chore(ci): SPDX headers on line 1 and Actions lockfile minted - #112
Conversation
Two estate gates, one change. **SPDX.** `governance / Workflow security linter` checks `head -1 | grep`, so a workflow carrying its identifier below a managed-by comment reports as missing one. Each file's OWN identifier is moved to line 1 — nothing is imposed, because repositories here are variously MPL-2.0, PMPL-1.0-or-later and AGPL-3.0-or-later and a default would mis-declare the minority. Licences seen here: MPL-2.0. **Lockfile.** `gh actions-lock` resolves each symbolic ref to a verified commit plus owner_id, repo_id and the transitive dependencies of composite actions — which is what OSSF Scorecard's Pinned-Dependencies check is asking for, and what an inline SHA cannot express. ⚠ Do NOT additionally SHA-pin inline. The mechanisms are mutually exclusive: `gh actions-lock` refuses a ref no tag or branch contains, so inline pinning REMOVES actions from the lockfile. Measured on hypatia 2026-08-07 — 40 inline pins caused 14 startup_failures and dropped 7 lockfile entries. Verified: all workflows parse, no duplicate identifiers, lockfile verify says "Run without --verify-local to resolve and pin missing actions.".
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
Note Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime. Code Review ✅ Approved 2 resolved / 2 findingsAdds SPDX headers to line 1 of CI workflows and mints an Actions lockfile, but replaces immutable SHA-pinned actions with mutable tag references and introduces silent major-version jumps. ✅ 2 resolved✅ Security: SHA-pinned actions replaced with mutable tag/branch refs
✅ Bug: Silent major-version jumps introduced while unpinning
OptionsDisplay: compact → Showing less information. Comment with these commands to change the behavior for this request:
Important Your trial ends in 3 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more. Was this helpful? React with 👍 / 👎 | Gitar |
`gh actions-lock` inserts `# This workflow is managed by gh actions-lock.` at line 1, which displaced the SPDX identifier moved there earlier in this branch. The linter greps `head -1` only, so the header read as missing again. Each file's OWN identifier is moved back to line 1 — nothing imposed. Files already correct are untouched, and any file carrying two identifiers aborts the change rather than guessing.
✅ All code review findings resolved.
1 participant
Two estate gates, one change.
SPDX — the linter checks
head -1only, so workflows carrying their identifier below a managed-by comment report as missing one. Each file's own identifier is moved to line 1; nothing is imposed (repos here are variously MPL-2.0, PMPL-1.0-or-later, AGPL-3.0-or-later). Licences in this repo:MPL-2.0.Lockfile (minted) —
gh actions-lockresolves each symbolic ref to a verified commit plus owner_id, repo_id and the transitive dependencies of composite actions. That is what Scorecard's Pinned-Dependencies check wants, and what an inline SHA cannot express.⚠ Do not additionally SHA-pin inline — the mechanisms are mutually exclusive, and inline pinning removes actions from the lockfile (measured on hypatia: 14
startup_failures).Verified: all workflows parse · no duplicate SPDX identifiers ·
gh actions-lock --verify-local: Run without --verify-local to resolve and pin missing actions.🤖 Generated with Claude Code