From 4a3b910742bc2e2a895a509eca253abe5a755ef7 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 7 Aug 2026 11:30:25 +0100 Subject: [PATCH] fix(ci): restore each workflow's own licence to line 1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit #689 added `# SPDX-License-Identifier: MPL-2.0` to 27 workflows on the premise that they had no SPDX header. They all had one — just not on line 1, which is the only place the linter looks (`head -1 | grep`). So the linter was right that line 1 was wrong, and I was wrong about why. 24 files already declared MPL-2.0, where the added line was merely duplicated. Three declared **PMPL-1.0-or-later**, and there the added line shadowed the file's actual licence as the first declaration: .github/workflows/governance.yml .github/workflows/hypatia-scan.yml .github/workflows/scorecard.yml Each file's own identifier is now moved to line 1 and the duplicate removed, so no licence is restated and none is changed. A licence sweep must always read what is there before writing — the estate has already lost two AGPL declarations to a sweep that did not. Verified: 0 files with duplicate SPDX lines, 0 missing it on line 1, the 3 PMPL files keep PMPL, all 27 parse, and `gh actions-lock --verify-local` still reports complete lockfile coverage. --- .github/workflows/bridge-gate.yml | 1 - .github/workflows/build-gossamer-gui.yml | 1 - .github/workflows/ci-health-sweep.yml | 1 - .github/workflows/ci.yml | 1 - .github/workflows/clusterfuzzlite.yml | 1 - .github/workflows/codeql.yml | 1 - .github/workflows/dependabot-automerge.yml | 1 - .github/workflows/dogfood-gate.yml | 1 - .github/workflows/estate-rescan.yml | 1 - .github/workflows/governance.yml | 3 +-- .github/workflows/hypatia-remediation-sweep.yml | 1 - .github/workflows/hypatia-scan.yml | 3 +-- .github/workflows/inbox-steward-intake.yml | 1 - .github/workflows/language-blockers.yml | 1 - .github/workflows/merge-orchestrate.yml | 1 - .github/workflows/mirror.yml | 1 - .github/workflows/pages.yml | 1 - .github/workflows/push-email-notify.yml | 1 - .github/workflows/quality.yml | 1 - .github/workflows/release.yml | 1 - .github/workflows/roadmap-sync.yml | 1 - .github/workflows/rust.yml | 1 - .github/workflows/scorecard.yml | 3 +-- .github/workflows/secret-scanner.yml | 1 - .github/workflows/security-policy.yml | 1 - .github/workflows/tests.yml | 1 - .github/workflows/verify-proofs.yml | 1 - 27 files changed, 3 insertions(+), 30 deletions(-) diff --git a/.github/workflows/bridge-gate.yml b/.github/workflows/bridge-gate.yml index f6401e1e..3d67240b 100644 --- a/.github/workflows/bridge-gate.yml +++ b/.github/workflows/bridge-gate.yml @@ -1,6 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell # diff --git a/.github/workflows/build-gossamer-gui.yml b/.github/workflows/build-gossamer-gui.yml index b3ba028b..a0a39cf9 100644 --- a/.github/workflows/build-gossamer-gui.yml +++ b/.github/workflows/build-gossamer-gui.yml @@ -1,6 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Build the Hypatia GUI wasm artifact from the Ephapax/Gossamer sources. # diff --git a/.github/workflows/ci-health-sweep.yml b/.github/workflows/ci-health-sweep.yml index ef77f12b..0e5b2e95 100644 --- a/.github/workflows/ci-health-sweep.yml +++ b/.github/workflows/ci-health-sweep.yml @@ -1,6 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Owner: Jonathan D.A. Jewell # CI-Health Sweep — estate-wide detection + auto-remediation of the diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 61f4d118..e763dcff 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,6 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Main CI workflow for hypatia # Tests Rust (adapters, cli, fixer, data), Haskell (registry), and Logtalk (engine) diff --git a/.github/workflows/clusterfuzzlite.yml b/.github/workflows/clusterfuzzlite.yml index d0ddb28d..cddb050f 100644 --- a/.github/workflows/clusterfuzzlite.yml +++ b/.github/workflows/clusterfuzzlite.yml @@ -1,6 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Consolidated workflow (behaviour-preserving merge). # Merged from: cflite_batch.yml, cflite_pr.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 482a8808..f4846623 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,6 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: CodeQL Security Analysis diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index 69a64606..4069b16e 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -1,6 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # # dependabot-automerge.yml — enable GitHub's native auto-merge on diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index 7116c28d..71992f09 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -1,6 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # diff --git a/.github/workflows/estate-rescan.yml b/.github/workflows/estate-rescan.yml index 29222fa0..683eeec6 100644 --- a/.github/workflows/estate-rescan.yml +++ b/.github/workflows/estate-rescan.yml @@ -1,6 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Hypatia Estate Rescan — refresh verisimdb-data/scans with current truth # diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 347bc416..f8287c85 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -1,7 +1,6 @@ -# SPDX-License-Identifier: MPL-2.0 -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: PMPL-1.0-or-later # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: Governance on: diff --git a/.github/workflows/hypatia-remediation-sweep.yml b/.github/workflows/hypatia-remediation-sweep.yml index 863ccb66..c630dcea 100644 --- a/.github/workflows/hypatia-remediation-sweep.yml +++ b/.github/workflows/hypatia-remediation-sweep.yml @@ -1,6 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Hypatia Remediation Sweep — fleet-wide proactive scan # diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 928f57ec..712a0eb8 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -1,7 +1,6 @@ -# SPDX-License-Identifier: MPL-2.0 -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: PMPL-1.0-or-later # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: Hypatia Security Scan on: diff --git a/.github/workflows/inbox-steward-intake.yml b/.github/workflows/inbox-steward-intake.yml index 0a411119..4795d361 100644 --- a/.github/workflows/inbox-steward-intake.yml +++ b/.github/workflows/inbox-steward-intake.yml @@ -1,6 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Inbox Steward Intake — Process reports from gitbot-fleet inbox-steward # diff --git a/.github/workflows/language-blockers.yml b/.github/workflows/language-blockers.yml index 26a36d29..161af348 100644 --- a/.github/workflows/language-blockers.yml +++ b/.github/workflows/language-blockers.yml @@ -1,6 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Consolidated workflow (behaviour-preserving merge). # Merged from: npm-bun-blocker.yml, ts-blocker.yml diff --git a/.github/workflows/merge-orchestrate.yml b/.github/workflows/merge-orchestrate.yml index 4ac86dbc..cc5b1586 100644 --- a/.github/workflows/merge-orchestrate.yml +++ b/.github/workflows/merge-orchestrate.yml @@ -1,6 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Copyright (c) 2026 Jonathan D.A. Jewell # diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 9a9f60b1..a4020d7d 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -1,6 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: Mirror to Git Forges diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 067aba7b..f80f5cbf 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -1,6 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: GitHub Pages (Ddraig SSG) on: diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index 39e588bd..c3557f68 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -1,6 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Dormant push-email notification. ARMED by setting the repo variable # PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled; diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml index eb35d19a..093aefcb 100644 --- a/.github/workflows/quality.yml +++ b/.github/workflows/quality.yml @@ -1,6 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Consolidated workflow (behaviour-preserving merge). # Merged from: docs.yml, quality.yml diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 8d4c497f..ebf04a81 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,6 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Consolidated workflow (behaviour-preserving merge). # Merged from: container.yml, release.yml diff --git a/.github/workflows/roadmap-sync.yml b/.github/workflows/roadmap-sync.yml index 30593239..d14b7d5c 100644 --- a/.github/workflows/roadmap-sync.yml +++ b/.github/workflows/roadmap-sync.yml @@ -1,6 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Centralized roadmap sweeper: adds recently-touched issues & PRs from every # owned repo (except son-shared) into the Hyperpolymath Master Roadmap (#35). diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml index 54adcb18..7d3b2aab 100644 --- a/.github/workflows/rust.yml +++ b/.github/workflows/rust.yml @@ -1,6 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Consolidated workflow (behaviour-preserving merge). # Merged from: rust-ci.yml, rust.yml diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index fc96909e..55491e95 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -1,7 +1,6 @@ -# SPDX-License-Identifier: MPL-2.0 -# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: PMPL-1.0-or-later # This workflow is managed by gh actions-lock. +# This workflow is managed by gh actions-lock. name: OSSF Scorecard on: diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index da8963f3..d2053ce6 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,6 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. name: Secret Scanner diff --git a/.github/workflows/security-policy.yml b/.github/workflows/security-policy.yml index 2d670479..3d50375b 100644 --- a/.github/workflows/security-policy.yml +++ b/.github/workflows/security-policy.yml @@ -1,6 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Consolidated workflow (behaviour-preserving merge). # Merged from: security-audit.yml, security.yml diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index b4085191..37641a33 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -1,6 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Consolidated workflow (behaviour-preserving merge). # Merged from: bench.yml, e2e.yml, integration.yml, stress-test.yml diff --git a/.github/workflows/verify-proofs.yml b/.github/workflows/verify-proofs.yml index 6d6df52b..bfa58f35 100644 --- a/.github/workflows/verify-proofs.yml +++ b/.github/workflows/verify-proofs.yml @@ -1,6 +1,5 @@ # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. -# SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # Consolidated workflow (behaviour-preserving merge). # Merged from: verify-idris.yml, verify-lean.yml, verify-tlaplus.yml