fix(ci): repoint codeql-action at a SHA that exists

[hyperpolymath]

github/codeql-action@29b1f65c1f735799893313399435a59f54045865 is pinned here but exists in no repository — the GitHub API returns 422 for it.

CodeQL therefore could not start: the run graph fails to build and the job reports startup_failure, so this repository has had no CodeQL scanning at all.

Repointed at 4187e74d05793876e9989daffde9c3e66b4acd07, which is what the v3 tag currently resolves to (v3.37.3), verified against the API.

Found while auditing the estate: the same non-existent SHA was pinned in 104 repositories, so CodeQL was dead across nearly all of them.

---

Summary by Gitar

• CI workflow fixes:
  • Repointed github/codeql-action to a valid commit SHA (4187e74d...) to resolve startup failures
  • Added CodeQL workflow and actions: read permission across workflow configurations
• Security and community files:
  • Added security policy, code of conduct, contributing guidelines, and Dependabot configuration

_{This will update automatically on new commits.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[gitar-bot]

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

Code Review ✅ Approved 2 resolved / 2 findings

Updates the CodeQL action SHA to restore workflow execution and introduces estate-wide security compliance files. CONTRIBUTING.md is truncated and template placeholders remain unreplaced in the security documentation.

✅ 2 resolved

✅ Bug: CONTRIBUTING.md is truncated/malformed markdown

📄 CONTRIBUTING.md:1-15
CONTRIBUTING.md begins with # Clone the repository followed by raw shell commands and a closing fence on line 16 that was never opened. The document's title, introduction, and the opening code fence for the setup block are missing, so the file renders as broken markdown (shell commands shown as prose, an orphan code fence). It appears the top of the template file was lost when it was committed. Prepend the intended heading and the openingbash fence for the clone/setup snippet.

✅ Quality: Template placeholders not replaced in security/docs files

📄 SECURITY.md:3-17 📄 SECURITY.md:43-46 📄 SECURITY.md:63 📄 SECURITY.md:206 📄 SECURITY.md:325 📄 SECURITY.md:351 📄 CODE_OF_CONDUCT.md:3-17 📄 CODE_OF_CONDUCT.md:25 📄 CONTRIBUTING.md:2-9 📄 CONTRIBUTING.md:89-92
SECURITY.md, CODE_OF_CONDUCT.md, and CONTRIBUTING.md still contain the unfilled template: the project is named "Squisher Corpus"/squisher-corpus and all links point to github.com/hyperpolymath/squisher-corpus instead of this repo (rescript-ecosystem), the PGP fingerprint is literally TBD, and the "TEMPLATE INSTRUCTIONS (delete this block before publishing)" comment blocks are still present. Published, these docs advertise the wrong repository for vulnerability reporting and security advisories. Replace all placeholders with the real repo/org name and contact details and delete the instruction blocks.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.