From 21c8797a47d5d2f16ef85be78cc0289df94a334f Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 10 Nov 2026 16:26:27 +0000 Subject: [PATCH] ci(workflow-linter): find the SPDX header in the leading comment block The SPDX check read only line 1 of each workflow, but gh actions-lock puts '# This workflow is managed by gh actions-lock.' there, so all 30 workflows failed although each carries its SPDX header in the opening comment block. The check now looks through that block, as the RSR template does. A file with no SPDX line, or one after the workflow body, still fails (checked under gawk and mawk). push also runs only on main now, as in the template (rsr-template-repo#322), so a PR push is linted once. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_0136P7ZnmBahbhfkFEP6ark4 --- .github/workflows/workflow-linter.yml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml index 4523c3c..fb8bb24 100644 --- a/.github/workflows/workflow-linter.yml +++ b/.github/workflows/workflow-linter.yml @@ -8,6 +8,10 @@ name: Workflow Security Linter on: push: + # A PR push already runs this through pull_request; push runs only on + # main, so each PR push is linted once and main is still checked after merge. + branches: + - main paths: - '.github/workflows/**' pull_request: @@ -38,13 +42,15 @@ jobs: failed=0 for file in .github/workflows/*.yml .github/workflows/*.yaml; do [ -f "$file" ] || continue - if ! head -1 "$file" | grep -q "^# SPDX-License-Identifier:"; then + # actions-lock may prepend its own comment. Require the licence + # in the leading comment block, before the workflow body. + if ! awk '/^# SPDX-License-Identifier:/ { found=1 } /^[^#[:space:]]/ { exit } END { exit !found }' "$file"; then echo "ERROR: $file missing SPDX header" failed=1 fi done if [ $failed -eq 1 ]; then - echo "Add '# SPDX-License-Identifier: MPL-2.0' as first line" + echo "Add '# SPDX-License-Identifier: MPL-2.0' to the leading comment block" exit 1 fi echo "All workflows have SPDX headers"