ci: shared CI checks across the SDK repositories #11

Tracking issue for CI checks that every SDK repository (sdk-go, sdk-python, sdk-typescript) should run the same way. Each item below gets its own issue or PR when we pick it up. When a check changes, it changes in all SDK repositories.

License headers

Decision (from the discussion on #3): new files need only the license identifier, in the file's comment syntax:

# SPDX-License-Identifier: Apache-2.0

• New files don't need SPDX-FileCopyrightText. Downstream pipelines read the identifier, so we keep that line. The copyright line isn't required.
• Existing headers keep their SPDX-FileCopyrightText line. Don't remove or rewrite it, including in files imported from core.
• Files that can't hold comments, such as JSON, get a REUSE-style <file>.license sidecar with the same line. tests/fixtures/oauth-client-credentials.json.license already does this.
• Generated code is excluded, for example src/openshell/_proto here and the generated Go bindings in sdk-go.

Today:

• Neither sdk-go nor sdk-python checks headers. The imported files all carry both lines.
• Core's checker (scripts/update_license_headers.py, mise run license:check) requires and writes the copyright line too, so we can't reuse it as-is.
• reuse lint also requires a copyright notice for every file, so it doesn't fit this policy without changes.

Proposal: add a small license:check task to each repository, run from mise run ci. It fails when a tracked source file has no SPDX-License-Identifier: Apache-2.0 line in its first few lines or in a sidecar. It neither requires nor rejects SPDX-FileCopyrightText. Document the rule in each repository's contributing notes.

• sdk-python
• sdk-go
• sdk-typescript

Other candidates

Each needs a decision on whether it belongs here.

• Workflow linting: sdk-go runs actionlint, shellcheck and zizmor (mise run workflows:check); sdk-python doesn't yet.
• Action pinning: actions are pinned by full commit SHA with a version comment. Decide on one update mechanism, such as Dependabot or Renovate, for all SDK repositories.
• Core sync automation: the core-watch and core-drift workflows and their scripts are copied from sdk-go (ci: propose bindings updates for new core releases and track drift against core main #5). A fix to one copy must reach the other.
• E2E gateway scripts: start-gateway.sh and stop-gateway.sh run the published gateway of a core version for the E2E lane. sdk-python copied them from sdk-go (test(e2e): run the SDK E2E suite against the pinned core gateway #12) and added --default-image. Decide whether to share them, and keep both copies identical until then.
• Script location: sdk-go keeps its automation scripts in hack/automation/. sdk-python groups scripts/ by purpose: scripts/core-sync/ for the bump and drift automation (ci(core): propose core release bumps and track drift on core main #13), scripts/e2e/ for the E2E gateway (test(e2e): run the SDK E2E suite against the pinned core gateway #12), and the build and check helpers at the top. They aren't hacks, so this layout fits better. Pick one layout for all SDK repositories.
• Org-level settings: DCO and the main rulesets already apply org-wide; ai-openshell/infra manages them in Terraform.

Where shared pieces live

For now each repository keeps its own copy, as with the core sync automation. If the copies start drifting, move them to reusable workflows or a composite action in one org repository, and track that here.