SRE-3706: Add yamllint and copyright checks

.github/dependabot.yml

@@ -0,0 +1,9 @@
+# Copyright 2026 Hewlett Packard Enterprise Development LP
+---
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

.github/workflows/bootstrap-checks.yml

@@ -1,15 +1,16 @@
 # Copyright 2026 Hewlett Packard Enterprise Development LP
+---
 name: bootstrap-validation
 
-on:
+'on':
   pull_request:
 
 jobs:
   validate-bootstrap:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install Linux setup prerequisites
         run: |
@@ -40,7 +41,7 @@ jobs:
     runs-on: windows-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Validate Windows bootstrap prerequisites
         shell: pwsh

.github/workflows/checks.yml

@@ -1,7 +1,8 @@
 # Copyright 2026 Hewlett Packard Enterprise Development LP
+---
 name: checks
 
-on:
+'on':
   pull_request:
 
 jobs:
@@ -10,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
 
@@ -22,6 +23,9 @@ jobs:
       - name: Block tracked code-checking-ref
         run: ./checks/guard-code-checking-ref.sh --target-root .
 
+      - name: Block active Jenkins @Library reference
+        run: ./checks/guard-jenkins-library-pin.sh --target-root .
+
       - name: Run linters on changed files
         env:
           GITHUB_BASE_REF: ${{ github.base_ref }}

.github/workflows/setup-dev-smoke.yml

@@ -1,7 +1,8 @@
 # Copyright 2026 Hewlett Packard Enterprise Development LP
+---
 name: setup-dev smoke test
 
-on:
+'on':
   pull_request:
 
 jobs:
@@ -17,7 +18,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Run setup-dev
         run: ./bin/setup-dev.sh

.pre-commit-config.yaml

@@ -1,4 +1,5 @@
 # Copyright 2026 Hewlett Packard Enterprise Development LP
+---
 repos:
   - repo: local
     hooks:

.pre-commit-hooks.yaml

@@ -1,3 +1,4 @@
+---
 # Copyright 2026 Hewlett Packard Enterprise Development LP
 - id: forbid-code-checking-ref
   name: forbid tracked code-checking-ref

.yamllint

@@ -0,0 +1,22 @@
+---
+extends: default
+
+ignore: |
+  *.tpl
+  .cache
+  *venv/
+  LEGACY/**
+  collections/ansible_collections/**
+
+rules:
+  comments-indentation: disable
+  comments:
+    min-spaces-from-content: 1
+  braces:
+    max-spaces-inside: 1
+  line-length:
+    max: 120
+    allow-non-breakable-inline-mappings: true
+  octal-values:
+    forbid-implicit-octal: true
+    forbid-explicit-octal: true

README.md

@@ -113,9 +113,9 @@ This command syncs the `code_checking` ref, writes the recommended GitHub
 workflow (`pull_request` trigger only, to avoid duplicate `push` + PR runs),
 bootstraps or refreshes pre-commit hooks, and updates the consumer `README.md`
 managed section. It also seeds baseline `.gitignore`,
-`cspell.config.yaml`, and `vscode-project-words.txt` in the consumer root when
-those files are missing. Running `sync-consumer` means you do not need
-to run `setup-github-workflow.sh` separately.
+`cspell.config.yaml`, `.yamllint`, and `vscode-project-words.txt` in the
+consumer root when those files are missing. Running `sync-consumer` means you
+do not need to run `setup-github-workflow.sh` separately.
 
 To skip README updates for a specific run:
 
@@ -132,6 +132,7 @@ For an initial consumer-repo integration commit after running
 - `.pre-commit-config.yaml` (if `setup-dev` was run)
 - `README.md`
 - `cspell.config.yaml` (if seeded)
+- `.yamllint` (if seeded)
 - `vscode-project-words.txt` (if seeded)
 
 The `code_checking` submodule was previously added. Changes inside that
@@ -144,6 +145,7 @@ git add .gitmodules
 git add .pre-commit-config.yaml   # if setup-dev was run
 git add README.md
 git add cspell.config.yaml     # seeded if missing
+git add .yamllint              # seeded if missing
 git add vscode-project-words.txt  # seeded if missing
 ```