fix(pr): exempt file-licensed packages, accept the security type, and keep the DCO check robust #4

Merged
KofTwentyTwo merged 3 commits from fix/pr-gates-dependency-license-input into main 2026-10-09 15:55:01 +00:00
3 Commits
Author SHA1 Message Date
james.maesandClaude Fable 5.1 3bd60828b5 ci: run the link check from an extracted lychee and skip template placeholders
The `docs` job downloaded lychee but ran `./lychee`, which the archive does not
contain: it unpacks into `lychee-x86_64-unknown-linux-gnu/`. The binary is now
extracted under `RUNNER_TEMP` (so its README and docs are not link-checked) and
run from there.

With the tool actually running, seven internal links failed: the ADR template's
`NNNN-title.md` placeholder and the repository templates' `LICENSE` links, which
resolve in an adopting repository rather than here (excluded in `lychee.toml`),
and the IntelliJ README's links to a `project/.idea/` directory that is not in
the repository yet (now plain text marked "not yet published").

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>
2026-10-09 10:53:36 -05:00
james.maesandClaude Fable 5.1 0ed03b9bfd docs: add a markdownlint configuration so the docs gate can pass
The `docs` job (markdownlint-cli2) failed on `main` itself with 686 findings, 666
of them MD013 line length, which K22-CODE-08 does not limit for prose. The new
`.markdownlint-cli2.yaml` turns off MD013, MD033 (the release checklist's
`<details>` block), MD036 (the exceptions register's summary lines) and MD041
(the pull-request template starts at a second-level heading). The remaining
findings are fixed in place: fenced blocks get a `text` language, the code-span
example no longer has leading/trailing spaces, the maintainer email is an
autolink, and multiple blank lines are collapsed.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>
2026-10-09 10:51:27 -05:00
james.maesandClaude Fable 5.1 1c533f5482 fix(pr): exempt file-licensed packages, accept the security type, and keep the DCO check robust
- pr.yml: an `allow-dependencies-licenses` input (package URLs) for packages whose
  nuspec names a license file, which the dependency graph reports as
  NOASSERTION; gclo's LibGit2Sharp and Windows SDK packages fail the license check
  on every version bump otherwise (EX-0003).
- pr.yml: the title check accepts the `security` type that policies/sdlc.md lists;
  sdlc.md lists `style`, which the check already accepted.
- pr.yml: the DCO check wrote an empty TSV field for commits whose author email
  has no GitHub login, and bash's tab IFS then collapsed the columns so every such
  commit failed as "no Signed-off-by". The login is written as "-" instead.
- exceptions/register.md: EX-0003 (gclo's libgit2 and Windows SDK licenses) and
  EX-0004 (gclo's in-repository release workflow until the shared one ships);
  EX-0002's current state notes that gclo now ships SHA256SUMS and attestations.
- configs/shell: CheckOperator conflicted with PSAlignAssignmentStatement on every
  aligned hashtable (the settings file itself included); alignment wins.
- MAINTAINERS.md: gclo's adoption status.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>
2026-10-09 10:42:27 -05:00