From df332375758f23d544b7e53da1da99cd94c74982 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 21 Jul 2026 07:31:29 +0100 Subject: [PATCH] fix(ci): add missing SPDX headers to workflow files MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Governance reusable's "Workflow security linter" job requires every .github/workflows/*.yml to carry an SPDX-License-Identifier on line 1. These files were missing it, so the Governance workflow failed on every push — one more red workflow feeding the ci_activity notification flood. Identifier (MPL-2.0) is taken from this repo's own existing workflow headers, which agree unanimously — not assumed. Files: boj-build.yml casket-pages.yml cflite_batch.yml cflite_pr.yml codeql.yml governance.yml hypatia-scan.yml instant-sync.yml mirror.yml pages.yml rust-ci.yml scorecard.yml secret-scanner.yml Co-Authored-By: Claude Opus 4.8 --- .github/workflows/boj-build.yml | 1 + .github/workflows/casket-pages.yml | 1 + .github/workflows/cflite_batch.yml | 1 + .github/workflows/cflite_pr.yml | 1 + .github/workflows/codeql.yml | 1 + .github/workflows/governance.yml | 1 + .github/workflows/hypatia-scan.yml | 1 + .github/workflows/instant-sync.yml | 1 + .github/workflows/mirror.yml | 1 + .github/workflows/pages.yml | 1 + .github/workflows/rust-ci.yml | 1 + .github/workflows/scorecard.yml | 1 + .github/workflows/secret-scanner.yml | 1 + 13 files changed, 13 insertions(+) diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml index c201d85..6daf3a2 100644 --- a/.github/workflows/boj-build.yml +++ b/.github/workflows/boj-build.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 name: BoJ Server Build Trigger diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml index a0276a1..5373499 100644 --- a/.github/workflows/casket-pages.yml +++ b/.github/workflows/casket-pages.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 name: GitHub Pages diff --git a/.github/workflows/cflite_batch.yml b/.github/workflows/cflite_batch.yml index 18f3994..ae2d111 100644 --- a/.github/workflows/cflite_batch.yml +++ b/.github/workflows/cflite_batch.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 name: ClusterFuzzLite Batch diff --git a/.github/workflows/cflite_pr.yml b/.github/workflows/cflite_pr.yml index 7442e8b..9ec35d1 100644 --- a/.github/workflows/cflite_pr.yml +++ b/.github/workflows/cflite_pr.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 name: ClusterFuzzLite PR diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index e58ca0c..bae8d3f 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 name: CodeQL Security Analysis diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index a1a8881..106963f 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 # governance.yml — single wrapper calling the shared estate governance bundle diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index baccf3f..38a80d6 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 # Thin wrapper around hyperpolymath/standards hypatia-scan-reusable.yml. diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index 95867cf..4cc5e3f 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 # Instant Forge Sync - Triggers propagation to all forges on push/release diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 6efb50d..ead31c6 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 name: Mirror to Git Forges diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 649dcb1..2697b6e 100755 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 name: GitHub Pages (Ddraig SSG) on: push: diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index c8865af..9b2810d 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 # Rust CI — thin wrapper calling the shared estate reusable in diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 721ba5f..17b8ee8 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 name: Scorecards supply-chain security diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index a025a61..7e4b114 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 name: Secret Scanner