From fb50a888e5755f10cda4ee8ac55b19e76008bbc1 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 26 Jun 2026 21:30:19 +0000 Subject: [PATCH 1/2] ci: re-pin setup-dlang to a live SHA + SHA-pin trufflehog MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two pre-existing CI-infra breakages, independent of any source change: - .github/workflows/d-ci.yml: dlang-community/setup-dlang was pinned to 4071ba8 (# v1.6.0), but that tag/SHA no longer exists upstream (v1.6.0 was removed; the action-resolution step failed → 'unable to find version'), breaking d-build on every PR. Re-pinned all 3 uses to v2.0.0 (0a7469b93f791d83f30932c6fd105796c6966e20). The 'compiler:' input is unchanged across v1→v2, so the jobs are unaffected. - .github/workflows/secret-scanner.yml: trufflesecurity/trufflehog was used at @main (unpinned), failing the governance 'Workflow security linter' SHA-pin gate. Pinned to d411fff7b8879a62509f3fa98c07f247ac089a51 (# v3.95.5), the SHA already vetted/used elsewhere in the estate. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01SuLNP87x3i5YXdq2wYERRK --- .github/workflows/d-ci.yml | 6 +++--- .github/workflows/secret-scanner.yml | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/d-ci.yml b/.github/workflows/d-ci.yml index ecbb54d7..868d7ac4 100644 --- a/.github/workflows/d-ci.yml +++ b/.github/workflows/d-ci.yml @@ -92,7 +92,7 @@ jobs: | grep -E '^(proven_path_has_traversal|proven_header_has_crlf|proven_free_string|proven_version|proven_build_info)$' \ | sort -u | tee /tmp/wired-exports.txt - name: Setup D compiler (LDC) - uses: dlang-community/setup-dlang@4071ba822f6d0f622ba7359556d11f5827725916 # v1.6.0 + uses: dlang-community/setup-dlang@0a7469b93f791d83f30932c6fd105796c6966e20 # v2.0.0 with: compiler: ldc-${{ env.LDC_VERSION }} - name: D build @@ -144,7 +144,7 @@ jobs: .github/workflows/d-ci.yml sparse-checkout-cone-mode: false - name: Setup D compiler (LDC) - uses: dlang-community/setup-dlang@4071ba822f6d0f622ba7359556d11f5827725916 # v1.6.0 + uses: dlang-community/setup-dlang@0a7469b93f791d83f30932c6fd105796c6966e20 # v2.0.0 with: compiler: ldc-${{ env.LDC_VERSION }} - name: Install just @@ -182,7 +182,7 @@ jobs: .github/workflows/d-ci.yml sparse-checkout-cone-mode: false - name: Setup D compiler (LDC) - uses: dlang-community/setup-dlang@4071ba822f6d0f622ba7359556d11f5827725916 # v1.6.0 + uses: dlang-community/setup-dlang@0a7469b93f791d83f30932c6fd105796c6966e20 # v2.0.0 with: compiler: ldc-${{ env.LDC_VERSION }} - name: Install just diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 86bebee9..c2c7ce99 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -23,6 +23,6 @@ jobs: with: fetch-depth: 0 - name: TruffleHog Secret Scan - uses: trufflesecurity/trufflehog@main + uses: trufflesecurity/trufflehog@d411fff7b8879a62509f3fa98c07f247ac089a51 # v3.95.5 with: extra_args: --only-verified --fail From e32fff26c18b6c86bbb85b745a4e67fd738e1ae9 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 26 Jun 2026 21:33:16 +0000 Subject: [PATCH 2/2] chore(licence): add SPDX-License-Identifier header to root LICENSE proven's root LICENSE had MPL-2.0 body text but no SPDX header, failing the governance 'Licence consistency' check (standards/scripts/check-licence- consistency.sh). Added 'SPDX-License-Identifier: MPL-2.0' (owner-authorised; same fix as standards#431). Check now passes: [OK] SPDX header: MPL-2.0 [OK] LICENSE body text matches SPDX header. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01SuLNP87x3i5YXdq2wYERRK --- LICENSE | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/LICENSE b/LICENSE index 14e2f777..790e9d6e 100644 --- a/LICENSE +++ b/LICENSE @@ -1,3 +1,5 @@ +SPDX-License-Identifier: MPL-2.0 + Mozilla Public License Version 2.0 ================================== @@ -370,4 +372,4 @@ Exhibit B - "Incompatible With Secondary Licenses" Notice --------------------------------------------------------- This Source Code Form is "Incompatible With Secondary Licenses", as - defined by the Mozilla Public License, v. 2.0. + defined by the Mozilla Public License, v. 2.0. \ No newline at end of file