fix(ci): roll back codeql-action to v4.38.0 SHA pin — resolves CodeQL/Hypatia startup_failure - #100
Merged
Merged
Conversation
…e startup_failure) Dependabot grouped bump #94 (codeql-action v4.38.0 -> v4.38.1) correlates 1:1 with every codeql.yml / hypatia-scan.yml run failing at startup (0 jobs dispatched, no runner error) from 2026-09-22 03:06 UTC. The same pattern reproduces estate-wide: RED vexometer codeql @v4.38.1 tag startup_failure since 09-21 RED hypatia codeql @1c5b675 (4.38.1) startup_failure since 09-22 RED rsr-template codeql @1c5b675 (4.38.1) startup_failure since 09-15 RED nexia-list codeql @v4.38.1 tag startup_failure since 09-22 GREEN affinescript codeql @v4.38.0 tag pass 09-21 GREEN boj-server codeql @v4.38.0/4.34 pass 09-21 GREEN deed-ecosystem codeql @b96794f0 SHA pass 09-21 Controlled probes (byte-replicas of the failing files under new paths on a scratch branch) DO start, so the file content is valid per se; the v4.38.1 release (tag AND its commit SHA) is being refused at workflow startup on every default-branch-evaluated run. Fully reversible fix: pin to the last green release v4.38.0 by SHA (matches deed-ecosystem, satisfies the repo's sha-pinning policy) until 4.38.1 is cleared. Also fixes governance "Workflow security linter" failure: actions.lock referenced codeql-action@v4.38.0 with no matching uses: entry (drift introduced by dependabot, which does not regenerate the lock). Lock re-keyed to the SHA pin used here. Dependabot guard added: ignore github/codeql-action 4.38.1 so the daily actions group cannot re-merge the broken bump tonight.
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (3)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (26)
|
| Layer / File(s) | Summary |
|---|---|
Pin CodeQL workflow actions .github/workflows/codeql.yml, .github/workflows/hypatia-scan.yml |
The CodeQL initialisation, analysis, and SARIF upload actions now use commit b96794f015dfd88f77b49b1c93e0fa7110f94c63, annotated as v4.38.0. |
Ignore the rejected Dependabot version .github/dependabot.yml |
Dependabot ignores github/codeql-action version 4.38.1. A comment records the workflow-startup validation failure. |
Priority: ➖ Normal
Estimated code review effort: 1 (Trivial) | ~5 minutes
Change: Bug fix
Merge Risk: ⚪ Minimal · up to ae838
CodeQL and Hypatia remain pinned to v4.38.0, avoiding the reported startup failure with no actionable merge-blocking risk remaining.
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
| Check name | Status | Explanation |
|---|---|---|
| Title check | ✅ Passed | The title clearly identifies the rollback to the v4.38.0 SHA pin and the CodeQL/Hypatia startup failure it addresses. |
| Description check | ✅ Passed | The description directly explains the v4.38.1 rollback, the startup failure, the Dependabot ignore rule, and the related workflow changes. |
| Docstring Coverage | ✅ Passed | No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… |
| Linked Issues check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |
✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
- Commit to this branch
- Create a new PR
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
A rabbit pins the actions tight
At v4.38.0, clear and bright
Dependabot skips the faulty trail
The workflows start without that veil
Three small changes keep the checks in sight
Comment @coderabbitai help to get the list of available commands.
|
🔍 Hypatia Security ScanFindings: 70 issues detected
View findings[
{
"reason": "Required workflow `scorecard.yml` is absent from .github/workflows/. The estate baseline expects it; without it this repository is unscanned for whatever that workflow covers, and its absence is silent — no job fails, because no job runs.",
"type": "missing_workflow",
"file": "scorecard.yml",
"action": "create",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Workflow executes remote script directly (curl/wget piped to shell). Download, verify checksum/signature, then execute.",
"type": "download_then_run",
"file": "ui-ci.yml",
"action": "verify_download_integrity",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Job `trigger-boj` in boj-build.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
"type": "missing_timeout_minutes",
"file": "boj-build.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium",
"recipe_id": "recipe-add-workflow-timeout-minutes",
"job": "trigger-boj"
},
{
"reason": "Job `build` in casket-pages.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
"type": "missing_timeout_minutes",
"file": "casket-pages.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium",
"recipe_id": "recipe-add-workflow-timeout-minutes",
"job": "build"
},
{
"reason": "Job `deploy` in casket-pages.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
"type": "missing_timeout_minutes",
"file": "casket-pages.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium",
"recipe_id": "recipe-add-workflow-timeout-minutes",
"job": "deploy"
},
{
"reason": "Job `analyze` in codeql.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
"type": "missing_timeout_minutes",
"file": "codeql.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium",
"recipe_id": "recipe-add-workflow-timeout-minutes",
"job": "analyze"
},
{
"reason": "Job `a2ml-validate` in dogfood-gate.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium",
"recipe_id": "recipe-add-workflow-timeout-minutes",
"job": "a2ml-validate"
},
{
"reason": "Job `dogfood-summary` in dogfood-gate.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium",
"recipe_id": "recipe-add-workflow-timeout-minutes",
"job": "dogfood-summary"
},
{
"reason": "Job `k9-validate` in dogfood-gate.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium",
"recipe_id": "recipe-add-workflow-timeout-minutes",
"job": "k9-validate"
},
{
"reason": "Job `scan` in hypatia-scan.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
"type": "missing_timeout_minutes",
"file": "hypatia-scan.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium",
"recipe_id": "recipe-add-workflow-timeout-minutes",
"job": "scan"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This was referenced Sep 22, 2026
hyperpolymath
added a commit
that referenced
this pull request
Sep 22, 2026
…ypassed in #101) (#104) ## Summary PR #101 proved (within ~1h of #100 landing) that the `versions: ["4.38.1"]` ignore rule does **not** stop dependabot from re-raising the blocked bump: it swapped `b96794f0` (v4.38.0 commit, green) for `1c5b675` (the **v4.38.1 commit**, estate-blocked) in SHA form today, while copying my inline "4.38.1 blocked" warning comment verbatim. `1c5b675` fails workflow startup on hypatia and rsr-template proven — merging #101 would have re-broken CodeQL + Hypatia tonight. #101 is closed with a warning comment. This PR upgrades the defence to an **unconditional hold** on `github/codeql-action` (no `versions` key = all updates ignored) until upstream clears 4.38.1 or a newer release is verified green. Comment documents why the versions-scoped rule failed so nobody "tidies" it back. ## Follow-ups outside this PR - Same hold needed in the **standards** canonical dependabot config so other estate repos don't take the SHA-form re-bump either — part of the estate rollback batch. - **Estate alert**: any repo whose dependabot merged the actions group since ~Sep-15 may already have the broken ref (vexometer + hypatia + rsr-template confirmed red). Co-authored-by: Arena Agent <agent@arena.ai>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the
CodeQL Security Analysis+Hypatia Security Scanstartup_failurethat has blocked both workflows onmainsince 2026-09-22 03:06 UTC (first failing run: #94's branch; every run since).Root cause
The grouped dependabot bump #94 moved
github/codeql-actionv4.38.0 → v4.38.1 incodeql.yml(init/analyze) andhypatia-scan.yml(upload-sarif). Since that merge, every run of those two workflows fails at startup (0 jobs ever dispatch — no job logs exist). The same signature now reproduces estate-wide, keyed exactly on the codeql-action version:@v4.38.1tag@1c5b675(4.38.1 SHA)@1c5b675(4.38.1 SHA)@v4.38.1tag@v4.38.0tag@v4.34/4.38.0@b96794f0(4.38.0 SHA)The v4.38.1 tag object exists (peeled
1c5b675653bb…) — verified vials-remote/API — but GitHub refuses it at workflow startup (tag and SHA form, per hypatia/rsr-template). Byte-identical replicas of the failing workflows under a new path on a scratch branch do start and execute, so the YAML/content itself is valid; v4.38.1 resolution is rejected by GitHub's actions catalog/policy layer on default-branch-evaluated runs. Exact GitHub-internal reason is not visible from the API (startup_failure runs expose no error text); the behavioural fix is unambiguous: stay on the last green release.Changes
codeql.yml,hypatia-scan.yml: pincodeql-action/*to@b96794f015dfd88f77b49b1c93e0fa7110f94c63(v4.38.0, SHA-pinned — satisfies this repo'ssha_pinning_requiredpolicy and matches the greendeed-ecosystemconfiguration).actions.lock: re-keyed to the SHA pin. This also fixes today'sWorkflow security linterfailure ("lock lists github/codeql-action@v4.38.0 but no workflow uses it") — dependabot bumpeduses:without regenerating the lock; the estate's locked-actions gate caught it exactly as designed.dependabot.yml:ignorerule forgithub/codeql-action@4.38.1so the daily grouped actions update can't re-merge the same broken bump overnight.Verification
The PR itself is the live test:
pull_requestruns of CodeQL and Hypatia on this branch should dispatch jobs (rather than startup_failure). Watch runs above. If either still fails at startup, the remaining levers are owner-side (delete+recreate workflow files to clear the poisoned registration, or repo Settings → Code security / Actions policy review), but the version discriminator evidence says this rollback is the fix.Follow-ups (estate-wide, not in this PR)
codeql-reusable.yml/hypatia-scan-reusable.ymlcurrently pin the 4.38.1 SHA (1c5b675…) and should be re-pinned to v4.38.0 SHA until upstream clears 4.38.1.Rollback of the codeql-action portion of #94; all other bumps in #94 are untouched. See issue #49 for the CI-honesty context — this is precisely the class of failure that used to be invisible.