From 5f60a55abaab53bca6c09e1c352b2a9e28571d60 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 21 Jul 2026 07:35:06 +0100 Subject: [PATCH] fix(ci): add missing SPDX headers to workflow files MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Governance reusable's "Workflow security linter" job requires every .github/workflows/*.yml to carry an SPDX-License-Identifier on line 1. These files were missing it, so the Governance workflow failed on every push — one more red workflow feeding the ci_activity notification flood. Identifier (MPL-2.0) is taken from this repo's own existing workflow headers, which agree unanimously — not assumed. Files: ada.yml codeql.yml comprehensive-quality.yml generator-generic-ossf-slsa3-publish.yml instant-sync.yml mirror.yml pages.yml secret-scanner.yml workflow-linter.yml Co-Authored-By: Claude Opus 4.8 --- .github/workflows/ada.yml | 1 + .github/workflows/codeql.yml | 1 + .github/workflows/comprehensive-quality.yml | 1 + .github/workflows/generator-generic-ossf-slsa3-publish.yml | 1 + .github/workflows/instant-sync.yml | 1 + .github/workflows/mirror.yml | 1 + .github/workflows/pages.yml | 1 + .github/workflows/secret-scanner.yml | 1 + .github/workflows/workflow-linter.yml | 1 + 9 files changed, 9 insertions(+) diff --git a/.github/workflows/ada.yml b/.github/workflows/ada.yml index cc1a624..98cff3b 100644 --- a/.github/workflows/ada.yml +++ b/.github/workflows/ada.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 name: Ada (GNAT) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index e5be511..80f278a 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 name: CodeQL Security Analysis diff --git a/.github/workflows/comprehensive-quality.yml b/.github/workflows/comprehensive-quality.yml index 37d9eca..59600f2 100644 --- a/.github/workflows/comprehensive-quality.yml +++ b/.github/workflows/comprehensive-quality.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 name: Comprehensive Quality Gates diff --git a/.github/workflows/generator-generic-ossf-slsa3-publish.yml b/.github/workflows/generator-generic-ossf-slsa3-publish.yml index a616aec..5502897 100644 --- a/.github/workflows/generator-generic-ossf-slsa3-publish.yml +++ b/.github/workflows/generator-generic-ossf-slsa3-publish.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 # This workflow uses actions that are not certified by GitHub. diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index 95867cf..4cc5e3f 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 # Instant Forge Sync - Triggers propagation to all forges on push/release diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 3665d45..6270c49 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 name: Mirror to Git Forges diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 649dcb1..2697b6e 100755 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 name: GitHub Pages (Ddraig SSG) on: push: diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index f71cd3c..6b72823 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 # Prevention workflow - scans for hardcoded secrets before they reach main diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml index 88d6779..9789e65 100644 --- a/.github/workflows/workflow-linter.yml +++ b/.github/workflows/workflow-linter.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 # Prevention workflow - validates all workflows have proper security config