Chore: Add copyright headers, update contributor policy and actions

.github/PULL_REQUEST_TEMPLATE.md

@@ -30,5 +30,6 @@ See [DCO missing](https://github.com/src-d/guide/blob/master/developer-community
 - [ ] Documentation has been added, updated, or not applicable
 - [ ] Changes have been rebased to main
 - [ ] Multiple commits to the same code have been squashed
+- [ ] All changes have been human generated or created with a reproducible tool
 
 <!-- markdownlint-disable-file MD041 -->

.github/workflows/docker.yml

@@ -1,3 +1,17 @@
+# Copyright the version-bump contributors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 name: Docker
 
 on:
@@ -10,6 +24,9 @@ on:
   schedule:
     - cron: '0 06 * * *'
 
+permissions:
+  contents: read
+
 jobs:
 
   docker:

.github/workflows/go.yml

@@ -1,3 +1,17 @@
+# Copyright the version-bump contributors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 name: Go
 
 on:
@@ -10,6 +24,9 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions:
+  contents: read
+
 jobs:
 
   build:

.github/workflows/version-bump.yml

@@ -1,10 +1,27 @@
+# Copyright the version-bump contributors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 name: Version Check
 
 on:
   schedule:
     - cron: '0 05 * * 0'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Version Check

.github/workflows/vulnscans.yml

@@ -1,10 +1,27 @@
+# Copyright the version-bump contributors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 name: Vulnerability Check
 
 on:
   schedule:
     - cron: '0 06 * * 0' # 6am UTC on Sundays
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   vulnerability-scans:
     name: Run vulnerability scans

.markdownlint.yml

@@ -1,3 +1,17 @@
+# Copyright the version-bump contributors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 # all lists use a `-`
 MD004:
   style: dash

.version-bump.yml

@@ -1,3 +1,17 @@
+# Copyright the version-bump contributors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 files:
   "Dockerfile*":
     processors:

CONTRIBUTING.md

@@ -8,6 +8,22 @@ Please send security issues to <git@bmitch.net>.
 
 Please search for similar issues and if none are seen, report an issue at [github.com/sudo-bmitch/version-bump/issues](https://github.com/sudo-bmitch/version-bump/issues)
 
+## Code style
+
+This project attempts to follow these principles:
+
+- Code is canonical Go, following styles and patterns commonly used by the Go community.
+- Dependencies outside of the Go standard library should be minimized.
+- Dependencies should be pinned to a specific digest and tracked by Go or version-check.
+- Unit tests are strongly encouraged with a focus on test coverage of the successful path and common errors.
+- Linters and other style formatting tools are used, please run `make all` before committing any changes.
+
+## LLM Policy
+
+This project expects all contributions to be developed by a human or created with a reproducible tool.
+Developers using an AI/LLM tool to generate their contribution are expected to fully understand the entire contribution and the logic behind its design.
+Contributions that appear to have been generated by an AI/LLM without a human review may result in a ban from future contributions to the project.
+
 ## Pull requests
 
 PR's are welcome.

Dockerfile

@@ -1,3 +1,17 @@
+# Copyright the version-bump contributors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 ARG REGISTRY=docker.io
 ARG ALPINE_VER=3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
 ARG GO_VER=1.26.4-alpine@sha256:3ad57304ad93bbec8548a0437ad9e06a455660655d9af011d58b993f6f615648

Dockerfile.buildkit

@@ -1,3 +1,17 @@
+# Copyright the version-bump contributors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 ARG REGISTRY=docker.io
 ARG ALPINE_VER=3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
 ARG GO_VER=1.26.4-alpine@sha256:3ad57304ad93bbec8548a0437ad9e06a455660655d9af011d58b993f6f615648

LICENSE

@@ -176,7 +176,18 @@
 
    END OF TERMS AND CONDITIONS
 
-   Copyright 2022 Brandon Mitchell.
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

Makefile

@@ -1,3 +1,17 @@
+# Copyright the version-bump contributors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 COMMANDS?=version-bump
 BINARIES?=$(addprefix bin/,$(COMMANDS))
 IMAGES?=$(addprefix docker-,$(COMMANDS))
@@ -57,7 +71,11 @@ test: ## go test
 	go test -cover -race ./...
 
 .PHONY: lint
-lint: lint-go lint-goimports lint-md lint-gosec ## Run all linting
+lint: lint-go lint-goimports lint-md lint-gosec lint-copyright ## Run all linting
+
+.PHONY: lint-copyright
+lint-copyright: ## Verify copyright headers in code files
+	./scripts/lint-copyright.sh
 
 .PHONY: lint-go
 lint-go: $(GOPATH)/bin/staticcheck .FORCE ## Run linting for Go

internal/config/config.go

@@ -1,3 +1,17 @@
+// Copyright the version-bump contributors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 // Package config defines the config file and load methods
 package config
 

internal/config/config_test.go

@@ -1,3 +1,17 @@
+// Copyright the version-bump contributors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 package config
 
 import (

internal/filesearch/filesearch.go

@@ -1,3 +1,17 @@
+// Copyright the version-bump contributors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 // Package filesearch is used to retrieve files for scanning
 package filesearch
 

internal/filesearch/filesearch_test.go

@@ -1,3 +1,17 @@
+// Copyright the version-bump contributors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 package filesearch
 
 import (

internal/lockfile/lockfile.go

@@ -1,3 +1,17 @@
+// Copyright the version-bump contributors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 // Package lockfile is used to manage the lockfile of managed versions
 package lockfile
 

internal/lockfile/lockfile_test.go

@@ -1,3 +1,17 @@
+// Copyright the version-bump contributors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 package lockfile
 
 import (

internal/processor/processor.go

@@ -1,3 +1,17 @@
+// Copyright the version-bump contributors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 // Package processor wraps the call to the scanner and requests to the source for a single type of update to a single file.
 // It includes logic for filtering, sorting, and templating of the source output.
 package processor