Infra: Add community workflows, compliance automation, and dependency review

[sfc-gh-swalia]

Summary

Adding community management workflows and compliance automation to bring GitHub infra in line with other ASF projects (modeled on Apache Iceberg's approach).

Compliance:

• Dependency license scanning on every PR - it blocks ASF Category X licenses (GPL, LGPL, AGPL, SSPL, EUPL) before merge
• Added Apache RAT integration for automated license header checks (prevents recurrence of the manual cleanup done in Add missing ASF header #242)
• ASF GitHub Actions allowlist verification ( now catches workflows that silently fail on apache/* repos)
• PR template updated with NOTICE/LICENSE obligation reminder for vendor code

Community management:

• Auto-label new issues needs-triage
• Path-based PR labeling with sync-labels (wildcard catch-all for converters/** + specific per-converter labels)
• First-time contributor welcome bot with ICLA reminder and Slack link
• Label state machine: awaiting-response flips to needs-review when author responds
• Stale issue/PR management (90-day issues, 60-day PRs — only targets items labeled awaiting-response, exempts anything assigned or milestoned)

Governance:

• PR title format enforcement (Area: Description) for clean squash-merge history
• Dependabot for GitHub Actions (weekly version updates, grouped)

All workflows include the ASF license header and are guarded with if: github.repository_owner == 'apache' so they do not fire on contributor forks.

Note: The labels referenced by these workflows (needs-triage, awaiting-response, needs-review, stale, converter/*, etc.) do not exist yet — GitHub creates them automatically on first use.

Checklist

Compliance

• ASF license headers are present on all new source files
• No third-party dependencies are added without PMC/IPMC approval

[jbonofre]

@sfc-gh-swalia Thanks for that! I will do the review. I saw some changes that are not required now and also to be clarified for release.

[jbonofre]

Can you please disclose any AI tool assistance?

[sfc-gh-swalia]

Can you please disclose any AI tool assistance?

Hey @jbonofre - Yes - I used Claude Opus 4.6 assistance for this PR. Primarily used it for researching ASF compliance patterns across workflow infrastructure, drafting workflow YAML andd validating configurations. I reviewed and validated the code before committing.

I propose we make AI tool disclosure a standard part of our contribution process i.e. a simple optional note in the PR template and a brief section in CONTRIBUTING.md. This keeps us transparent and aligned. Happy to include that in
this PR if people are on board.

[sfc-gh-swalia]

Can you please disclose any AI tool assistance?

@jbonofre #259 - I added this PR asking contributors to disclose AI usage