From adefc0ea9b6989dd5e876b557e134b32bc54f7d7 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Wed, 23 Sep 2026 00:29:37 +0100
Subject: [PATCH] ci: re-pin codeql-action to the true v4.38.0 commit

The pin 1c5b675653bb5c22dbe9b12b556ec555138e09fd is the commit that the
annotated tag v4.38.1 dereferences to -- not v4.38.0, despite the trailing
comment claiming otherwise. v4.38.1 is blocked estate-wide (nexia-list#100),
so every repo carrying this pin has in fact been running the blocked version.

  v4.38.0 -> tag object 4bd7200e -> commit b96794f015dfd88f77b49b1c93e0fa7110f94c63
  v4.38.1 -> tag object c23de5a8 -> commit 1c5b675653bb5c22dbe9b12b556ec555138e09fd

Where the ref was a bare tag (@v4.38.1) it was also unpinned -- a mutable ref
upstream can re-point at will -- so it is now pinned to a SHA as well as moved
off the blocked version.

In a number of repos the lock had already been moved to b96794f0 while the
workflow was left on the blocked SHA. Those two disagree, so the workflow is
currently rejected at startup and has not been running at all; this commit
makes the workflow match the lock and brings it back to life.

The workflow and actions.lock are changed in a single commit: GitHub compares
the lock to the workflow by literal string, so a partial edit is a startup
failure rather than a stale lock.

Refs: hyperpolymath/standards#1005

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X3hgXxWm6umMgZkjYyHnnm
---
 .github/workflows/codeql.yml       | 4 ++--
 .github/workflows/hypatia-scan.yml | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 5615246..3e0f69f 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -44,12 +44,12 @@ jobs:
         uses: actions/checkout@v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.0 (4.38.1 blocked estate-wide; see PR #100)
+        uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100)
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.0 (4.38.1 blocked estate-wide; see PR #100)
+        uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100)
         with:
           category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 81eaaca..4937deb 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -245,7 +245,7 @@ jobs:
           always() &&
           (github.event_name != 'pull_request' ||
            github.event.pull_request.head.repo.fork != true)
-        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.0 (4.38.1 blocked estate-wide; see PR #100)
+        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100)
         with:
           sarif_file: hypatia.sarif
           # Distinct category so Hypatia results coexist with CodeQL's