Read OSS version IDs from list headers

.github/workflows/mirror-oss.yml

@@ -225,9 +225,15 @@ jobs:
               if isinstance(node, dict):
                   for key, child in node.items():
                       normalized = re.sub(r"[^a-z0-9]", "", key.casefold())
-                      if normalized in {"versionid", "xossversionid"} and isinstance(child, str):
-                          if child and child.casefold() != "null":
-                              yield child
+                      if normalized in {"versionid", "xossversionid"}:
+                          candidates = child if isinstance(child, list) else [child]
+                          for candidate in candidates:
+                              if (
+                                  isinstance(candidate, str)
+                                  and candidate
+                                  and candidate.casefold() != "null"
+                              ):
+                                  yield candidate
                       yield from version_ids(child)
               elif isinstance(node, list):
                   for child in node:

tests/test_workflow_contract.py

@@ -76,6 +76,7 @@ def test_oss_workflow_has_no_moving_alias_and_uses_reviewed_shared_bucket() -> N
     assert "load_ossutil_json" in workflow
     assert workflow.count("JSONDecoder().raw_decode") == 2
     assert workflow.count("unexpected output after ossutil JSON document") == 2
+    assert "candidates = child if isinstance(child, list) else [child]" in workflow
 
 
 def test_all_external_actions_are_pinned_to_full_commit_sha() -> None: