From fdf8e61c97181dfe945ca7cf64430685aabb47b7 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 19 Oct 2026 21:42:24 +0000 Subject: [PATCH] fix(ci): SPDX check accepts the licence after the actions-lock banner `gh actions-lock` writes "# This workflow is managed by gh actions-lock." as the first line of every workflow it touches, which pushes the SPDX line to line 2. The linter only read line 1, so Workflow Security Linter has failed on every workflow since the actions group bump (#77). The check now looks for the SPDX line anywhere in the leading comment block, before the workflow body. This is the rsr-template-repo check (0afa6c9, #237) copied unchanged; standards' governance check works the same way. No workflow header changes. Tested: passes on main's 20 workflows; on planted files it passes SPDX on line 1 or after the banner, and fails no SPDX and SPDX below `name:`. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01Y6FD63UrriRBHqmhhEca9t --- .github/workflows/workflow-linter.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml index b0e79ec..57cf662 100644 --- a/.github/workflows/workflow-linter.yml +++ b/.github/workflows/workflow-linter.yml @@ -32,13 +32,15 @@ jobs: failed=0 for file in .github/workflows/*.yml .github/workflows/*.yaml; do [ -f "$file" ] || continue - if ! head -1 "$file" | grep -q "^# SPDX-License-Identifier:"; then + # actions-lock may prepend its own comment. Require the licence + # in the leading comment block, before the workflow body. + if ! awk '/^# SPDX-License-Identifier:/ { found=1 } /^[^#[:space:]]/ { exit } END { exit !found }' "$file"; then echo "ERROR: $file missing SPDX header" failed=1 fi done if [ $failed -eq 1 ]; then - echo "Add '# SPDX-License-Identifier: MPL-2.0' as first line" + echo "Add '# SPDX-License-Identifier: MPL-2.0' to the leading comment block" exit 1 fi echo "All workflows have SPDX headers"