You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
ci(workflow-linter): look for SPDX in the leading comment block - #139
The SPDX check in workflow-linter.yml reads only line 1 of each workflow. Dependabot's actions-lock bumps prepend # This workflow is managed by gh actions-lock. above the existing header, so all 23 workflows on main now have their SPDX line on line 2 or later and fail the check. Moving it back to the top would only last until the next bump.
Change
The "Check SPDX headers" step now accepts an SPDX-License-Identifier anywhere in the leading block of comment and blank lines, before the first YAML line. A file whose only SPDX line comes after YAML, or that has none, still fails.
Testing
I ran the step scripts locally against this branch:
SPDX check: exit 0.
Permissions check: exit 0.
Negative test: a file with no SPDX header and a file with SPDX after name: both fail.
The "Check SPDX headers" step only read line 1 of each workflow. Dependabot's
actions-lock bumps now prepend "# This workflow is managed by gh
actions-lock." above the existing header, so every workflow's SPDX line sits
on line 2 or later and lint-workflows fails on main ("missing SPDX header",
one error per file). Moving the SPDX line back to the top would last only
until the next Dependabot bump.
The check now accepts an SPDX-License-Identifier anywhere in the leading
block of comment and blank lines, before the first YAML line. A file whose
only SPDX line comes after YAML content, or that has none, still fails.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0132Cdz3iwk2QGKv2sUhhsye
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 1dcc356f-e2ab-4e5c-94c8-53f463e8af05
Commits
Reviewing files that changed from the base of the PR and between 5318bfe and 05f4e92.
Files selected for processing: 1
.github/workflows/workflow-linter.yml
No actionable comments were generated in the recent review.
Summary
Summary by CodeRabbit
Chores
The workflow license check now accepts SPDX identifiers in the opening comment and blank lines, and still reports an error if none is found there.
The SPDX check now searches the initial comment and blank-line section of each workflow file. It stops at the first non-comment, non-blank line and fails if the identifier is absent.
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: ASSERTIVE
Plan: Advanced
Run ID: e72f392f-cbff-4447-8122-a04c8c7aca4e
Commits
Reviewing files that changed from the base of the PR and between 1d6ecd0 and 5318bfe.
Files selected for processing: 1
.github/workflows/workflow-linter.yml
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.
The failing finishingbot / release-readiness and rhodibot / rsr-compliance checks are not caused by this PR, so they won't be fixed here.
What fails: both checks are gitbot-fleet audits of the whole repository's content.
Why they aren't this PR's: both also fail on main on every recent push, including 1d6ecd0, 8e217f3 and e4adfec. This PR changes only one line in .github/workflows/workflow-linter.yml.
Fix: none exists yet. The audit findings are in each run's uploaded *-results artifact. Clearing them is repository-content work (the descriptile/RSR layout migration) that is outside this PR's scope.
The check this PR targets is Workflow Linter / lint-workflows.
SonarCloud's quality gate failed this PR on two findings in the lines
around the SPDX change: "Redirect this error message to stderr (>&2)"
on the missing-SPDX and missing-permissions echo lines. Both lines are
diagnostics, and the step's result still comes from its exit status, so
sending them to stderr changes nothing about pass or fail.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0132Cdz3iwk2QGKv2sUhhsye
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
What was wrong
The SPDX check in
workflow-linter.ymlreads only line 1 of each workflow. Dependabot's actions-lock bumps prepend# This workflow is managed by gh actions-lock.above the existing header, so all 23 workflows onmainnow have their SPDX line on line 2 or later and fail the check. Moving it back to the top would only last until the next bump.Change
The "Check SPDX headers" step now accepts an
SPDX-License-Identifieranywhere in the leading block of comment and blank lines, before the first YAML line. A file whose only SPDX line comes after YAML, or that has none, still fails.Testing
I ran the step scripts locally against this branch:
name:both fail.Generated by Claude Code