From 5318bfe15ae9704563db2c0b61f738678d808905 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 4 Nov 2026 23:48:40 +0000 Subject: [PATCH 1/2] ci(workflow-linter): look for SPDX in the leading comment block The "Check SPDX headers" step only read line 1 of each workflow. Dependabot's actions-lock bumps now prepend "# This workflow is managed by gh actions-lock." above the existing header, so every workflow's SPDX line sits on line 2 or later and lint-workflows fails on main ("missing SPDX header", one error per file). Moving the SPDX line back to the top would last only until the next Dependabot bump. The check now accepts an SPDX-License-Identifier anywhere in the leading block of comment and blank lines, before the first YAML line. A file whose only SPDX line comes after YAML content, or that has none, still fails. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_0132Cdz3iwk2QGKv2sUhhsye --- .github/workflows/workflow-linter.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml index 14dd5e8..d6ca89b 100644 --- a/.github/workflows/workflow-linter.yml +++ b/.github/workflows/workflow-linter.yml @@ -26,7 +26,7 @@ jobs: errors=0 for f in .github/workflows/*.yml .github/workflows/*.yaml; do [ -f "$f" ] || continue - if ! head -1 "$f" | grep -q "SPDX-License-Identifier"; then + if ! awk '/^[[:space:]]*(#|$)/ { if (/SPDX-License-Identifier/) found = 1; next } { exit } END { exit !found }' "$f"; then echo "ERROR: $f missing SPDX header" errors=$((errors + 1)) fi From 05f4e92926cc280cb1e381c1994d669b62b8e5b7 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 5 Nov 2026 00:15:24 +0000 Subject: [PATCH 2/2] ci(workflow-linter): send the SPDX and permissions errors to stderr SonarCloud's quality gate failed this PR on two findings in the lines around the SPDX change: "Redirect this error message to stderr (>&2)" on the missing-SPDX and missing-permissions echo lines. Both lines are diagnostics, and the step's result still comes from its exit status, so sending them to stderr changes nothing about pass or fail. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_0132Cdz3iwk2QGKv2sUhhsye --- .github/workflows/workflow-linter.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml index d6ca89b..baadcc3 100644 --- a/.github/workflows/workflow-linter.yml +++ b/.github/workflows/workflow-linter.yml @@ -27,7 +27,7 @@ jobs: for f in .github/workflows/*.yml .github/workflows/*.yaml; do [ -f "$f" ] || continue if ! awk '/^[[:space:]]*(#|$)/ { if (/SPDX-License-Identifier/) found = 1; next } { exit } END { exit !found }' "$f"; then - echo "ERROR: $f missing SPDX header" + echo "ERROR: $f missing SPDX header" >&2 errors=$((errors + 1)) fi done @@ -39,7 +39,7 @@ jobs: for f in .github/workflows/*.yml .github/workflows/*.yaml; do [ -f "$f" ] || continue if ! grep -q "^permissions:" "$f"; then - echo "ERROR: $f missing permissions declaration" + echo "ERROR: $f missing permissions declaration" >&2 errors=$((errors + 1)) fi done