This came to me when reviewing patches on the OE-Core list and a patch with this issue, but perhaps patchtest could be improved to report when an SPDX identifier is missing in a newly added file. It should be feasible by grepping for "SPDX-License-Identifier:" in the file?