Merge pull request #783 from eclipse-threadx/devv6.5.2.202603_rel

Merged changes ahead of the v6.5.2.202603 release

1 files changed, 63 insertions, 0 deletions

diff --git a/.github/workflows/repo_checks.yml b/.github/workflows/repo_checks.yml
new file mode 100644
index 00000000..955e6ddd
--- /dev/null
+++ b/.github/workflows/repo_checks.yml
@@ -0,0 +1,63 @@
+###############################################################################
+# Copyright (c) 2026 Eclipse ThreadX contributors
+#
+# This program and the accompanying materials are made available under the
+# terms of the MIT License which is available at
+# https://opensource.org/licenses/MIT.
+#
+# AI Disclosure: This file was largely AI-generated by Claude Code (Opus 5).
+# The AI-generated portions may be considered public domain (CC0-1.0)
+# and not subject to the project's licence. The human contributor has
+# reviewed and verified that the code is correct.
+#
+# SPDX-License-Identifier: MIT and CC0-1.0
+###############################################################################
+
+name: repo_checks
+
+# Repository-wide text checks.
+#
+# THIS LIVES IN ITS OWN WORKFLOW BECAUSE IT MUST NOT BE PATH-FILTERED, and a
+# path filter is a property of a workflow rather than of a job.  The check
+# selects its input with `git ls-files` and scans every tracked file, so any
+# file at all can carry a finding.
+#
+# That is not hypothetical here.  The pass that introduced the fixed
+# disclosure line covered source files only, and the drift it was meant to end
+# survived for months afterwards in CMake files, toolchain files, shell and
+# PowerShell scripts, a GDB script and a Visual Studio manifest -- precisely
+# the files a source-path filter would have skipped.  A workflow that gates no
+# pull request anybody opens is worse than no workflow, because it looks like
+# coverage.
+#
+# Cheap enough that running it on everything costs nothing worth measuring: it
+# is grep over a repository this size, with no toolchain, no build and no
+# cache.
+
+on:
+  # No `paths:` on either trigger, deliberately.  See above.
+  push:
+    branches: [ dev, master ]
+  pull_request:
+    branches: [ dev, master ]
+
+# A second push to the same branch makes the first answer irrelevant.
+concurrency:
+  group: repo-checks-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  checks:
+    runs-on: ubuntu-24.04
+    steps:
+    # Actions are pinned to a commit SHA with the version in the trailing
+    # comment.  A tag can be moved; a SHA cannot, which is what makes "which
+    # code ran in our CI" answerable from the repository.
+    - name: Check out the repository
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+    - name: Check the AI disclosure comments
+      run: scripts/check_ai_disclosure.sh