ci: vendor validation scripts and remove remote action pins

[hyperpolymath]

Automated PR to fix CI after deleted actions.

---

Summary by Gitar

• CI Workflows:
  • Added vendored validate-a2ml.sh and validate-k9.sh validation scripts in .githooks/
  • Updated dogfood-gate.yml workflow to run local validation scripts instead of remote ecosystem actions

_{This will update automatically on new commits.}

[sonarqubecloud]

Quality Gate passed

Issues
6 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[gitar-bot]

Code Review ✅ Approved 2 resolved / 2 findings

Vendors validation scripts and removes remote action pins in CI, but the file read loops drop the last line when no trailing newline and normalise_level only strips a single leading or trailing space.

✅ 2 resolved

✅ Edge Case: File read loops drop last line when no trailing newline

📄 .githooks/validate-k9.sh:122-131 📄 .githooks/validate-k9.sh:141-150 📄 .githooks/validate-k9.sh:169-183 📄 .githooks/validate-a2ml.sh:102-111 📄 .githooks/validate-a2ml.sh:128-142 📄 .githooks/validate-a2ml.sh:239-253 📄 .githooks/validate-a2ml.sh:270-280
All the while IFS= read -r line; do ... done < "$file" loops in both scripts skip the final line when a file lacks a trailing newline, because read returns non-zero on the last unterminated line and the loop body never runs for it. This silently omits the last line from every content check (pedigree name/version/leash, SPDX, attestation, section-heading), producing false negatives or false positives — e.g. a K9 file ending in leash = "hunt" } with no newline would evade the hunt-signature check, and a single-line file K9! with no newline reports a missing magic number. Add the standard fallback so the last line is always processed.

✅ Quality: normalise_level only strips a single leading/trailing space

📄 .githooks/validate-k9.sh:95-108
In validate-k9.sh, raw="${raw## }" / raw="${raw%% }" use a literal single-space pattern (no wildcard), so only one space is removed. A leash value indented or padded with tabs or multiple spaces (e.g. security_level = "hunt") will retain whitespace after normalisation and fail the exact == comparison against kennel/yard/hunt, wrongly reporting an invalid security level. Use a bracket-with-wildcard pattern to strip all leading/trailing whitespace.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}