From 6e9d24a5274c235105698a301a8f7b2fe8eff2ec Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 21 Jul 2026 16:05:33 +0100 Subject: [PATCH] fix(governance): add SPDX header to pages.yml, refresh three stale standards pins MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Both failing Governance jobs are root-caused and fixed. Workflow security linter The failure was `.github/workflows/pages.yml missing SPDX header`. pages.yml arrived in #51 and begins directly at `name:`. Every other workflow in the repo already carries the header; this was the only one. Added. Recording a correction: an earlier audit in this programme reported that every workflow already had both an SPDX header and a top-level `permissions:` block, and the hypothesis that SPDX was the cause was marked disproved. That audit was wrong. The real cause is exactly the one first suspected. Check Workflow Staleness Three callers pinned standards reusables at d7c22711e830, which the gate measured as 63 commits / 24 days behind standards HEAD — outside its recency window of >50 commits AND >14 days: * governance-reusable.yml * hypatia-scan-reusable.yml * scorecard-reusable.yml All three refreshed to f9dca6ded2cad8ab54044c1cb0489b558ae2682b (full 40-char SHA; the gate's message quotes the abbreviated form). Deliberately NOT touched: * mirror-reusable.yml (d135b05) and secret-scanner-reusable.yml (c65436e) — neither was flagged by the staleness gate, and the secret-scanner pin in particular should not be moved independently of the gitleaks allowlist work. * scorecard-enforcer.yml — the gate's message asks for its removal, but this repository does not have that file. That clause is generic advice, not a finding against this repo. Verified: actionlint 0 errors; all 18 workflows carry an SPDX header. --- .github/workflows/governance.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- .github/workflows/pages.yml | 2 ++ .github/workflows/scorecard.yml | 2 +- 4 files changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 13327b9..3f783fa 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -13,4 +13,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e \ No newline at end of file + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@f9dca6ded2cad8ab54044c1cb0489b558ae2682b \ No newline at end of file diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 02b0e9c..637e90d 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -16,4 +16,4 @@ permissions: jobs: scan: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e \ No newline at end of file + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@f9dca6ded2cad8ab54044c1cb0489b558ae2682b \ No newline at end of file diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 649dcb1..f2ebfff 100755 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -1,3 +1,5 @@ +# SPDX-License-Identifier: MPL-2.0 +# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) name: GitHub Pages (Ddraig SSG) on: push: diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 4ecc2ad..db25ae8 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -13,7 +13,7 @@ permissions: jobs: scorecard: - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@f9dca6ded2cad8ab54044c1cb0489b558ae2682b permissions: contents: read security-events: write