diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
index ed3c9d9584d..8d4ddf94513 100644
--- a/.github/workflows/scorecards.yml
+++ b/.github/workflows/scorecards.yml
@@ -1,3 +1,6 @@
+---
+# vi: ts=2 sw=2 et:
+# SPDX-License-Identifier: LGPL-2.1-or-later
 name: Scorecards supply-chain security
 on:
   # Only the default branch is supported.