refactor: remove mvp wording from unsupported subset messaging

.github/FUNDING.yml

@@ -1 +1,4 @@
+# SPDX-FileCopyrightText: 2026 LibreSign
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
 github: libresign

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: 2026 LibreSign
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
 name: Bug report
 description: Report a reproducible defect
 labels: [bug]

.github/ISSUE_TEMPLATE/config.yml

@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: 2026 LibreSign
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
 blank_issues_enabled: false
 contact_links:
   - name: Security disclosure

.github/ISSUE_TEMPLATE/discussion.yml

@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: 2026 LibreSign
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
 name: Discussion
 description: Start a technical/product discussion
 labels: [discussion]

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: 2026 LibreSign
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
 name: Feature request
 description: Propose a feature for roadmap review
 labels: [enhancement]

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,3 +1,6 @@
+<!-- SPDX-FileCopyrightText: 2026 LibreSign -->
+<!-- SPDX-License-Identifier: AGPL-3.0-or-later -->
+
 ## Scope
 
 - [ ] Change scope and impact are clearly described

.github/actions/shell-quality/action.yml

@@ -0,0 +1,24 @@
+# SPDX-FileCopyrightText: 2026 LibreSign
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+name: shell-quality
+description: Install shell tooling and run shell safety checks.
+
+runs:
+  using: composite
+  steps:
+    - name: Install shell tools
+      shell: bash
+      run: sudo apt-get update && sudo apt-get install -y shellcheck shfmt devscripts
+
+    - name: shellcheck
+      shell: bash
+      run: shellcheck scripts/*.sh
+
+    - name: shfmt check
+      shell: bash
+      run: shfmt -d scripts
+
+    - name: checkbashisms
+      shell: bash
+      run: checkbashisms -f scripts/*.sh

.github/copilot-instructions.md

@@ -1,3 +1,6 @@
+<!-- SPDX-FileCopyrightText: 2026 LibreSign -->
+<!-- SPDX-License-Identifier: AGPL-3.0-or-later -->
+
 # Copilot Instructions
 
 ## Mandatory quality flow

.github/dependabot.yml

@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: 2026 LibreSign
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
 version: 2
 updates:
   - package-ecosystem: composer

.github/release-drafter.yml

@@ -1,5 +1,16 @@
+# SPDX-FileCopyrightText: 2026 LibreSign
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
 name-template: 'v$RESOLVED_VERSION'
 tag-template: 'v$RESOLVED_VERSION'
+template: |
+  ## Changes
+
+  $CHANGES
+
+  ## Contributors
+
+  $CONTRIBUTORS
 change-template: '- $TITLE (#$NUMBER)'
 categories:
   - title: 'Features'

.github/workflows/bc-check.yml

@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: 2026 LibreSign
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
 name: bc-check
 
 on:
@@ -7,12 +10,18 @@ jobs:
   bc-check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
+      - name: Detect minimum PHP from composer.json
+        id: php_min
+        run: |
+          php_version=$(grep -Po '"php"\s*:\s*"\K[^"]+' composer.json | grep -Eo '[0-9]+\.[0-9]+' | head -n1)
+          [[ -n "$php_version" ]] || { echo "Could not determine minimum PHP version"; exit 1; }
+          echo "version=$php_version" >> "$GITHUB_OUTPUT"
       - uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.2'
+          php-version: ${{ steps.php_min.outputs.version }}
       - run: composer install --no-interaction --prefer-dist
       - run: composer bin qa install --no-interaction --prefer-dist
       - run: composer run bc:check

.github/workflows/changelog.yml

@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: 2026 LibreSign
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
 name: changelog
 
 on:
@@ -7,12 +10,12 @@ jobs:
   changelog:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
       - name: Check if CHANGELOG.md changed
         id: changed_files
-        uses: tj-actions/changed-files@v46
+        uses: tj-actions/changed-files@v47
         with:
           files: |
             CHANGELOG.md

.github/workflows/commitlint.yml

@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: 2026 LibreSign
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
 name: commitlint
 
 on:
@@ -7,11 +10,27 @@ jobs:
   commitlint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-      - run: npm ci
-      - run: npx commitlint --from=${{ github.event.pull_request.base.sha }} --to=${{ github.sha }}
+      - name: Validate Conventional Commits
+        run: |
+          set -euo pipefail
+          RANGE="${{ github.event.pull_request.base.sha }}..${{ github.sha }}"
+
+          invalid=0
+          while IFS= read -r message; do
+            [[ -z "$message" ]] && continue
+            [[ "$message" =~ ^Merge\  ]] && continue
+
+            if [[ "$message" =~ ^(build|chore|ci|docs|feat|fix|perf|refactor|revert|style|test)(\([a-z0-9._/-]+\))?!?:\ .+ ]]; then
+              continue
+            fi
+
+            echo "Invalid conventional commit message: $message"
+            invalid=1
+          done < <(git log --format=%s "$RANGE")
+
+          if [[ $invalid -ne 0 ]]; then
+            exit 1
+          fi

.github/workflows/compatibility-matrix.yml

@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: 2026 LibreSign
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
 name: compatibility-matrix
 
 on:
@@ -9,13 +12,18 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        php: ['8.2', '8.3']
         deps: [lowest, highest]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
+      - name: Detect minimum PHP from composer.json
+        id: php_min
+        run: |
+          php_version=$(grep -Po '"php"\s*:\s*"\K[^"]+' composer.json | grep -Eo '[0-9]+\.[0-9]+' | head -n1)
+          [[ -n "$php_version" ]] || { echo "Could not determine minimum PHP version"; exit 1; }
+          echo "version=$php_version" >> "$GITHUB_OUTPUT"
       - uses: shivammathur/setup-php@v2
         with:
-          php-version: ${{ matrix.php }}
+          php-version: ${{ steps.php_min.outputs.version }}
       - run: |
           if [ "${{ matrix.deps }}" = "lowest" ]; then
             composer update --prefer-lowest --prefer-dist --no-interaction

.github/workflows/composer-validate.yml

@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: 2026 LibreSign
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
 name: composer-validate
 
 on:
@@ -9,8 +12,14 @@ jobs:
   composer-validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
+      - name: Detect minimum PHP from composer.json
+        id: php_min
+        run: |
+          php_version=$(grep -Po '"php"\s*:\s*"\K[^"]+' composer.json | grep -Eo '[0-9]+\.[0-9]+' | head -n1)
+          [[ -n "$php_version" ]] || { echo "Could not determine minimum PHP version"; exit 1; }
+          echo "version=$php_version" >> "$GITHUB_OUTPUT"
       - uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.2'
+          php-version: ${{ steps.php_min.outputs.version }}
       - run: composer validate --strict

.github/workflows/coverage.yml

@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: 2026 LibreSign
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
 name: coverage
 
 on:
@@ -7,10 +10,16 @@ jobs:
   coverage:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
+      - name: Detect minimum PHP from composer.json
+        id: php_min
+        run: |
+          php_version=$(grep -Po '"php"\s*:\s*"\K[^"]+' composer.json | grep -Eo '[0-9]+\.[0-9]+' | head -n1)
+          [[ -n "$php_version" ]] || { echo "Could not determine minimum PHP version"; exit 1; }
+          echo "version=$php_version" >> "$GITHUB_OUTPUT"
       - uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.2'
+          php-version: ${{ steps.php_min.outputs.version }}
           coverage: xdebug
       - run: composer install --no-interaction --prefer-dist
       - run: composer bin phpunit install --no-interaction --prefer-dist

.github/workflows/dco.yml

@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: 2026 LibreSign
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
 name: dco
 
 on:
@@ -7,7 +10,29 @@ jobs:
   dco:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: tim-actions/dco@v1
+      - uses: actions/checkout@v6
         with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
+          fetch-depth: 0
+      - name: Validate DCO sign-off in commits
+        run: |
+          set -euo pipefail
+          RANGE="${{ github.event.pull_request.base.sha }}..${{ github.sha }}"
+
+          invalid=0
+          while IFS= read -r sha; do
+            [[ -z "$sha" ]] && continue
+
+            parent_count=$(git rev-list --parents -n1 "$sha" | wc -w)
+            if [[ "$parent_count" -gt 2 ]]; then
+              continue
+            fi
+
+            if ! git log -1 --format=%B "$sha" | grep -qi '^Signed-off-by:'; then
+              echo "Missing Signed-off-by in commit $sha"
+              invalid=1
+            fi
+          done < <(git rev-list "$RANGE")
+
+          if [[ $invalid -ne 0 ]]; then
+            exit 1
+          fi

.github/workflows/dependabot-auto-triage.yml

@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: 2026 LibreSign
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
 name: dependabot-auto-triage
 
 on:
@@ -9,7 +12,7 @@ jobs:
     if: github.actor == 'dependabot[bot]'
     runs-on: ubuntu-latest
     steps:
-      - uses: dependabot/fetch-metadata@v2
+      - uses: dependabot/fetch-metadata@v3
         id: metadata
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/docker.yml

@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: 2026 LibreSign
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
 name: docker
 
 on:
@@ -7,8 +10,8 @@ jobs:
   docker:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Lint Dockerfile
-        run: docker run --rm -i hadolint/hadolint < .docker/Dockerfile
+        run: docker run --rm -i hadolint/hadolint hadolint --failure-threshold error - < .docker/Dockerfile
       - name: Validate compose
         run: docker compose config > /dev/null

.github/workflows/duplication.yml

@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: 2026 LibreSign
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
 name: duplication
 
 on:
@@ -10,10 +13,16 @@ jobs:
     runs-on: ubuntu-latest
     continue-on-error: true
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
+      - name: Detect minimum PHP from composer.json
+        id: php_min
+        run: |
+          php_version=$(grep -Po '"php"\s*:\s*"\K[^"]+' composer.json | grep -Eo '[0-9]+\.[0-9]+' | head -n1)
+          [[ -n "$php_version" ]] || { echo "Could not determine minimum PHP version"; exit 1; }
+          echo "version=$php_version" >> "$GITHUB_OUTPUT"
       - uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.2'
+          php-version: ${{ steps.php_min.outputs.version }}
       - run: composer install --no-interaction --prefer-dist
       - run: composer bin phpcpd install --no-interaction --prefer-dist
       - run: composer run duplication:check

.github/workflows/github-meta.yml

@@ -1,3 +1,6 @@
+# SPDX-FileCopyrightText: 2026 LibreSign
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
 name: github-meta
 
 on:
@@ -7,8 +10,8 @@ jobs:
   github-meta:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: rhysd/actionlint@v1.7.1
+      - uses: actions/checkout@v6
+      - uses: rhysd/actionlint@v1.7.12
       - name: Validate issue templates exist
         run: |
           test -f .github/ISSUE_TEMPLATE/bug_report.yml