You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
ci(workflow-linter): look for SPDX in the leading comment block - #141
lint-workflows fails on main with ERROR: .github/workflows/<file>.yml missing SPDX header for all 20 workflows (exit code 20). The SPDX check reads only line 1. Dependabot's actions-lock bumps (from #136 on) prepend # This workflow is managed by gh actions-lock. above the existing header, so every SPDX line is now on line 2 or later. Moving it back to the top would only last until the next bump.
Change
workflow-linter.yml: the "Check SPDX headers" step now accepts an SPDX-License-Identifier anywhere in the leading block of comment and blank lines, before the first YAML line. A file whose only SPDX line comes after YAML, or that has none, still fails.
Testing
I ran the step scripts locally against this branch:
SPDX check: exit 0 (was 20).
Permissions check: exit 0.
Negative test: a file with no SPDX header and a file with SPDX after name: both fail; a file with SPDX after a blank line and another comment passes.
The "Check SPDX headers" step only read line 1 of each workflow. Dependabot's
actions-lock bumps now prepend "# This workflow is managed by gh
actions-lock." above the existing header, so every workflow's SPDX line sits
on line 2 or later and lint-workflows fails on main ("missing SPDX header",
one error per file). Moving the SPDX line back to the top would last only
until the next Dependabot bump.
The check now accepts an SPDX-License-Identifier anywhere in the leading
block of comment and blank lines, before the first YAML line. A file whose
only SPDX line comes after YAML content, or that has none, still fails.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0132Cdz3iwk2QGKv2sUhhsye
No actionable merge-blocking risk was identified in the workflow linter change.
Pre-merge checks: 4
Check name
Status
Explanation
Title check
The title names the change: the workflow linter's SPDX check now scans the leading comment block. It matches the single file change in the summary and the stated objective. It uses the conventional co…
Description check
The description is directly related to the changeset. It explains the failure (SPDX check reads only line 1, and Dependabot's actions-lock bumps push the header lower), describes the new behaviour in …
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Full details: Title check
Explanation
The title names the change: the workflow linter's SPDX check now scans the leading comment block. It matches the single file change in the summary and the stated objective. It uses the conventional commit prefix 'ci(workflow-linter)', which is acceptable. The title is 63 characters, within a normal length.
Full details: Description check
Explanation
The description is directly related to the changeset. It explains the failure (SPDX check reads only line 1, and Dependabot's actions-lock bumps push the header lower), describes the new behaviour in workflow-linter.yml, and reports local test results for the SPDX and permissions checks plus negative cases. It is specific enough to pass.
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 64f2a4c0-b8ed-4b7c-9c45-66d5434d79ce
Commits
Reviewing files that changed from the base of the PR and between a328a17 and 4493412.
Files selected for processing: 1
.github/workflows/workflow-linter.yml
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
What was wrong
lint-workflowsfails onmainwithERROR: .github/workflows/<file>.yml missing SPDX headerfor all 20 workflows (exit code 20). The SPDX check reads only line 1. Dependabot's actions-lock bumps (from #136 on) prepend# This workflow is managed by gh actions-lock.above the existing header, so every SPDX line is now on line 2 or later. Moving it back to the top would only last until the next bump.Change
workflow-linter.yml: the "Check SPDX headers" step now accepts anSPDX-License-Identifieranywhere in the leading block of comment and blank lines, before the first YAML line. A file whose only SPDX line comes after YAML, or that has none, still fails.Testing
I ran the step scripts locally against this branch:
name:both fail; a file with SPDX after a blank line and another comment passes.Generated by Claude Code