fix(ci): repoint codeql-action at a SHA that exists

[hyperpolymath]

github/codeql-action@29b1f65c1f735799893313399435a59f54045865 is pinned here but exists in no repository — the GitHub API returns 422 for it.

CodeQL therefore could not start: the run graph fails to build and the job reports startup_failure, so this repository has had no CodeQL scanning at all.

Repointed at 4187e74d05793876e9989daffde9c3e66b4acd07, which is what the v3 tag currently resolves to (v3.37.3), verified against the API.

Found while auditing the estate: the same non-existent SHA was pinned in 104 repositories, so CodeQL was dead across nearly all of them.

---

Summary by Gitar

• CI & Workflows:
  • Repointed codeql-action to a valid SHA and added actions: read permissions across workflow files
• Project Governance & Documentation:
  • Added project governance, maintainers, and funding configuration files
• Licensing & Compliance:
  • Added and updated open-source license files including AGPL-3.0-or-later.txt and CC-BY-SA-4.0.txt

_{This will update automatically on new commits.}

[gitar-bot]

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

Code Review ✅ Approved 3 resolved / 3 findings

Updates CodeQL actions to use valid SHA pins and adds project governance and licensing files. However, funding.yml uses an unrecognized lowercase filename, mise.toml incorrectly uses [alias] for shell commands, and several invalid tool names are listed under [tools].

✅ 3 resolved

✅ Bug: funding.yml lowercase filename won't be recognized by GitHub

📄 .github/funding.yml:1-4
GitHub only detects the sponsor-button config when the file is named .github/FUNDING.yml (uppercase); a lowercase .github/funding.yml is ignored, so the github: metadatastician sponsor button will never appear. Rename the file to .github/FUNDING.yml.

✅ Bug: mise.toml [alias] misused for shell commands instead of [tasks]

📄 mise.toml:52-57
In mise, [alias] maps a tool name to a version alias (e.g. node.lts = "22"), not a command string. Entries like build = "cargo build --release || npm run build || go build" are not valid aliases and will not run as intended; command definitions belong in a [tasks] table. Move task/build/test/lint/fmt into [tasks] (using run =) so they actually execute.

✅ Bug: mise.toml lists several invalid/non-installable tool names

📄 mise.toml:1-15
Several [tools] entries are not valid mise registry short-names and will make mise install fail: denojs should be deno, and runtime-bundled managers/binaries such as npm, cargo, pip, and gofmt are not standalone mise tools (they ship with node/rust/python/go). Testing frameworks like vitest/jest are also not mise tools. Remove the bundled/invalid entries and rename denojs to deno.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}