fix(ci): add missing SPDX headers to workflow files#47
Merged
Conversation
The Governance reusable's "Workflow security linter" job requires every .github/workflows/*.yml to carry an SPDX-License-Identifier on line 1. These files were missing it, so the Governance workflow failed on every push — one more red workflow feeding the ci_activity notification flood. Identifier (MPL-2.0) is taken from this repo's own existing workflow headers, which agree unanimously — not assumed. Files: boj-build.yml casket-pages.yml cflite_batch.yml cflite_pr.yml codeql.yml governance.yml hypatia-scan.yml instant-sync.yml mirror.yml pages.yml rust-ci.yml scorecard.yml secret-scanner.yml Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| @@ -1,3 +1,4 @@ | |||
| # SPDX-License-Identifier: MPL-2.0 | |||
| @@ -1,3 +1,4 @@ | |||
| # SPDX-License-Identifier: MPL-2.0 | |||
| @@ -1,3 +1,4 @@ | |||
| # SPDX-License-Identifier: MPL-2.0 | |||
| @@ -1,3 +1,4 @@ | |||
| # SPDX-License-Identifier: MPL-2.0 | |||
| @@ -1,3 +1,4 @@ | |||
| # SPDX-License-Identifier: MPL-2.0 | |||
| @@ -1,3 +1,4 @@ | |||
| # SPDX-License-Identifier: MPL-2.0 | |||
🔍 Hypatia Security ScanFindings: 66 issues detected
View findings[
{
"reason": "No test directory or test files found",
"type": "no_tests",
"file": "/home/runner/work/docmatrix/docmatrix",
"action": "flag",
"rule_module": "honest_completion",
"severity": "high",
"deduction": 20
},
{
"reason": "Action actions/checkout@v4 needs attention",
"type": "unpinned_action",
"file": "pages.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Action actions/checkout@v4 needs attention",
"type": "unpinned_action",
"file": "pages.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Action actions/upload-pages-artifact@v3 needs attention",
"type": "unpinned_action",
"file": "pages.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Action actions/deploy-pages@v4 needs attention",
"type": "unpinned_action",
"file": "pages.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "codeql.yml lists `language: javascript-typescript` but the repo has no source files in any CodeQL-scannable language. The analyze job will exit 'no source files' on every run. Switch the matrix to `actions` (which scans workflow files — every repo has those).",
"type": "codeql_language_matrix_mismatch",
"file": "codeql.yml",
"action": "switch_codeql_matrix_to_actions",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in push-email-notify.yml",
"type": "missing_timeout_minutes",
"file": "push-email-notify.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in instant-sync.yml",
"type": "secret_action_without_presence_gate",
"file": "instant-sync.yml",
"action": "peter-evans/repository-dispatch",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in mirror.yml",
"type": "secret_action_without_presence_gate",
"file": "mirror.yml",
"action": "webfactory/ssh-agent",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in mirror.yml",
"type": "secret_action_without_presence_gate",
"file": "mirror.yml",
"action": "webfactory/ssh-agent",
"rule_module": "workflow_audit",
"severity": "high"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
Governanceworkflow fails on every push here. Its Workflow security linter job requires every.github/workflows/*.ymlto carry anSPDX-License-Identifiercomment on line 1:This is a real gate catching a real gap — the files below never had the header. Each failure is another red workflow feeding the
ci_activitynotification flood.Licence identifier
MPL-2.0— taken from this repo's own existing workflow headers, which agree unanimously. It is not assumed or copied from a template. Repos with mixed or absent identifiers were deliberately skipped for a manual decision rather than guessed, because an earlier estate sweep flattened co-developed AGPL repos to MPL-2.0.Files
boj-build.yml casket-pages.yml cflite_batch.yml cflite_pr.yml codeql.yml governance.yml hypatia-scan.yml instant-sync.yml mirror.yml pages.yml rust-ci.yml scorecard.yml secret-scanner.ymlPure one-line prepend — no other content is touched.
🤖 Generated with Claude Code