From ae8385c925fbb22b0084cf83bcfa8a1cef298aba Mon Sep 17 00:00:00 2001 From: Arena Agent Date: Tue, 22 Sep 2026 10:47:03 +0000 Subject: [PATCH] fix(ci): roll back codeql-action 4.38.1 -> 4.38.0 SHA pin (estate-wide startup_failure) Dependabot grouped bump #94 (codeql-action v4.38.0 -> v4.38.1) correlates 1:1 with every codeql.yml / hypatia-scan.yml run failing at startup (0 jobs dispatched, no runner error) from 2026-09-22 03:06 UTC. The same pattern reproduces estate-wide: RED vexometer codeql @v4.38.1 tag startup_failure since 09-21 RED hypatia codeql @1c5b675 (4.38.1) startup_failure since 09-22 RED rsr-template codeql @1c5b675 (4.38.1) startup_failure since 09-15 RED nexia-list codeql @v4.38.1 tag startup_failure since 09-22 GREEN affinescript codeql @v4.38.0 tag pass 09-21 GREEN boj-server codeql @v4.38.0/4.34 pass 09-21 GREEN deed-ecosystem codeql @b96794f0 SHA pass 09-21 Controlled probes (byte-replicas of the failing files under new paths on a scratch branch) DO start, so the file content is valid per se; the v4.38.1 release (tag AND its commit SHA) is being refused at workflow startup on every default-branch-evaluated run. Fully reversible fix: pin to the last green release v4.38.0 by SHA (matches deed-ecosystem, satisfies the repo's sha-pinning policy) until 4.38.1 is cleared. Also fixes governance "Workflow security linter" failure: actions.lock referenced codeql-action@v4.38.0 with no matching uses: entry (drift introduced by dependabot, which does not regenerate the lock). Lock re-keyed to the SHA pin used here. Dependabot guard added: ignore github/codeql-action 4.38.1 so the daily actions group cannot re-merge the broken bump tonight. --- .github/dependabot.yml | 7 +++++++ .github/workflows/actions.lock | 8 ++++---- .github/workflows/codeql.yml | 4 ++-- .github/workflows/hypatia-scan.yml | 2 +- 4 files changed, 14 insertions(+), 7 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 55c3c99..3d9fe16 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -8,6 +8,13 @@ updates: actions: patterns: - "*" + ignore: + # v4.38.1 fails GitHub workflow-startup validation estate-wide + # (codeql.yml/hypatia-scan.yml startup_failure on every repo that merged + # the grouped bump; v4.38.0 is green). Rollback: PR #100. Revisit once + # 4.38.1 is cleared upstream. + - dependency-name: "github/codeql-action" + versions: ["4.38.1"] # Rust core crate. NOTE: deliberately no entry for /desktop — its path # dependency on an external sibling checkout (../../gossamer) would make # dependabot error. diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index ebb0530..c432e34 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -14,7 +14,7 @@ workflows: - 'haskell-actions/setup@v2.12.0' '.github/workflows/codeql.yml': - 'actions/checkout@v7.0.1' - - 'github/codeql-action@v4.38.0' + - 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63' '.github/workflows/dogfood-gate.yml': - 'actions/checkout@v7.0.1' - 'hyperpolymath/deed-ecosystem@main' @@ -25,7 +25,7 @@ workflows: - 'actions/github-script@v9.0.0' - 'actions/upload-artifact@v7.0.1' - 'erlef/setup-beam@v1.24.1' - - 'github/codeql-action@v4.38.0' + - 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63' '.github/workflows/instant-sync.yml': - 'peter-evans/repository-dispatch@v4.0.1' '.github/workflows/label-triage.yml': [] @@ -88,8 +88,8 @@ dependencies: commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124' owner_id: 47606891 repo_id: 331103973 - 'github/codeql-action@v4.38.0': - ref: 'v4.38.0' + 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63': + ref: 'b96794f015dfd88f77b49b1c93e0fa7110f94c63' commit: 'sha1-b96794f015dfd88f77b49b1c93e0fa7110f94c63' owner_id: 9919 repo_id: 259445878 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 545c487..b6d1b6b 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -44,12 +44,12 @@ jobs: uses: actions/checkout@v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@v4.38.1 + uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 (4.38.1 blocked estate-wide; see PR #100) with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4.38.1 + uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 (4.38.1 blocked estate-wide; see PR #100) with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 7bc31f4..5475494 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -245,7 +245,7 @@ jobs: always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork != true) - uses: github/codeql-action/upload-sarif@v4.38.1 + uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 (4.38.1 blocked estate-wide; see PR #100) with: sarif_file: hypatia.sarif # Distinct category so Hypatia results coexist with CodeQL's