From 05a39aed912ddb2ed0b06947a5ebcb2f12ca2583 Mon Sep 17 00:00:00 2001 From: Bill Traynor Date: Mon, 5 Oct 2026 13:24:54 -0400 Subject: [PATCH 1/2] Sign off the sync commit so the DCO check can pass RISC-V spec repositories run the DCO check, which requires every commit to carry a Signed-off-by matching its author. peter-evans/create-pull-request authors the sync commit as the user who triggered the workflow and adds no trailer, so every sync PR lands with DCO failing and cannot merge until someone amends the commit by hand. Add the trailer to commit-message, naming the same user the action authors as. This mirrors what milestone-pr in version-bot.yml already does for exactly this reason. Note that the action's own `signoff: true` input does not solve it: that adds a Signed-off-by for the *committer*, which defaults to github-actions[bot], while the author remains the triggering user -- so the trailer would not match the author and DCO would still fail. Observed on riscv/riscv-high-assurance-cryptography#184, the first sync PR this template has ever opened. Co-Authored-By: Claude Opus 5 Signed-off-by: Bill Traynor --- .github/workflows/template-sync.yml | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/.github/workflows/template-sync.yml b/.github/workflows/template-sync.yml index d1d804d..565e3fa 100644 --- a/.github/workflows/template-sync.yml +++ b/.github/workflows/template-sync.yml @@ -217,7 +217,18 @@ jobs: uses: peter-evans/create-pull-request@v8 with: token: ${{ secrets.GHTOKEN || secrets.GITHUB_TOKEN }} - commit-message: 'chore: sync template-owned files from docs-spec-template@${{ steps.refs.outputs.short_target }}' + # Same reason as milestone-pr in version-bot.yml: the DCO check that + # RISC-V spec repos run requires a Signed-off-by matching the + # commit's author. create-pull-request authors the commit as the user + # who triggered this workflow and adds no trailer of its own, so the + # sync PR is blocked until someone amends it. Sign off as that same + # user. (The action's own `signoff: true` is no use here -- it signs + # as the *committer*, which defaults to github-actions[bot] and so + # would not match the author.) + commit-message: | + chore: sync template-owned files from docs-spec-template@${{ steps.refs.outputs.short_target }} + + Signed-off-by: ${{ github.actor }} <${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com> branch: gitbot/template-sync-${{ steps.refs.outputs.short_target }} delete-branch: true title: 'Template sync: pick up docs-spec-template changes (${{ steps.refs.outputs.short_target }})' From 83caf2b75d9fd6ab32645daa627438cb500a9ffc Mon Sep 17 00:00:00 2001 From: Bill Traynor Date: Mon, 5 Oct 2026 13:25:01 -0400 Subject: [PATCH 2/2] Declare read-only permissions in vale-linting.yml The workflow declares no `permissions`, so it inherits the repository default and CodeQL raises "Workflow does not contain permissions" in every repository that adopts the file. It was flagged that way on riscv/riscv-high-assurance-cryptography#184 and fixed there by hand -- but vale-linting.yml is template-owned, so the next sync would have overwritten the fix and the finding would have returned. The reusable workflow only reads the tree in order to lint it, so `contents: read` is all it needs. Co-Authored-By: Claude Opus 5 Signed-off-by: Bill Traynor --- .github/workflows/vale-linting.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/vale-linting.yml b/.github/workflows/vale-linting.yml index 08cd975..e62f283 100644 --- a/.github/workflows/vale-linting.yml +++ b/.github/workflows/vale-linting.yml @@ -6,6 +6,12 @@ on: pull_request: branches: [main] +# The reusable workflow only reads the tree to lint it. Declaring this +# explicitly also clears the CodeQL "Workflow does not contain permissions" +# finding, which otherwise fires in every repository that adopts this file. +permissions: + contents: read + jobs: call-reusable-vale-workflow-in-riscv-vale-repo: uses: riscv-admin/riscv-vale/.github/workflows/vale-reusable.yml@main