ci/licence: re-pin setup-dlang + SHA-pin trufflehog + add LICENSE SPDX header#174
Merged
Conversation
Two pre-existing CI-infra breakages, independent of any source change: - .github/workflows/d-ci.yml: dlang-community/setup-dlang was pinned to 4071ba8 (# v1.6.0), but that tag/SHA no longer exists upstream (v1.6.0 was removed; the action-resolution step failed → 'unable to find version'), breaking d-build on every PR. Re-pinned all 3 uses to v2.0.0 (0a7469b93f791d83f30932c6fd105796c6966e20). The 'compiler:' input is unchanged across v1→v2, so the jobs are unaffected. - .github/workflows/secret-scanner.yml: trufflesecurity/trufflehog was used at @main (unpinned), failing the governance 'Workflow security linter' SHA-pin gate. Pinned to d411fff7b8879a62509f3fa98c07f247ac089a51 (# v3.95.5), the SHA already vetted/used elsewhere in the estate. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SuLNP87x3i5YXdq2wYERRK
proven's root LICENSE had MPL-2.0 body text but no SPDX header, failing the governance 'Licence consistency' check (standards/scripts/check-licence- consistency.sh). Added 'SPDX-License-Identifier: MPL-2.0' (owner-authorised; same fix as standards#431). Check now passes: [OK] SPDX header: MPL-2.0 [OK] LICENSE body text matches SPDX header. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SuLNP87x3i5YXdq2wYERRK
hyperpolymath
changed the title
hyperpolymath
marked this pull request as ready for review
June 26, 2026 21:48
|
hyperpolymath
added a commit
that referenced
this pull request
Jun 26, 2026
…0 docs (#175) ## Summary Fixes the two pre-existing proven CI failures that #174 surfaced (and which were out of #174's pin-scope). ### 1. `d-build` compile — D `nothrow` violations `parseHexColor` / `parseCurrency` / `parseIsoDateTime` / `parsePhone` / `parseUrl` are marked `nothrow`, but called the `*Result.success` / `.failure` factory methods, which were **not** `nothrow` → `ldc2` errors. Those factories only construct and return a struct (no throwing operations), so marking all **10** methods `nothrow` is the correct, minimal fix (across `safe_{color,currency,datetime,phone,url}.d`). ### 2. `Enforce Trustfile Policies` — SPDX gate vs docs licence The gate required `MPL-2.0` on every file under `src/ffi/bindings`, flagging **27 README docs** that correctly carry **`CC-BY-SA-4.0`** (the estate docs licence). Changed it to accept **either** `MPL-2.0` (code) **or** `CC-BY-SA-4.0` (docs), flagging only headers that are neither — so it still catches stray PMPL/Apache/etc. ## Verification - Trustfile SPDX check simulated locally against the tree → **0 files flagged** (PASS). - `nothrow` fix is sound by construction (factory bodies do only struct construction); I couldn't run `ldc2` in this environment, so CI's `d-build` is the final confirmation. ## Note The pre-existing Hypatia `scan` / `Validate Hypatia Baseline` reds are **not** addressed here (scanner-dependent, owner-territory) and remain as on standards. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- _Generated by [Claude Code](https://claude.ai/code/session_01SuLNP87x3i5YXdq2wYERRK)_ Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes three pre-existing governance/CI failures on proven (all independent of any source change; they fail on every PR). Verified locally.
1.
Workflow security linter—trufflehog@mainunpinned → fixedsecret-scanner.yml:26pinned to@main. Pinned tod411fff7…(# v3.95.5), an estate-vetted SHA. Linter's own check now reports all actions SHA-pinned.2.
d-buildaction resolution — vanishedsetup-dlangSHA → fixedd-ci.ymlpinnedsetup-dlang@4071ba8… # v1.6.0, but that tag was removed upstream, so GitHub failed at "Prepare all required actions". Re-pinned all 3 uses tov2.0.0(0a7469b9…); the only input (compiler:) is unchanged across v1→v2.3.
Licence consistency— root LICENSE missing SPDX header → fixedcheck-licence-consistency.sherrored: rootLICENSEhad MPL-2.0 body text but noSPDX-License-Identifier:header. AddedSPDX-License-Identifier: MPL-2.0(owner-authorised; identical to standards#431). Check now passes.Still red on proven (pre-existing, out of scope here)
d-build— the Dnothrowcompile errors above (real code bug)scan / Hypatia Neurosymbolic Analysis+governance / Validate Hypatia Baseline— proven's own scanner findings / empty-baseline gate (scanner-dependent, like standards' baseline)Enforce Trustfile Policies— not yet diagnosed🤖 Generated with Claude Code