chore(ci): SPDX headers on line 1 and Actions lockfile minted - #46
Conversation
Two estate gates, one change. **SPDX.** `governance / Workflow security linter` checks `head -1 | grep`, so a workflow carrying its identifier below a managed-by comment reports as missing one. Each file's OWN identifier is moved to line 1 — nothing is imposed, because repositories here are variously MPL-2.0, PMPL-1.0-or-later and AGPL-3.0-or-later and a default would mis-declare the minority. Licences seen here: MPL-2.0. **Lockfile.** `gh actions-lock` resolves each symbolic ref to a verified commit plus owner_id, repo_id and the transitive dependencies of composite actions — which is what OSSF Scorecard's Pinned-Dependencies check is asking for, and what an inline SHA cannot express. ⚠ Do NOT additionally SHA-pin inline. The mechanisms are mutually exclusive: `gh actions-lock` refuses a ref no tag or branch contains, so inline pinning REMOVES actions from the lockfile. Measured on hypatia 2026-08-07 — 40 inline pins caused 14 startup_failures and dropped 7 lockfile entries. Verified: all workflows parse, no duplicate identifiers, lockfile verify says "All 11 workflows have complete lockfile coverage.".
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
|
Note Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime. Code Review ✅ Approved 2 resolved / 2 findingsMoves SPDX headers and mints an Actions lockfile, but places a managed-by comment on line 1 which breaks the SPDX linter and unpins action commit SHAs to mutable tags. ✅ 2 resolved✅ Bug: Managed-by comment on line 1 breaks SPDX linter (opposite of goal)
✅ Security: Actions unpinned from commit SHAs to mutable tags/branches
OptionsDisplay: compact → Showing less information. Comment with these commands to change the behavior for this request:
Important Your trial ends in 3 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more. Was this helpful? React with 👍 / 👎 | Gitar |
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
`gh actions-lock` inserts `# This workflow is managed by gh actions-lock.` at line 1, which displaced the SPDX identifier moved there earlier in this branch. The linter greps `head -1` only, so the header read as missing again. Each file's OWN identifier is moved back to line 1 — nothing imposed. Files already correct are untouched, and any file carrying two identifiers aborts the change rather than guessing.
✅ All code review findings resolved.
|
1 participant
Two estate gates, one change.
SPDX — the linter checks
head -1only, so workflows carrying their identifier below a managed-by comment report as missing one. Each file's own identifier is moved to line 1; nothing is imposed (repos here are variously MPL-2.0, PMPL-1.0-or-later, AGPL-3.0-or-later). Licences in this repo:MPL-2.0.Lockfile (minted) —
gh actions-lockresolves each symbolic ref to a verified commit plus owner_id, repo_id and the transitive dependencies of composite actions. That is what Scorecard's Pinned-Dependencies check wants, and what an inline SHA cannot express.⚠ Do not additionally SHA-pin inline — the mechanisms are mutually exclusive, and inline pinning removes actions from the lockfile (measured on hypatia: 14
startup_failures).Verified: all workflows parse · no duplicate SPDX identifiers ·
gh actions-lock --verify-local: All 11 workflows have complete lockfile coverage.🤖 Generated with Claude Code