feat: add reusable verify-boilerplate composite action

[Prachi01Yadav]

Fixes #1069

What this PR does

Adds a reusable composite GitHub Action at .github/actions/verify-boilerplate/ that wraps the existing hack/boilerplate/boilerplate.py script, so Kubeflow subprojects can enforce Apache 2.0 copyright headers without vendoring the script.

Requirements checklist

• Composite action wrapping hack/boilerplate/boilerplate.py — script is sourced directly from kubeflow/testing via actions/checkout with sparse-checkout, so callers never vendor it.
• Input for base ref — base-ref input defaults to the PR base branch (github.base_ref), so only changed/new files are flagged for year-less header enforcement.
• Input for boilerplate template directory — boilerplate-dir input lets repos with custom templates point to their own directory. Defaults to kubeflow/testing's templates.
• Sets up Python — includes a setup-python step (default 3.12) so callers don't need to add one.
• Non-zero exit on failure — the script already exits non-zero with remediation output; the action inherits this behavior.

Usage

Callers can use this action in their workflows like:

steps:
  - uses: actions/checkout@v4
    with:
      fetch-depth: 0

  - uses: kubeflow/testing/.github/actions/verify-boilerplate@master
    with:
      base-ref: ${{ github.base_ref }}

Context

• Tracking issue: request: Add Reusable copyright boilerplate check CI action #1069
• Related: chore: standardize copyright boilerplate and enforce with CI sdk#765, Standardize copyright boilerplate and enforce with CI workflow sdk#566

[jaiakash]

@Prachi01Yadav please check the nit comments, rest looks good to me.

cc @tariq-hasan for review

[jaiakash]

/lgtm

[tariq-hasan]

I've just had a few additional comments. Overall lgtm. Thanks.

[Prachi01Yadav]

I've just had a few additional comments. Overall lgtm. Thanks.

@tariq-hasan Thanks for the review! I've applied all your suggestions (removed the checkout/cleanup steps and simplified the fallback). Let me know if everything looks good now!

[tariq-hasan]

Hi @Prachi01Yadav! I have added some further comments to help refine the first iteration and make it more robust.

[tariq-hasan]

Thanks @Prachi01Yadav!
/lgtm
/assign @jaiakash @juliusvonkohout @andreyvelich @nsingla

[tariq-hasan]

Depending on preference we can self-test this composite action directly on this testing repo (perhaps something like .github/workflows/code-quality-check.yaml) before there's adoption in consumer repos. Or we could test in kubeflow/sdk#765 directly.

[Prachi01Yadav]

Depending on preference we can self-test this composite action directly on this testing repo (perhaps something like .github/workflows/code-quality-check.yaml) before there's adoption in consumer repos. Or we could test in kubeflow/sdk#765 directly.

let's just test it directly in kubeflow/sdk#765, I can update that PR to use this action as soon as this is merged.. let me know if that sounds good to you

[Copilot]

🟡 Changes recommended

Documented input names do not match the action’s implementation, causing caller values to be ignored.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds a reusable composite GitHub Action for enforcing Apache 2.0 boilerplate headers.

Changes:

• Configures Python and runs the shared boilerplate checker.
• Supports base-reference, template-directory, and repository-root inputs.

File summaries

File	Review
.github/actions/verify-boilerplate/action.yml	Two moderate issues (2 votes each): rename base-reference to documented base-ref, and boilerplate-directory to boilerplate-dir, including all references.

Review details

Suppressed comments (1)

.github/actions/verify-boilerplate/action.yml:111

• setup-python puts the cross-platform python executable on PATH, whereas a python3 executable is not guaranteed on Windows. Since this composite action has no runner-OS restriction, it can fail after successfully setting up Python on Windows runners. Invoke python here so the configured interpreter is used on every supported runner.

        python3 "${script}" \

• Files reviewed: 1/1 changed files
• Comments generated: 2
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[tariq-hasan]

I've created a separate issue to track this gap - #1074 - so we can move forward with this PR in the meantime.

[tariq-hasan]

Same as above.

[tariq-hasan]

Thanks for the contribution @Prachi01Yadav!
/lgtm
/approve

[google-oss-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: tariq-hasan

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [tariq-hasan]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment