fix(scripts): the SPDX recipe writes the template rule that stops at an indented body

campaigns/TEMPLATE-DRIFT-CAMPAIGN.adoc

@@ -70,7 +70,9 @@ repair refuses the repository, and no file is changed.
 
 Each recipe was also run on the files of `system-et` at `main` (`04a8b6e`):
 
-* SPDX rule: the step is identical to the step of the template (`c5a1da7`).
+* SPDX rule: the step is identical to the step of the template branch
+  (`rsr-template-repo` pull request 323, `915acb2`). That pull request makes
+  the rule stop at an indented workflow body also.
 * Token guard: the job is identical to the job in pull request 92
   (`9f529ef`). The guard step is identical to the guard step of the template
   branch (`rsr-template-repo` pull request 321, `806dac0`).
@@ -100,6 +102,10 @@ and `fix-lock-self-sha-refs.sh` already cover these.
   inactive file (`e2e.yml.template`).
 * The token guard recipe edits only the shape of the old template. It does
   not rewrite a workflow that a person changed.
+* The SPDX recipe has 1 target: the `head -1` rule. A linter that has the
+  first form of the template rule (the form before `rsr-template-repo` pull
+  request 323, for example in `system-et`) is not a target, and keeps that
+  form.
 * The number of repositories with each target is not known. No estate scan
   was made.
 

scripts/fix-workflow-linter-spdx-rule.sh

@@ -27,7 +27,7 @@ set -euo pipefail
 
 REL=".github/workflows/workflow-linter.yml"
 OLD_RULE='^[[:space:]]*if ! head -1 "\$[A-Za-z_][A-Za-z0-9_]*" \| grep -q "\^# SPDX-License-Identifier:"; then[[:space:]]*$'
-NEW_RULE='/^# SPDX-License-Identifier:/ { found=1 } /^[^#[:space:]]/ { exit } END { exit !found }'
+NEW_RULE='/^# SPDX-License-Identifier:/ { found=1 } /^[[:space:]]*[^#[:space:]]/ { exit } END { exit !found }'
 
 # Print the path of the linter when it is a regular file inside the repository.
 # A missing file, a symlink, or a path that leaves the repository is no target.

tests/template-drift-recipes-test.sh

@@ -82,7 +82,7 @@ cat > "$TMP/expected" <<'YAML'
           for file in .github/workflows/*.yml; do
             # actions-lock may prepend its own comment. Require the licence
             # in the leading comment block, before the workflow body.
-            if ! awk '/^# SPDX-License-Identifier:/ { found=1 } /^[^#[:space:]]/ { exit } END { exit !found }' "$file"; then
+            if ! awk '/^# SPDX-License-Identifier:/ { found=1 } /^[[:space:]]*[^#[:space:]]/ { exit } END { exit !found }' "$file"; then
               echo "ERROR: $file missing SPDX header"
             fi
           done
@@ -100,6 +100,12 @@ printf '# comment\nname: a\n# SPDX-License-Identifier: MPL-2.0\n' > "$TMP/s3"
 awk "$RULE" "$TMP/s1" || fail "$R: the new rule refuses a licence on line 2"
 if awk "$RULE" "$TMP/s2"; then fail "$R: the new rule accepts a file with no licence"; fi
 if awk "$RULE" "$TMP/s3"; then fail "$R: the new rule accepts a licence after the body"; fi
+# A workflow with an indented root mapping: the body starts at the first line
+# that is not a comment, so a licence line after it does not count.
+printf '# comment\n  name: a\n  jobs: {}\n# SPDX-License-Identifier: MPL-2.0\n' > "$TMP/s4"
+printf '# SPDX-License-Identifier: MPL-2.0\n  name: a\n  jobs: {}\n' > "$TMP/s5"
+if awk "$RULE" "$TMP/s4"; then fail "$R: the new rule accepts a licence after an indented body"; fi
+awk "$RULE" "$TMP/s5" || fail "$R: the new rule refuses a licence before an indented body"
 
 # A linter with a different rule is not a target.
 REPO=$(new_repo spdx-other); F="$REPO/.github/workflows/workflow-linter.yml"