, .github/dependabot.yml	The workflow uses the SHA-pinned v4.38.0 CodeQL action. Dependabot ignores updates because v4.38.1 fails workflow-startup validation. Existing language and build-mode settings remain unchanged.

Priority: ⬆️ High

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix · Severity of issue fixed: Low

Merge Risk: ⚪ Minimal · up to 4d925

The workflow stays on the pinned CodeQL v4.38.0 action while Dependabot holds updates, avoiding the reported startup failure and leaving the change mergeable.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the rollback to the v4.38.0 SHA pin and the Dependabot hold for the CodeQL workflow startup failure.
Description check	✅ Passed	The description directly explains the CodeQL rollback, Dependabot hold, startup_failure incident, and related changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit pins the CodeQL trail
At v4.38.0, workflows sail
Dependabot waits in place
Till upstream fixes the race
Safe checks spring without fail}

_{Comment @coderabbitai help to get the list of available commands.}