From 6a12e317b5c90ef88b66fd4cd6319b7fb81cd502 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 21 Jul 2026 07:33:04 +0100 Subject: [PATCH] fix(ci): add missing SPDX headers to workflow files MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Governance reusable's "Workflow security linter" job requires every .github/workflows/*.yml to carry an SPDX-License-Identifier on line 1. These files were missing it, so the Governance workflow failed on every push — one more red workflow feeding the ci_activity notification flood. Identifier (MPL-2.0) is taken from this repo's own existing workflow headers, which agree unanimously — not assumed. Files: boj-build.yml codeql.yml dependabot-automerge.yml instant-sync.yml mirror.yml openssf-compliance.yml pages.yml rhodibot.yml rust-ci.yml secret-scanner.yml static-analysis-gate.yml Co-Authored-By: Claude Opus 4.8 --- .github/workflows/boj-build.yml | 1 + .github/workflows/codeql.yml | 1 + .github/workflows/dependabot-automerge.yml | 1 + .github/workflows/instant-sync.yml | 1 + .github/workflows/mirror.yml | 1 + .github/workflows/openssf-compliance.yml | 1 + .github/workflows/pages.yml | 1 + .github/workflows/rhodibot.yml | 1 + .github/workflows/rust-ci.yml | 1 + .github/workflows/secret-scanner.yml | 1 + .github/workflows/static-analysis-gate.yml | 1 + 11 files changed, 11 insertions(+) diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml index 4af0ee3..f69efd2 100644 --- a/.github/workflows/boj-build.yml +++ b/.github/workflows/boj-build.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 # diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 6257962..297134b 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 name: CodeQL Security Analysis diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index 64623c0..d2d50fd 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 # diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index cd1cc06..b45dc46 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 # Instant Forge Sync - Triggers propagation to all forges on push/release diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 82565aa..825b994 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 name: Mirror to Git Forges diff --git a/.github/workflows/openssf-compliance.yml b/.github/workflows/openssf-compliance.yml index 7202291..d6741b2 100644 --- a/.github/workflows/openssf-compliance.yml +++ b/.github/workflows/openssf-compliance.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 # OpenSSF Best Practices compliance gate — blocks PRs and pushes that lack diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 649dcb1..2697b6e 100755 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 name: GitHub Pages (Ddraig SSG) on: push: diff --git a/.github/workflows/rhodibot.yml b/.github/workflows/rhodibot.yml index 97cd96e..00d5951 100644 --- a/.github/workflows/rhodibot.yml +++ b/.github/workflows/rhodibot.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 # rhodibot.yml — Automated RSR compliance enforcement diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index c8865af..9b2810d 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 # Rust CI — thin wrapper calling the shared estate reusable in diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index e57df1a..c04b443 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 name: Secret Scanner diff --git a/.github/workflows/static-analysis-gate.yml b/.github/workflows/static-analysis-gate.yml index e77b3a1..e814c3e 100644 --- a/.github/workflows/static-analysis-gate.yml +++ b/.github/workflows/static-analysis-gate.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 # Static Analysis Gate — Required by branch protection rules.