[hyperpolymath]

Summary

Workflow Security Linter failed on all 30 workflows with missing SPDX header. Every one of them does carry # SPDX-License-Identifier: MPL-2.0, but on line 2 or later: gh actions-lock writes # This workflow is managed by gh actions-lock. on line 1. The check read only line 1.

Changes

• .github/workflows/workflow-linter.yml:
  • The SPDX check looks through the leading comment block, before the workflow body. This is the same check the RSR template uses.
  • push runs only on main, as in ci(workflow-linter): run push only on main rsr-template-repo#322. A PR push is then linted once, through pull_request.

No licence header is changed; this PR only corrects where the check looks.

Testing

• With the new check, all 30 workflows pass. With the old check, all 30 failed.
• Negative controls under both gawk and mawk:
  • a workflow with no SPDX line is rejected;
  • a workflow whose SPDX line comes after the body is rejected.

Not in this PR

The K9 failures in dogfood-gate.yml are a separate matter. The current validator, standards e064539, rejects 15 of this repo's 18 K9 files on content: unfilled TODO/{{PORT}} mint placeholders, missing pedigree fields, and coordination.k9 / session/custom-checks.k9 not being in the coordination dialect. Swapping the validator alone would not turn that job green. It is left for the owner's decision.

---

Generated by Claude Code

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 41 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: bc62a3e4-176b-4af3-8e74-101c2285fa3f

Commits

Reviewing files that changed from the base of the PR and between 04a8b6e and 21c8797.

Files selected for processing: 1

• .github/workflows/workflow-linter.yml

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[chatgpt-codex-connector]

Codex Review Summary: ❌ Failed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	❌ Failed 2026-11-10T16:39:04.052661Z We couldn’t complete this review. Comment @codex review to try again.	21c8797	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[hyperpolymath]

CI status on 21c8797. None of the 4 red checks comes from this diff.

lint-workflows: the SPDX step that this PR changes now passes ("All workflows have SPDX headers"). The job fails one step later, in "Check SHA-Pinned Actions":

✗ Ref changed haskell-actions/setup@v2.12.1
  workflow uses ref "v2.12.1" but lockfile pins "v2.12.0"
✗ Unused lockfile entry haskell-actions/setup@v2.12.0

main has the same drift: pages.yml:39 uses v2.12.1, and actions.lock pins v2.12.0. This PR touches neither file. The fix is a regenerated lockfile. actions.lock is tool-owned, so I did not edit it by hand, and this session cannot install gh-actions-lock. To fix it, run this on main:

gh actions-lock

Then commit the updated .github/workflows/actions.lock.

Validate K9 contracts, SonarQube, Hypatia neurosymbolic scan: these failures are already on main and come from other causes: unfilled K9 mint tokens, no SONAR_TOKEN secret, and the 6 Hypatia findings classified earlier. This PR does not touch them.

Auto-merge stays blocked until the lockfile is fixed on main and merged into this branch.

---

Generated by Claude Code