chore(scripts): standardize copyright headers to canonical 2026 format

[WilliamBerryiii]

Description

This PR standardizes copyright headers across the repository to a single canonical 2026 form and adds tooling so the format stays consistent going forward. The header line # Copyright (c) Microsoft Corporation. becomes # Copyright (c) 2026 Microsoft Corporation. All rights reserved. in 592 files, while the adjacent SPDX-License-Identifier: MIT line is preserved everywhere.

The bulk of the diff is mechanical one-line header swaps. The substantive work is concentrated in three files that make the standardization repeatable and tested.

Tooling and logic

• Added scripts/lib/Modules/CopyrightHeader.psm1, a shared module exposing the canonical copyright and SPDX lines through Get-CanonicalHeaderLines plus header matching and generation helpers. Both validation and repair now read header text from this single source of truth.
• Extended scripts/linting/Test-CopyrightHeaders.ps1 with a -Fix switch that rewrites non-canonical headers and inserts missing ones in place, using the comment prefix appropriate to each file (# for shell, PowerShell, and Python; // for TypeScript). Fix mode is idempotent; the default behavior remains validation-only.
• Replaced the inline $CopyrightPattern and $SpdxPattern constants with the shared module, widened the header detection window from the first 10 lines to the first 15 lines to account for shebang and #Requires preambles, and added plugins to the default excluded paths so generated plugin output is not scanned or rewritten.
• Header placement is directive-aware: shebangs and #Requires directives stay first, and the header block is inserted or rewritten beneath them.

Tests

• Expanded scripts/tests/linting/Test-CopyrightHeaders.Tests.ps1 to cover canonical 2026 validation, guidance alignment via Get-CanonicalHeaderLines, TypeScript // prefixes, fix-mode rewrite and insertion, idempotency, shebang preservation, plugin-output exclusion, and acceptance of 2027 headers during validation while fix mode rewrites them to 2026.

Mechanical header updates

The remaining files are header-only swaps across .github/skills (skill bash and PowerShell scripts and tests), evals/agent-behavior specs, scripts/tests fixtures and Pester files, .github/workflows, docs/docusaurus sources, and smaller groups under scripts/, .devcontainer/scripts, and .github/instructions. The bash and pester instruction example headers were updated to match the new canonical form. Several PowerShell and test files also had a visible BOM artifact removed from before their first directive.

Related Issue(s)

Related to #2157

Type of Change

Select all that apply:

Infrastructure & Configuration:

• Linting configuration (markdown, PowerShell, etc.)

Other:

• Script/automation (.ps1, .sh, .py)

Testing

• npm run validate:copyright: 381 files scanned, 381 with headers, 0 missing, 100% compliance.
• npm run test:ps -- -TestPath "scripts/tests/linting/Test-CopyrightHeaders.Tests.ps1": 55 passed / 0 failed.
• Remaining repository-wide checks (PowerShell analysis, markdown, frontmatter, skills, links, evals, plugin freshness, docs) are deferred to CI for this PR.

Checklist

Required Checks

• Documentation is updated (if applicable)
• Files follow existing naming conventions
• Changes are backwards compatible (if applicable)
• Tests added for new functionality (if applicable)

Required Automated Checks

The following validation commands must pass before merging:

• Markdown linting: npm run lint:md
• Spell checking: npm run spell-check
• Frontmatter validation: npm run lint:frontmatter
• Skill structure validation: npm run validate:skills
• Link validation: npm run lint:md-links
• PowerShell analysis: npm run lint:ps
• Eval spec schema and coverage (if AI artifacts changed): npm run eval:lint:schema
• Plugin freshness: npm run plugin:generate
• Docusaurus tests: npm run docs:test

Security Considerations

• This PR does not contain any sensitive or NDA information
• Any new dependencies have been reviewed for security issues
• Security-related scripts follow the principle of least privilege

Additional Notes

Header changes are text-only and backwards compatible. The new -Fix switch is additive and defaults off, so existing validation-only invocations are unaffected. Repository-wide linters were not run locally for this PR; CI is the gate for those checks.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.24%. Comparing base (44b42d4) to head (70c7b1b).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2169   +/-   ##
=======================================
  Coverage   81.24%   81.24%           
=======================================
  Files         127      127           
  Lines       18831    18831           
  Branches       12       12           
=======================================
  Hits        15300    15300           
  Misses       3528     3528           
  Partials        3        3           

Flag	Coverage Δ
docusaurus	61.84% <ø> (ø)
pytest	77.90% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
...skills/accessibility/accessibility/scripts/scan.py	68.91% <ø> (ø)
...tal/customer-card-render/scripts/generate_cards.py	96.84% <ø> (ø)
...kills/experimental/mural/scripts/mural/__init__.py	81.04% <ø> (ø)
...kills/experimental/mural/scripts/mural/__main__.py	100.00% <ø> (ø)
.../experimental/mural/scripts/mural/_area_helpers.py	47.82% <ø> (ø)
...ills/experimental/mural/scripts/mural/_backends.py	79.45% <ø> (ø)
...ills/experimental/mural/scripts/mural/_cli_auth.py	67.36% <ø> (ø)
...ills/experimental/mural/scripts/mural/_commands.py	76.88% <ø> (ø)
...lls/experimental/mural/scripts/mural/_constants.py	100.00% <ø> (ø)
...s/experimental/mural/scripts/mural/_credentials.py	88.60% <ø> (ø)
... and 72 more

... and 5 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Eval Execution

⚠️ No eval summary was produced.

[katriendg]

Review summary

Thanks for tackling this — the bulk header standardization and the three-file tooling design (shared CopyrightHeader.psm1, idempotent -Fix, directive-aware placement) look solid. Holding off on approval because 3 CI checks are failing, and all three trace to changes in this PR rather than unrelated infra.

1. PowerShell Lint — 46 × PSUseBOMForUnicodeEncodedFile

The BOM removal strips the UTF-8 BOM from .ps1/.psm1 files that contain non-ASCII characters (emoji like ✅ ⚠️ 📄). PSScriptAnalyzer requires a BOM on non-ASCII files, so each one now trips a warning and fails the gate. Repair-FileHeaders also writes BOM-less (Set-Content -Encoding utf8), so fix-mode would re-introduce this on any non-ASCII file it touches.

Suggested fix: restore the BOM on the affected non-ASCII files, and have fix-mode emit utf8BOM when the file content contains non-ASCII characters.

2. PowerShell Tests — new fix-mode test fails

Test-CopyrightHeaders Fix Mode > Excludes plugin files from discovery during fix mode fails on the Linux runner:

Expected 'src/kept.ps1' to be found in collection ... but it was not found.

Looks like a path-normalization / exclude-matching issue on POSIX paths. The new test needs to pass before merge.

3. Eval Validation — generated-spec drift

eval:lint:vally runs Build-AgentBehaviorSpec.ps1 -WhatIf and reports drift. evals/agent-behavior/eval.yaml is banner-marked:

# Generated by Build-AgentBehaviorSpec.ps1 - do not edit by hand.

The header was added to it by hand, but the generator doesn't emit that line, so the committed file no longer matches generator output.

Suggested fix: revert the manual header edit on evals/agent-behavior/eval.yaml and add it (or its directory) to the exclusion list, or update the generator and regenerate. (Schema, text, and safety eval sub-checks all passed.)

Also worth a sweep

• Generated-file handling is inconsistent: plugins/ was excluded, but the generated eval.yaml was still edited (cause of #3). Worth checking for other "do not edit by hand" artifacts.
• The "Required Automated Checks" in the PR description are all unchecked, with repo-wide linters deferred to CI — and CI is now red on three of them.

Once the BOM handling, the failing fix-mode test, and the generated eval.yaml are sorted and CI is green, this should be good to go.