fix(ci): codeql-action v4.38.1 -> v4.38.0 SHA pin + dependabot hold (estate-wide startup_failure)

[hyperpolymath]

Summary

Estate-wide incident: github/codeql-action v4.38.1 fails GitHub workflow startup on every repo that took it — CodeQL/Hypatia runs die with startup_failure, zero jobs dispatched, no error text via the API. Full investigation + evidence chain: nexia-list#100.

Changes

• codeql-action/* refs (tag @v4.38.1 or SHA 1c5b675…) re-pinned to the v4.38.0 commit b96794f015dfd88f77b49b1c93e0fa7110f94c63 (green on deed-ecosystem; satisfies SHA-pin policy).
• actions.lock re-keyed where present (dependabot bumps uses: without regenerating the lock → governance linter failure).
• dependabot.yml: full hold on github/codeql-action — scoped versions: ignores do NOT hold on this path (nexia-list#101 re-raised the bump in SHA form within an hour, copying the inline warning comment verbatim while swapping the SHA).

Canonical fix at the estate origin: standards#973. Batch-mates: nexia-list#100 (merged), hypatia#828, vexometer#90, rsr-template-repo#191, empty-linter#99, modshells#119, plasma-parser-writer#98, robodog-defensive-systems-lab#145, twingate-helm-deploy#138, wokelang#147, laniakea#91, maa-framework#198, methodologies#92, rpa-elysium#134, scripts#136, universal-chat-extractor#165, verisimdb#280. Lift the hold once upstream clears 4.38.1 or a canary verifies green.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 63717335-82e1-4589-8571-f75d3135d4a0

📥 Commits

Reviewing files that changed from the base of the PR and between 5cd4229 and 95cfe8a.

📒 Files selected for processing (2)

• .github/dependabot.yml
• .github/workflows/codeql.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (23)

• GitHub Check: scan / gitleaks
• GitHub Check: scan / rust-secrets
• GitHub Check: scan / shell-secrets
• GitHub Check: hypatia / Hypatia Neurosymbolic Analysis
• GitHub Check: governance / Well-Known (RFC 9116 + RSR)
• GitHub Check: governance / Guix primary / Nix fallback policy
• GitHub Check: governance / Trusted-base reduction policy
• GitHub Check: governance / Licence consistency
• GitHub Check: governance / Code quality + docs
• GitHub Check: governance / Check Workflow Staleness
• GitHub Check: governance / Security policy checks
• GitHub Check: governance / Workflow security linter
• GitHub Check: validate
• GitHub Check: governance / Language / package anti-pattern policy
• GitHub Check: analyze (actions, none)
• GitHub Check: test (1.11)
• GitHub Check: test (1.10)
• GitHub Check: Groove manifest check
• GitHub Check: Validate DEED manifests
• GitHub Check: Empty-linter (invisible characters)
• GitHub Check: Validate K9 contracts
• GitHub Check: test (1.11)
• GitHub Check: test (1.10)

🧰 Additional context used

🪛 YAMLlint (1.37.1)

.github/dependabot.yml

[error] 18-18: too many blank lines (1 > 0)

(empty-lines)

🔇 Additional comments (2)

.github/workflows/codeql.yml (1)

36-36: LGTM!

Also applies to: 41-41

.github/dependabot.yml (1)

12-17: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated the automated code-scanning workflow to use CodeQL Action v4.38.0.
  • Pinned the CodeQL Action version to maintain a consistent scanning setup and prevent automatic version changes.

Walkthrough

The CodeQL workflow now uses the v4.38.0 action commit. Dependabot ignores updates for github/codeql-action and documents the version hold.

Changes

CodeQL version management

Layer / File(s)	Summary
Pin and hold CodeQL action version .github/workflows/codeql.yml, .github/dependabot.yml	The workflow updates both CodeQL action references to the v4.38.0 commit. Dependabot ignores updates for github/codeql-action and records the reason for holding this version.

Priority: ⬆️ High

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 95cfe

The workflow is pinned to the intended CodeQL version and future updates are held, reducing recurrence of the reported startup failures. No actionable merge-blocking risk is currently established.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the main changes: reverting CodeQL Action to v4.38.0 with a SHA pin and adding a Dependabot hold. It is specific and related to the changeset, despite being longer than pre…
Description check	✅ Passed	The description directly explains the CodeQL Action rollback, Dependabot hold, workflow startup failures, and related lock-file changes. It is relevant to the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the CodeQL pin
v4.38.0 now starts within
Dependabot waits by the gate
No newer action updates its state
The workflow runs with versions straight}

_{Comment @coderabbitai help to get the list of available commands.}