Fix Copilot setup validation job by resolving workflow yamllint errors

.github/workflows/code-coverage.yml

@@ -1,4 +1,4 @@
 concurrency:
   cancel-in-progress: true
   group: coverage-${{ github.workflow }}-${{ github.ref }}
 jobs:
@@ -7,7 +7,7 @@
     runs-on: ubuntu-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 
@@ -56,7 +56,7 @@
     runs-on: ubuntu-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 
@@ -185,7 +185,7 @@
     runs-on: ubuntu-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 
@@ -278,14 +278,12 @@
         python-version: ["3.11", "3.12"]
     timeout-minutes: 20
 name: Code Coverage
 on:
   pull_request:
     branches: [main, dev]
   push:
     branches: [main, dev]
   workflow_dispatch:
 
-
-
 permissions:
   contents: read

.github/workflows/dataset-integrity.yml

@@ -11,9 +11,9 @@
 #   - integrity-summary: Aggregates results into a single status check
 # =============================================================================
 
 name: Dataset Integrity
 
 on:
     pull_request:
         branches: [main, dev]
         paths:
@@ -67,9 +67,9 @@
 
         steps:
             - name: Harden the runner (Audit all outbound calls)
               uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
               with:
-                egress-policy: audit
+                  egress-policy: audit
 
             - name: Checkout code
               uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
@@ -186,9 +186,9 @@
 
         steps:
             - name: Harden the runner (Audit all outbound calls)
               uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
               with:
-                egress-policy: audit
+                  egress-policy: audit
 
             - name: Checkout code
               uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
@@ -489,9 +489,9 @@
         timeout-minutes: 1
         steps:
             - name: Harden the runner (Audit all outbound calls)
               uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
               with:
-                egress-policy: audit
+                  egress-policy: audit
 
             - name: Aggregate status
               env:

.github/workflows/ossar.yml

@@ -49,7 +49,7 @@ jobs:
         uses: github/ossar-action@v1
         id: ossar
 
-        # Upload results to the Security tab
+      # Upload results to the Security tab
       - name: Upload OSSAR results
         uses: github/codeql-action/upload-sarif@v3
         with:

tests/test_workflow_yamllint_regressions.py

@@ -0,0 +1,61 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+import yaml
+
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+
+
+def _read(path: str) -> str:
+    return (REPO_ROOT / path).read_text(encoding="utf-8")
+
+
+@pytest.mark.unit
+def test_code_coverage_workflow_no_triple_blank_before_permissions() -> None:
+    content = _read(".github/workflows/code-coverage.yml")
+    assert "\n\n\npermissions:" not in content
+
+
+@pytest.mark.unit
+def test_dataset_integrity_harden_runner_with_block_indentation() -> None:
+    content = _read(".github/workflows/dataset-integrity.yml")
+    bad_indent = "with:\n                egress-policy: audit"  # 16 leading spaces on egress-policy
+    good_indent = "with:\n                  egress-policy: audit"  # 18 leading spaces on egress-policy
+    assert bad_indent not in content
+    assert content.count(good_indent) == 3
+
+
+@pytest.mark.unit
+def test_workflow_files_end_with_newline() -> None:
+    for rel_path in (
+        ".github/workflows/github_workflows_autofix-pr.yml",
+        ".github/workflows/github_workflows_validate-workflows.yml",
+    ):
+        assert _read(rel_path).endswith("\n")
+
+
+@pytest.mark.unit
+def test_ossar_workflow_steps_and_branch_spacing_regression() -> None:
+    content = _read(".github/workflows/ossar.yml")
+    workflow = yaml.safe_load(content)
+    triggers = workflow.get("on", workflow.get(True))
+    assert triggers is not None, "Expected workflow triggers under key 'on' (or YAML-1.1 boolean True fallback)."
+    steps = workflow["jobs"]["OSSAR-Scan"]["steps"]
+
+    assert triggers["push"]["branches"] == ["main"]
+    assert triggers["pull_request"]["branches"] == ["main"]
+    assert steps[0]["name"] == "Checkout repository"
+
+
+@pytest.mark.unit
+def test_summary_workflow_has_no_trailing_whitespace() -> None:
+    content = _read(".github/workflows/summary.yml")
+    trailing_ws_lines = [
+        line_number
+        for line_number, line in enumerate(content.splitlines(), start=1)
+        if line != line.rstrip(" \t")
+    ]
+    assert not trailing_ws_lines, f"Trailing whitespace found on lines: {trailing_ws_lines}"