fix(governance): close the baseline/alert split and stop the SPDX check fighting the lockfile

[hyperpolymath]

Three structural corrections — each removes a class of estate failure rather than another instance.

1. The baseline never reached the security tab

scan ──┬─> findings.json ─> apply-baseline.sh ─> the GATE (filtered)
└─> hypatia.sarif ────────────────────> code scanning (NOT filtered)

The code_scanning ruleset rule blocks on those alerts and knows nothing of the baseline, so acknowledging a finding silenced the gate while the same finding still blocked the merge — every required check green, nothing to point at.

Measured 2026-08-07: 147 open PRs across 91 repos, held by 1,777 alerts, zero introduced by the PR they blocked.

scripts/filter-sarif-by-baseline.sh filters the SARIF before upload. It contains no matcher of its own — it runs the caller's apply-baseline.sh (the same copy the gate runs) and uses its findings_suppressed list, so there is exactly one matcher by construction. It fails open in every error path; 4 of its 9 tests assert that.

2. The SPDX check fought gh actions-lock

The check was head -1 | grep, but gh actions-lock inserts its managed-by comment at line 1 on every mint — so the check re-failed on files whose licence sat on line 2. It reported 40 workflows estate-wide as missing a header they had, and prepending a default mis-licensed 3 files (PMPL shadowed by MPL) before it was caught.

Now reads the leading comment block, where REUSE puts the identifier. Validated against 984 real workflow files: 983 accepted, the single rejection genuinely has no declaration.

3. The pin check named the wrong thing

ERROR: Found unpinned actions: comes only from the no-lockfile branch but reads generically — indistinguishable from the stale-lockfile branch or an SPDX failure in the same job. It now says which tree lacked a lockfile and states the mutual exclusion, because inline-pinning to "fix" it removes actions from the lockfile (hypatia: 14 startup_failures from one commit).

Tests: 9 + 9, both in scripts/tests/ so self-test.yml discovers them as of #588.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
23 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[gitar-bot]

💡 Edge Case: SPDX header scan stops at a blank line in the block

The awk matcher /^#/ { print; next } { exit } exits on the first non-comment line, so a blank line anywhere in the leading comment block (e.g. # managed by gh actions-lock., blank line, then # SPDX-License-Identifier:) causes the identifier below it to be missed and the file to be reported as missing a header it has — the same false-positive class this PR set out to remove. Consider skipping blank lines within the leading block (e.g. add a /^[[:space:]]*$/ { next } rule) if such layouts occur in the estate.

Tolerate blank lines interspersed in the leading comment block.:

awk '/^---[[:space:]]*$/ { next } /^[[:space:]]*$/ { next } /^#/ { print; next } { exit }' "$file" \
| grep -q "^# SPDX-License-Identifier:"

• Apply fix

_{Check the box to apply the fix or reply for a change | Was this helpful? React with 👍 / 👎}

[gitar-bot]

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

Code Review👍 Approved with suggestions0 resolved / 1 findings

Aligns the SARIF upload with the baseline to resolve merge blockers, fixes SPDX header detection for comment blocks, and improves pin-check error messages. Consider updating the awk matcher in the SPDX scan to handle internal blank lines without exiting prematurely.

Auto-approved and auto-merge armed: No blocking issues found.
Please see Auto-approve Docs for details on setting custom approval criteria. — merges when pipeline and required approvals pass.

💡 Edge Case: SPDX header scan stops at a blank line in the block

📄 .github/workflows/governance-reusable.yml:1063-1064📄 scripts/tests/spdx-header-block-test.sh:19-22

The awk matcher /^#/ { print; next } { exit } exits on the first non-comment line, so a blank line anywhere in the leading comment block (e.g. # managed by gh actions-lock., blank line, then # SPDX-License-Identifier:) causes the identifier below it to be missed and the file to be reported as missing a header it has — the same false-positive class this PR set out to remove. Consider skipping blank lines within the leading block (e.g. add a /^[[:space:]]*$/ { next } rule) if such layouts occur in the estate.

Tolerate blank lines interspersed in the leading comment block.

awk '/^---[[:space:]]*$/ { next } /^[[:space:]]*$/ { next } /^#/ { print; next } { exit }' "$file" \
| grep -q "^# SPDX-License-Identifier:"

🤖 Prompt for agents

Code Review: Aligns the SARIF upload with the baseline to resolve merge blockers, fixes SPDX header detection for comment blocks, and improves pin-check error messages. Consider updating the awk matcher in the SPDX scan to handle internal blank lines without exiting prematurely.
1. 💡 Edge Case: SPDX header scan stops at a blank line in the block
Files: .github/workflows/governance-reusable.yml:1063-1064, scripts/tests/spdx-header-block-test.sh:19-22
The awk matcher `/^#/ { print; next } { exit }` exits on the first non-comment line, so a blank line anywhere in the leading comment block (e.g. `# managed by gh actions-lock.`, blank line, then `# SPDX-License-Identifier:`) causes the identifier below it to be missed and the file to be reported as missing a header it has — the same false-positive class this PR set out to remove. Consider skipping blank lines within the leading block (e.g. add a `/^[[:space:]]*$/ { next }` rule) if such layouts occur in the estate.
Fix (Tolerate blank lines interspersed in the leading comment block.):
awk '/^---[[:space:]]*$/ { next } /^[[:space:]]*$/ { next } /^#/ { print; next } { exit }' "$file" \
| grep -q "^# SPDX-License-Identifier:"

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

---

Important

Your trial ends in 3 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more.

_{Was this helpful? React with 👍 / 👎 | Gitar}

[gitar-bot]

⚠️This PR is blocked due to unresolved code review findings.

_{Configure merge blocking · Maintainers can dismiss this review.}