ci: vendor validation scripts and remove remote action pins

[hyperpolymath]

Automated PR to fix CI after deleted actions.

---

Summary by Gitar

• CI scripts vendoring:
  • Added .githooks/validate-a2ml.sh for A2ML manifest validation
  • Added .githooks/validate-k9.sh for K9 configuration validation
• Workflow updates:
  • Updated dogfood-gate.yml to run vendored scripts instead of remote actions

_{This will update automatically on new commits.}

[sonarqubecloud]

Quality Gate passed

Issues
6 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[gitar-bot]

CI failed: 4 CI validation failures occurred due to a missing allowlist entry for .githooks/, unfilled placeholder tokens in SECURITY.md, invalid K9 contract file formats, and an unconfigured SonarQube token.

Overview

Analysis of 4 CI logs revealed 4 distinct failure patterns: 3 change-related validation/test failures (root shape check, SECURITY.md placeholder check, and K9 contract validation) and 1 infrastructure/authentication failure (missing SonarQube token).

Failures

Root Shape Check Failure (confidence: high)

• Type: build
• Affected jobs: 90124880028
• Related to change: yes
• Root cause: The newly added directory .githooks/ is not present on the allowed root entries list in the repository configuration.
• Suggested fix: Add an entry for .githooks/ to .machine_readable/root-allow.txt, or move its contents to an appropriate existing subdirectory.

Unfilled Security File Placeholders (confidence: high)

• Type: tooling
• Affected jobs: 90124880023
• Related to change: yes
• Root cause: .github/SECURITY.md contains 13 unfilled {{PLACEHOLDER}} tokens (such as {{SECURITY_EMAIL}}, {{PGP_FINGERPRINT}}, etc.) violating OpenSSF Best Practices validation.
• Suggested fix: Populate all placeholder tokens in .github/SECURITY.md with actual project details or run just init to fill them.

K9 Contract Validation Errors (confidence: high)

• Type: test
• Affected jobs: 90124880303
• Related to change: yes
• Root cause: Scanned K9 files lack the required 'K9!' magic number on the first non-empty line, are missing signature fields, or have incomplete pedigree blocks.
• Suggested fix: Update all K9 contract files (e.g., in .machine_readable/arrival-pack/) to include the 'K9!' magic number, valid signatures, and required pedigree structures.

SonarQube Authentication Failure (confidence: high)

• Type: authentication
• Affected jobs: 90124880130
• Related to change: no
• Root cause: The SONAR_TOKEN environment variable was missing or invalid, causing the SonarScanner step to fail authorization.
• Suggested fix: Configure a valid SONAR_TOKEN secret in the GitHub repository settings and pass it correctly in the workflow.

Summary

• Change-related failures: 3 failures (root shape violation, unfilled SECURITY.md template tokens, and K9 contract validation errors).
• Infrastructure/flaky failures: 1 failure (missing SonarQube authentication token).
• Recommended action: Update the codebase to register .githooks/ in the allowlist, fill in the SECURITY.md placeholders, fix the K9 contract files, and ensure repository secrets include a valid SONAR_TOKEN if SonarQube analysis is required.

Code Review ✅ Approved

Vendors validation scripts into .githooks/ and updates dogfood-gate.yml to remove remote action dependencies. No issues found.

Auto-approved: No blocking issues found.
Please see Auto-approve Docs for details on setting custom approval criteria.

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[gitar-bot]

Gitar has auto-approved this PR (configure)