rule: detect workflow-linter.yml self-referential uses: grep

[hyperpolymath]

Context

ipv6-only#9 (and other repos still carrying the legacy in-tree workflow-linter.yml) fails its own linter because the linter naively greps for uses: across all workflow files, and workflow-linter.yml itself contains regex comments + the grep command line that match.

Example failure (ipv6-only#9 run 26444048244):

ERROR: Found unpinned actions:
.github/workflows/workflow-linter.yml:64:          # Find any uses: lines that don't have @SHA format
.github/workflows/workflow-linter.yml:65:          # Pattern: uses: owner/repo@<40-char-hex>
.github/workflows/workflow-linter.yml:66:          unpinned=$(grep -rn "uses:" .github/workflows/ | \
.github/workflows/scorecard-enforcer.yml:68:          unpinned=$(grep -r "uses:.*@v[0-9]" .github/workflows/*.yml 2>/dev/null | grep -v "#" | head -5 || true)

Today's sweep found 4 repos in this state (ipv6-only#9, ipv6-only#10, file-soup#44, fireflag#30) — none fixable in-tree; needs linter patch.

Rule

Add to lib/rules/workflow_audit.ex:

def check_workflow_linter_self_reference(workflow_contents, _opts \\ []) do
  linter_file = workflow_contents["workflow-linter.yml"]

  if linter_file && Regex.match?(~r/grep .* "uses:"/, linter_file) and
       not Regex.match?(~r/workflow-linter\.yml|scorecard-enforcer\.yml/, linter_file) do
    {:fail, %{
      rule: :workflow_linter_self_reference,
      severity: :medium,
      path: ".github/workflows/workflow-linter.yml",
      message: "Linter greps 'uses:' across all workflows including itself; will false-positive",
      fix: "Add `grep -v -E 'workflow-linter\\.yml|scorecard-enforcer\\.yml'` or scope grep to `^[[:space:]]*uses:`"
    }}
  else
    :ok
  end
end

Action

Per-repo workflow-linter.yml copies should be retired in favour of standards/governance-reusable.yml; this rule catches the recurrent fork pattern.

Filed from session sweeping otpiser#11 + estate-wide drift.