test: harden compiler regressions and ci metadata checks

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>

Author: vitormattos

.github/FUNDING.yml

@@ -1 +1,4 @@
+# SPDX-FileCopyrightText: 2026 LibreSign
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
 github: libresign

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: 2026 LibreSign
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
 name: Bug report
 description: Report a reproducible defect
 labels: [bug]

.github/ISSUE_TEMPLATE/config.yml

@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: 2026 LibreSign
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
 blank_issues_enabled: false
 contact_links:
   - name: Security disclosure

.github/ISSUE_TEMPLATE/discussion.yml

@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: 2026 LibreSign
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
 name: Discussion
 description: Start a technical/product discussion
 labels: [discussion]

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: 2026 LibreSign
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
 name: Feature request
 description: Propose a feature for roadmap review
 labels: [enhancement]

.github/actions/shell-quality/action.yml

@@ -0,0 +1,24 @@
+# SPDX-FileCopyrightText: 2026 LibreSign
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+name: shell-quality
+description: Install shell tooling and run shell safety checks.
+
+runs:
+  using: composite
+  steps:
+    - name: Install shell tools
+      shell: bash
+      run: sudo apt-get update && sudo apt-get install -y shellcheck shfmt devscripts
+
+    - name: shellcheck
+      shell: bash
+      run: shellcheck scripts/*.sh
+
+    - name: shfmt check
+      shell: bash
+      run: shfmt -d scripts
+
+    - name: checkbashisms
+      shell: bash
+      run: checkbashisms -f scripts/*.sh

.github/dependabot.yml

@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: 2026 LibreSign
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
 version: 2
 updates:
   - package-ecosystem: composer

.github/release-drafter.yml

@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: 2026 LibreSign
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
 name-template: 'v$RESOLVED_VERSION'
 tag-template: 'v$RESOLVED_VERSION'
 template: |

.github/workflows/bc-check.yml

@@ -10,7 +10,7 @@ jobs:
   bc-check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
       - name: Detect minimum PHP from composer.json

.github/workflows/changelog.yml

@@ -10,12 +10,12 @@ jobs:
   changelog:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
       - name: Check if CHANGELOG.md changed
         id: changed_files
-        uses: tj-actions/changed-files@v46
+        uses: tj-actions/changed-files@v47
         with:
           files: |
             CHANGELOG.md