Repository navigation
fix(ci): SPDX check must scan past the actions-lock banner; repoint standards links - #107
Conversation
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 22 minutes. View limit details
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
SPDX header scan .github/workflows/workflow-linter.yml |
The check searches the first five lines of each workflow file for an SPDX identifier. It retains the existing reporting and exit-code handling. |
Standards links
| Layer / File(s) | Summary |
|---|---|
Update standards links .github/CONTRIBUTING.md, CHANGELOG.adoc |
The signing policy, workflow, template, and cliff.toml links now point to metadatastician/standards. |
Priority:
Estimated code review effort: 2 (Simple) | ~5 minutes
Change: Bug fix
Merge Risk: 
64023
-
No actionable merge-blocking risk remains in the reviewed changes.
Pre-merge checks: 
-
Check name Status Explanation Title check The title clearly identifies both main changes: updating the SPDX check to scan beyond the actions-lock banner and repointing standards links. Description check The description directly explains the SPDX check fix, the standards-link updates, verification results, and deliberate exclusions. Docstring Coverage No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Docstring Coverage
-
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: dc91595110
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # on line 2. Checking only line 1 flagged all 18 workflows as | ||
| # missing a header they in fact carry, and `exit $errors` turned | ||
| # that into exit code 18 -- a red check on a clean tree. | ||
| if ! head -5 "$f" | grep -q "SPDX-License-Identifier"; then |
There was a problem hiding this comment.
When a workflow lacks a header but contains the substring within its first five lines—for example, name: SPDX-License-Identifier Audit or # SPDX-License-Identifier intentionally omitted—this widened check now accepts it as compliant. Anchor the match to the repository's header syntax (such as ^# SPDX-License-Identifier:) so scanning past the actions-lock banner does not let ordinary YAML or explanatory prose bypass the license gate.
Useful? React with 👍 / 👎.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
hyperpolymath
changed the title
Pull request was closed
6402300 to
3dcade8
Compare
…tandards links 1. lint-workflows was red on main with exit code 18 -- a false failure. gh actions-lock prepends its banner as line 1, pushing the SPDX tag to line 2, while the check read only `head -1`. The step counts one error per file and ends with `exit $errors`, so 18 workflows became exit 18. All 18 files do carry the header. Scan the first five lines instead. Verified in both directions: current tree 18 errors -> 0; a negative control with no SPDX in the first five lines still fails; SPDX on line 1 still passes. This failure predates and is independent of #106, which inherits it from main. 2. hyperpolymath/standards no longer exists at that path -- the repository moved to the metadatastician organisation. The old URLs work only via GitHub redirect. Every destination was checked at the new owner before rewriting, so these move to a place that exists rather than to a fresh 404: docs/SIGNING-POLICY.adoc file 5657b .github/workflows/changelog-reusable.yml file 12170b templates/cliff.toml file 3234b issues/206 feat(changelog): add git-cliff config Deliberately unchanged: the five `uses: hyperpolymath/standards/...` reusable refs (functional CI, both pinned SHAs still resolve, managed by gh actions-lock); and links whose targets are missing at the new owner too, so changing the owner would not fix them (component-readiness-grades, self-validating/*, a2ml, k9-svc, docs/audits/*). Those are dead links, not stale-owner links.
7705953 to
519891a
Compare
Two independent fixes, both verified.
1.
lint-workflowswas red onmainwithexit code 18— a false failuregh actions-lockprepends its banner as line 1, pushing the SPDX tag to line 2:The SPDX step read only
head -1, counted one error per file, and ended withexit $errors— so 18 workflows becameexit 18, matching the CI annotation exactly:All 18 files do carry the header. A red check on a compliant tree, caused by
two estate tools disagreeing about line 1. Fixed by scanning the first five lines.
Verified in both directions:
errors=1lint-workflowsSUCCESSThis failure predates and is independent of #106; the Dependabot branch inherits
it from
main. This PR unblocks #106.2.
hyperpolymath/standardslinks pointed at a path that no longer existsThe repository moved to the
metadatasticianorganisation:The old URLs work only because GitHub redirects them. Every destination was
checked at the new owner before rewriting, so these move to a place that
exists rather than to a fresh 404:
docs/SIGNING-POLICY.adoc.github/workflows/changelog-reusable.ymltemplates/cliff.tomlissues/206Deliberately not changed
The five
uses: hyperpolymath/standards/...reusable-workflow refs. They arefunctional CI, both pinned SHAs (
da2c748a,84355587) verified still reachable,and they are managed by
gh actions-lock. Re-pointing them is a CI change thatbelongs in its own review, not folded into a docs fix.
Links whose targets are missing at the new owner too, so changing the owner
would not fix them:
component-readiness-grades—Justfile:208,.machine_readable/contractiles/Justfile:208self-validating/—.machine_readable/self-validating/README.adoca2ml,k9-svc—PHASE2-ROADMAP.adocdocs/audits/*—docs/tech-debt-2026-05-26.adocThese are dead links, not stale-owner links. They need a decision about where
that content went. Flagging rather than silently "fixing" them.
Cosmetic, for whoever owns
gh actions-lockIt writes its banner twice — lines 1 and 3, with the SPDX tag between them.
That duplication is what put the identifier on line 2 and broke the linter.