fix(ci): repoint codeql-action at a SHA that exists

[hyperpolymath]

github/codeql-action@29b1f65c1f735799893313399435a59f54045865 is pinned here but exists in no repository — the GitHub API returns 422 for it.

CodeQL therefore could not start: the run graph fails to build and the job reports startup_failure, so this repository has had no CodeQL scanning at all.

Repointed at 4187e74d05793876e9989daffde9c3e66b4acd07, which is what the v3 tag currently resolves to (v3.37.3), verified against the API.

Found while auditing the estate: the same non-existent SHA was pinned in 104 repositories, so CodeQL was dead across nearly all of them.

---

Summary by Gitar

• Security & Compliance:
  • Added CODE_OF_CONDUCT.md and removed duplicate GOVERNANCE.adoc
  • Granted actions: read permission across workflow files for security compliance

_{This will update automatically on new commits.}

[gitar-bot]

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

CI failed: The rust-ci workflow failed because the required 'toolchain' input was missing or not properly supplied when calling the setup action.

Overview

1 log analyzed across 1 job revealed a configuration failure in the CI pipeline where a required toolchain input was omitted.

Failures

Missing 'toolchain' input in rust-ci workflow (confidence: high)

• Type: configuration
• Affected jobs: 90323956770
• Related to change: yes
• Root cause: The Rust toolchain setup step or action received an empty or missing 'toolchain' parameter, triggering a required input validation failure.
• Suggested fix: Update the workflow configuration to explicitly provide a valid 'toolchain' input value (such as stable, nightly, or a specific version string).

Summary

• Change-related failures: 1 configuration error due to a missing required input in the CI workflow.
• Infrastructure/flaky failures: None
• Recommended action: Ensure that all custom action or workflow step calls define the required toolchain input parameter in the workflow files.

Code Review ✅ Approved 1 resolved / 1 findings

Updates CodeQL action reference, cleans up duplicate governance files, and hardens workflow permissions. The newly added CODE_OF_CONDUCT.md contains a template placeholder and incorrect project name.

✅ 1 resolved

✅ Quality: CODE_OF_CONDUCT.md ships template block and wrong project name

📄 CODE_OF_CONDUCT.md:3-17 📄 CODE_OF_CONDUCT.md:25 📄 CODE_OF_CONDUCT.md:313
The new CODE_OF_CONDUCT.md still contains the template instructions block that explicitly says "delete this block before publishing" (lines 3-21) and references a different project throughout: "Squisher Corpus" and "squisher-corpus" instead of git-reticulator (e.g. lines 8-10, 25, 313). Publishing this makes the repo's conduct policy point contributors at the wrong project name and discussion URL (https://github.com/hyperpolymath/squisher-corpus/discussions). Delete the template comment block and replace all placeholder values with git-reticulator's actual name, repo slug, and URLs.

Tip

Comment Gitar fix CI to trigger a fix.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.