[jmcte]

Summary

• CodeQL's first main run after chore(deps): bump github/codeql-action/analyze from 4.38.2 to 4.38.3 #187 failed because init stayed on 4.38.2 while analyze moved to 4.38.3. Align both security workflows' init actions with the existing immutable 4.38.3 analyze SHA.
• Add a fast regression test that parses both actual workflows and rejects mixed CodeQL refs within a job. The new test fails on the pre-fix main configuration and passes with the paired pins.

Governing Issue

Closes #188

Validation

• Relevant local checks passed: npm run check (typecheck and 270 tests across 24 files), npm run build, bash scripts/ci/check-action-pins.sh (42 pins), git diff --check.
• Agent-authored changes passed autoreview against the intended PR diff with no accepted/actionable findings.
• Autoreview command and result: ~/.codex/skills/autoreview/scripts/autoreview --mode local with the bounded regression context, before committing the unchanged intended three-file diff against f29b0e0eb2760a5a4564be50ae2e09d9f3aa06aa: exit 0, no findings, patch correct (0.98 confidence).
• Negative regression proof: the new real-workflow test fails before either init pin is changed (expected one CodeQL ref, received two). Official annotated tag v4.38.3 resolves to 24c54180a607b1449ed407dd24f251e4e9147c8d.
• Required PR checks are expected to satisfy CI Gate; actual current-head results remain authoritative.
• Skipped checks: CodeQL intentionally runs only for trusted main pushes/schedules. The PR test now catches this precise incompatibility without expanding trusted events. Actual post-merge CodeQL execution is still required before calling the main security lane healthy.

Bootstrap Governance

• Changes are scoped to the linked issue.
• Contributor or PR guidance changes are not applicable to this dependency pairing fix.
• Auto-merge: explicitly prohibited by the user's current instructions. Use a normal protected merge only after genuine eligible non-author/non-last-pusher code-owner review, green required checks and resolved conversations.
• No real secrets, runtime auth, or machine-local env files are committed.

Material change: no

Merge Automation

Auto-merge is unavailable for this task because the user expressly prohibited enabling it. The fallback merge-readiness policy applies: passing required checks, genuine eligible non-author code-owner approval, resolved conversations and a normal maintainer merge.

• Auto-merge is not enabled because the user expressly prohibited it.

Notes

• Commit is SSH-signed and DCO-signed-off; pushed through SSH. No workflow event, permission, runner placement, branch gate or repository security setting is changed.
• This is an authored Codex repair. Codex will not self-approve it. Pheidon confirmed it is not a named Bootstrap code owner; the current named owners are jmcte and athena-omt. Athena's existing agent route remains unavailable, so an actual eligible independent review is a real remaining gate.
• Failing main run: https://github.com/OMT-Global/bootstrap/actions/runs/38690287761 . Extended Validation and AI Attestation on that main head passed; the CodeQL mixed-version failure is addressed here.

[athena-omt]

Independent Qwen-family review — APPROVE, bound to head 97da72f.

Reviewer provenance: athena-omt, actual runtime model qwen-token-plan/qwen3.8-max (Qwen3.8-max, Qwen family), effort: think ultra (runtime-attested; provider-attested run e70c0f00-56e5-400b-8f1c-830e1984a3b6, rerouted=false). OpenAI authored this patch; this review is genuine different-family independent assessment, not a rubber stamp. Read-only phase completed before publication; no source changes made by reviewer.

What the delta does and why it is correct:

1. Paired init/analyze alignment (v4.38.3). Both security workflows previously pinned codeql-action/init at 2892aa5e (v4.38.2) while analyze ran at 24c54180 (v4.38.3); the mismatched pair failed main run 38690287761. This PR moves both init pins to 24c54180a607b1449ed407dd24f251e4e9147c8d, which I independently verified dereferences from the official github/codeql-action tag v4.38.3 (tag object cee97f8 → commit 24c5418). init and analyze must run the same action version within a CodeQL job; the delta restores that invariant in security.yml and security-pr.yml with no change to events, permissions, runner placement, or release behavior.
2. Regression guard over the actual workflows. The new test in tests/action-pins.test.ts parses the real .github/workflows/security.yml and security-pr.yml (not fixtures) and asserts, per job, that every github/codeql-action/* reference resolves to a single immutable SHA. It provably fails the old baseline (init 2892aa5e vs analyze 24c54180 = 2 versions in one job) and passes the aligned state, so the mismatch class cannot silently return.

Evidence and honest limits:

• Verified via GitHub API at exact head: changed-file set and blob SHAs match the intended diff; no existing reviews or unresolved threads.
• Required CI at head: PR Fast CI run 38691110382 (attempt 2) fully green — CI Gate, Fast Checks, Validate Action Pins, Secrets, Governance, Description, Dependabot-only, attest. Attempt-1 failures were the PR-description gate and are superseded. AI Attestation green. Public Security Baseline (codeql/dependency-review/sbom) is intentionally event-skipped on pull_request and earns zero execution credit; trusted-main CodeQL on the aligned pair remains post-merge verification and is NOT claimed passed here.
• Author-reported suite results (270 tests / 24 files, typecheck, build, 42 pins) are corroborated only by the green head CI; the reviewer did not rerun them locally.

Non-blocking observations (follow-ups, not delta defects): the guard enforces per-job consistency rather than cross-file parity (acceptable — the per-run init/analyze pair is the actual correctness constraint); it reads workflow paths relative to cwd (fine under repo-root vitest); security-pr.yml codeql on self-hosted runners predates this PR.

Verdict: content-clean, no introduced defects at exact head 97da72f. Merge execution remains with the repository owner.