ci: vendor validation scripts and remove remote action pins

[hyperpolymath]

Automated PR to fix CI after deleted actions.

---

Summary by Gitar

• CI Workflows:
  • Vendored validation scripts validate-a2ml.sh and validate-k9.sh into .githooks/
  • Replaced remote GitHub Action pins in dogfood-gate.yml with local script execution

_{This will update automatically on new commits.}

[gitar-bot]

CI failed: 3 change-related CI failures from a missing Alpine package in the fallback containerfile, an unprocessable CodeQL language matrix entry, and a banned Python file detected by governance checks.

Overview

Three distinct failures occurred across the CI run: a container build failure due to a missing package in the Alpine fallback image, a CodeQL analysis failure caused by missing JavaScript/TypeScript source files, and a repository governance failure detecting a banned Python file.

Failures

Alpine Fallback Container Build Failure (confidence: high)

• Type: build
• Affected jobs: 90126091169
• Related to change: yes
• Root cause: Containerfile.alpine-fallback attempts to install gcompat using apk add, but the package is unavailable in the Chainguard Alpine package repository.
• Suggested fix: Remove gcompat from the apk add command in Containerfile.alpine-fallback, or replace it with a compatible package or base image.

CodeQL Configuration Failure (confidence: high)

• Type: configuration
• Affected jobs: 90126091328
• Related to change: yes
• Root cause: The CodeQL analysis workflow targeted JavaScript/TypeScript, but no valid source files for that language were present or processed in the repository, causing CodeQL to fail with exit code 32.
• Suggested fix: Remove JavaScript/TypeScript from the CodeQL analysis matrix or ensure the required source files are present and correctly located.

Governance Banned Language Check Failure (confidence: high)

• Type: tooling
• Affected jobs: 90126093607
• Related to change: yes
• Root cause: Hypatia governance checks (cicd_rules/banned_language_file) detected a Python file (nautilus-extension/cloud_sync_overlay.py), which is banned by repository policy unless explicitly exempted.
• Suggested fix: Remove/rewrite nautilus-extension/cloud_sync_overlay.py in an allowed language, or add an exemption pragma (# hypatia:ignore cicd_rules/banned_language_file) or baseline entry.

Summary

• Change-related failures: 3 failures (Container build error, CodeQL configuration error, and governance policy check failure for a Python file)
• Infrastructure/flaky failures: 0
• Recommended action: Fix the missing package in Containerfile.alpine-fallback, adjust the CodeQL matrix configuration, and either remove or exempt the Python file in the repository.

Code Review ✅ Approved

Vendors validation scripts locally and updates the CI workflow to execute them instead of using remote action pins. No issues found.

Auto-approved: No blocking issues found.
Please see Auto-approve Docs for details on setting custom approval criteria.

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[gitar-bot]

Gitar has auto-approved this PR (configure)