From 519891a2a1f9953cf08f71cc9034e844f70cb1ac Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Fri, 30 Oct 2026 16:00:54 +0000
Subject: [PATCH] fix(ci): SPDX check must scan past the actions-lock banner;
 repoint standards links

1. lint-workflows was red on main with exit code 18 -- a false failure.

gh actions-lock prepends its banner as line 1, pushing the SPDX tag to line 2,
while the check read only `head -1`. The step counts one error per file and ends
with `exit $errors`, so 18 workflows became exit 18. All 18 files do carry the
header. Scan the first five lines instead.

Verified in both directions: current tree 18 errors -> 0; a negative control with
no SPDX in the first five lines still fails; SPDX on line 1 still passes.

This failure predates and is independent of #106, which inherits it from main.

2. hyperpolymath/standards no longer exists at that path -- the repository moved
to the metadatastician organisation. The old URLs work only via GitHub redirect.

Every destination was checked at the new owner before rewriting, so these move to
a place that exists rather than to a fresh 404:

  docs/SIGNING-POLICY.adoc                  file  5657b
  .github/workflows/changelog-reusable.yml  file 12170b
  templates/cliff.toml                      file  3234b
  issues/206                                feat(changelog): add git-cliff config

Deliberately unchanged: the five `uses: hyperpolymath/standards/...` reusable
refs (functional CI, both pinned SHAs still resolve, managed by gh actions-lock);
and links whose targets are missing at the new owner too, so changing the owner
would not fix them (component-readiness-grades, self-validating/*, a2ml, k9-svc,
docs/audits/*). Those are dead links, not stale-owner links.
---
 .github/CONTRIBUTING.md               | 2 +-
 .github/workflows/workflow-linter.yml | 8 +++++++-
 CHANGELOG.adoc                        | 8 ++++----
 3 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md
index 02f5fd9..d0e4d49 100644
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@@ -124,7 +124,7 @@ Footer: issue reference, e.g. Closes #123
 
 Every commit that reaches the default branch must be signed; a ruleset refuses
 unsigned pushes. Estate policy:
-[SIGNING-POLICY](https://github.com/hyperpolymath/standards/blob/main/docs/SIGNING-POLICY.adoc).
+[SIGNING-POLICY](https://github.com/metadatastician/standards/blob/main/docs/SIGNING-POLICY.adoc).
 
 - **People and interactive agents** sign with an SSH key registered on GitHub
   as a *signing* key (`gpg.format=ssh`, `user.signingkey=<key>.pub`,
diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml
index 81a5ab6..931061b 100644
--- a/.github/workflows/workflow-linter.yml
+++ b/.github/workflows/workflow-linter.yml
@@ -22,7 +22,13 @@ jobs:
           errors=0
           for f in .github/workflows/*.yml .github/workflows/*.yaml; do
             [ -f "$f" ] || continue
-            if ! head -1 "$f" | grep -q "SPDX-License-Identifier"; then
+            # Scan the first five lines, not just the first. `gh actions-lock`
+            # prepends its own "# This workflow is managed by gh actions-lock."
+            # banner above the SPDX tag, so a compliant file has the identifier
+            # on line 2. Checking only line 1 flagged all 18 workflows as
+            # missing a header they in fact carry, and `exit $errors` turned
+            # that into exit code 18 -- a red check on a clean tree.
+            if ! head -5 "$f" | grep -q "SPDX-License-Identifier"; then
               echo "ERROR: $f missing SPDX header"
               errors=$((errors + 1))
             fi
diff --git a/CHANGELOG.adoc b/CHANGELOG.adoc
index 07441e4..1387236 100644
--- a/CHANGELOG.adoc
+++ b/CHANGELOG.adoc
@@ -3,10 +3,10 @@
 All notable changes to `+casket-ssg+` will be documented in this file.
 
 This file is generated from conventional commits by the
-https://github.com/hyperpolymath/standards/blob/main/.github/workflows/changelog-reusable.yml[`+changelog-reusable.yml+`]
-workflow (`+hyperpolymath/standards#206+`). Adopt the workflow in this
+https://github.com/metadatastician/standards/blob/main/.github/workflows/changelog-reusable.yml[`+changelog-reusable.yml+`]
+workflow (`+metadatastician/standards#206+`). Adopt the workflow in this
 repo’s CI to keep this file in sync automatically — see
-https://github.com/hyperpolymath/standards/blob/main/templates/cliff.toml[`+templates/cliff.toml+`]
+https://github.com/metadatastician/standards/blob/main/templates/cliff.toml[`+templates/cliff.toml+`]
 for the canonical config.
 
 The format follows https://keepachangelog.com/en/1.1.0/[Keep a
@@ -46,7 +46,7 @@ Comment-step gate) (#3)
 Prior commits to this file’s introduction are recorded in git history
 but not formally classified into Keep-a-Changelog sections. To backfill,
 run `+git cliff -o CHANGELOG.md+` locally using the canonical
-https://github.com/hyperpolymath/standards/blob/main/templates/cliff.toml[`+cliff.toml+`]
+https://github.com/metadatastician/standards/blob/main/templates/cliff.toml[`+cliff.toml+`]
 — this is one-shot mechanical work.
 
 '''''