fix(ci): repoint codeql-action at a SHA that exists

[hyperpolymath]

github/codeql-action@29b1f65c1f735799893313399435a59f54045865 is pinned here but exists in no repository — the GitHub API returns 422 for it.

CodeQL therefore could not start: the run graph fails to build and the job reports startup_failure, so this repository has had no CodeQL scanning at all.

Repointed at 4187e74d05793876e9989daffde9c3e66b4acd07, which is what the v3 tag currently resolves to (v3.37.3), verified against the API.

Found while auditing the estate: the same non-existent SHA was pinned in 104 repositories, so CodeQL was dead across nearly all of them.

---

Summary by Gitar

• CI updates:
  • Repointed codeql-action to a valid SHA 4187e74d to fix startup failures
  • Added actions: read permission across workflow files
• Documentation:
  • Added CONTRIBUTING.md and cleaned up duplicate governance files

_{This will update automatically on new commits.}

[gitar-bot]

CI failed: Estate compliance check failed due to the presence of a disallowed `flake.nix` file instead of the required Guix packaging configuration.

Overview

1 log analyzed across 1 job revealed an estate compliance failure. The CI check rejected the presence of Nix packaging (flake.nix), which violates the repository's estate policy mandating Guix packaging.

Failures

Estate Policy Violation: Disallowed Nix Packaging (confidence: high)

• Type: configuration
• Affected jobs: 90324133365
• Related to change: yes
• Root cause: The repository includes a flake.nix file, violating estate policy (LANGUAGE-POLICY.adoc) which requires Guix as primary packaging (guix.scm, manifest.scm, channels.scm, .guix-channel) with a Containerfile escape hatch and prohibits Nix mirrors.
• Suggested fix: Create functional Guix packaging files (guix.scm, manifest.scm, channels.scm, .guix-channel, and Containerfile), and remove flake.nix.

Summary

• Change-related failures: 1 configuration failure caused by policy non-compliance (flake.nix instead of Guix).
• Infrastructure/flaky failures: None.
• Recommended action: Replace flake.nix with proper Guix configuration files and a Containerfile following estate guidelines.

Code Review ✅ Approved

Repoints the CodeQL action at a valid SHA to resolve startup failures and adds missing read permissions across workflow files. No issues found.

Auto-approved and auto-merge armed: No blocking issues found.
Please see Auto-approve Docs for details on setting custom approval criteria. — merges when pipeline and required approvals pass.

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[gitar-bot]

⚠️ Gitar auto-approved this PR but could not enable auto-merge: auto-merge is disabled for this repository — enable "Allow auto-merge" in the repository settings.

[gitar-bot]

Gitar has auto-approved this PR and enabled auto-merge (configure)