fix(workflows): resync actions.lock, repair validate-spdx staged mode, refresh registry

[hyperpolymath]

Three commits, each one file, each independently reviewable.

1. fix(hooks) — validate-spdx staged mode gets the filter its scan mode has

validate-spdx.sh scan mode filters by extension; staged mode did not. So no
commit touching .github/workflows/actions.lock could pass pre-commit — the lockfile
is not a source file and carries no SPDX header by design. Instance 15 of the estate's
recurring trap: a guard asking a different question than its consumer.

Ships scripts/tests/validate-spdx-test.sh covering both modes, including the lockfile
case that motivated it.

2. fix(workflows) — resync actions.lock after the codeql-action bump

Dependabot bumped codeql-action in the workflow files; the lockfile was not resynced, so
it named a ref the workflows no longer used.

Six lines, hand-edited: cdf488f5… → b96794f0… (the three codeql-action refs in
the workflows: stanzas, plus the dependencies: block key, ref: and commit:).
owner_id / repo_id unchanged. ref: stays a bare SHA per the lock regime.

Why by hand. gh actions-lock fix mode was measured to rewrite 16 .yml
files (42 with --no-narrow), de-pinning correct SHAs back to mutable tags and
inventing invalid local action refs — straight into sha_pinning_required and startup
death. Only --no-fix --json is safe to read.

Verification: stale findings 3 → 0 (re-measured on this branch); gate rc 1 → 0;
git diff origin/main..HEAD -- '.github/workflows/*.yml' is empty — zero .yml bytes
touched.

(The 75 sha-as-ref findings the tool also reports are pre-existing and doctrinal: the
tool prefers a tag, the estate ruleset mandates a SHA. Not addressed here.)

3. chore(registry) — refresh three stale source_hash lines

Not cosmetic: build-registry.sh --check fails at main's HEAD, so
registry-verify.yml is red before this branch touches anything. Regenerated with the
generator, not hand-edited; the diff is exactly three source_hash lines.

The file's shape is unchanged (owner ruling R-H4). Reshaping the registry away from
its superseded TOML-shaped record dialect is a separate, deliberate job against
build-registry.sh.

Verification: build-registry.sh --check rc 1 → 0.

---

⚠ Depends on #798. This branch was previously uncommittable: standards could accept
no commit through its own pre-commit hook. #798 removes the two dead-format gates that
deadlocked it. These three commits are signed and passed the repaired hook; merge #798
first so the fix is reproducible for anyone else on this branch.

🤖 Generated with Claude Code

https://claude.ai/code/session_0168Bgpez8mFBcAqYAj8VgEx

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 6ed870e1-e315-4ce5-9f3c-f57fbbf08332

📥 Commits

Reviewing files that changed from the base of the PR and between 1f91287 and b178294.

⛔ Files ignored due to path filters (1)

• .github/workflows/actions.lock is excluded by !**/*.lock

📒 Files selected for processing (2)

• .githooks/validate-spdx.sh
• scripts/tests/validate-spdx-test.sh

---

📝 Summary

Summary by CodeRabbit

• Chores

  • SPDX validation now consistently applies the same file rules to staged changes and full repository scans.
  • JSON source files are now required to include an SPDX licence header.

• Tests

  • Added automated coverage for SPDX validation, including valid and invalid headers, non-source files, staged checks, and full-scan consistency.

Walkthrough

The SPDX hook now treats JSON files as source files and uses the same allowlist for staged and full scans. A new shell test script verifies lockfile handling, source-file failures, valid headers, non-source files, and scan-mode parity.

Changes

SPDX validation

Layer / File(s)	Summary
Validator allowlist and scan flow .githooks/validate-spdx.sh	is_source_file now includes *.json and acts as the single extension authority. Full scans now pass all regular files to this function.
Validator mode coverage scripts/tests/validate-spdx-test.sh	The new tests check staged mode, full-scan parity, header requirements, lockfiles, and non-source files.

Estimated code review effort: 2 (Simple) | ~15 minutes

Change: Bug fix · Severity of issue fixed: Low

Suggested reviewers: joshuajewell

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{I hop through files where headers gleam
JSON joins the checking stream
Lockfiles rest without a sign
Shell and YAML must align
Staged and scanned now share one way}

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
7 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud