From 95feedb9d1c9b9d587b62bcd99fc70c8289b7e6b Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 21 Jul 2026 07:31:42 +0100 Subject: [PATCH] fix(ci): add missing SPDX headers to workflow files MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Governance reusable's "Workflow security linter" job requires every .github/workflows/*.yml to carry an SPDX-License-Identifier on line 1. These files were missing it, so the Governance workflow failed on every push — one more red workflow feeding the ci_activity notification flood. Identifier (MPL-2.0) is taken from this repo's own existing workflow headers, which agree unanimously — not assumed. Files: boj-build.yml casket-pages.yml codeql.yml dependabot-automerge.yml governance.yml hypatia-scan.yml instant-sync.yml mirror.yml pages.yml scorecard.yml secret-scanner.yml Co-Authored-By: Claude Opus 4.8 --- .github/workflows/boj-build.yml | 1 + .github/workflows/casket-pages.yml | 1 + .github/workflows/codeql.yml | 1 + .github/workflows/dependabot-automerge.yml | 1 + .github/workflows/governance.yml | 1 + .github/workflows/hypatia-scan.yml | 1 + .github/workflows/instant-sync.yml | 1 + .github/workflows/mirror.yml | 1 + .github/workflows/pages.yml | 1 + .github/workflows/scorecard.yml | 1 + .github/workflows/secret-scanner.yml | 1 + 11 files changed, 11 insertions(+) diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml index 3700530..642bb79 100644 --- a/.github/workflows/boj-build.yml +++ b/.github/workflows/boj-build.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 name: BoJ Server Build Trigger diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml index aa80b53..20204df 100644 --- a/.github/workflows/casket-pages.yml +++ b/.github/workflows/casket-pages.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 name: GitHub Pages diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 4dbe860..53957f2 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 name: CodeQL Security Analysis diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index 64623c0..d2d50fd 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 # diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index a1a8881..106963f 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 # governance.yml — single wrapper calling the shared estate governance bundle diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 3ac232f..4e4e04b 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 # hypatia-scan.yml — thin wrapper calling the shared Hypatia neurosymbolic scan diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index 13dec45..b328ae0 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 # Instant Forge Sync - Triggers propagation to all forges on push/release diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index e397cfb..08f0d46 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 name: Mirror to Git Forges diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index f95bced..513f8e1 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 name: GitHub Pages (Ddraig SSG) on: push: diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 8bf16c1..31c8740 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 # scorecard.yml — thin wrapper calling the shared OSSF Scorecard analysis in diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 48645e9..09bb92b 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,3 +1,4 @@ +# SPDX-License-Identifier: MPL-2.0 # // Copyright (c) Jonathan D.A. Jewell # SPDX-License-Identifier: MPL-2.0 name: Secret Scanner