chore(ci): add PR lint workflow and SPDX header pre-commit hook (#60)

Add pr-lint.yml to enforce conventional commit PR titles and run
check-license-headers.sh on all tracked Rust, shell, and Dockerfile
sources. Add scripts/check-license-headers.sh and opt-in .githooks/pre-commit
(cargo fmt + staged header check). Apply AMD Apache-2.0 SPDX headers across
the codebase so the new checks pass.

Author: sgopinath1

.githooks/pre-commit

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+#
+# Pre-commit checks:
+#   1. cargo fmt --check
+#   2. SPDX license headers on staged source files
+#
+# Bypass with: git commit --no-verify
+
+if command -v cargo >/dev/null 2>&1; then
+  if ! cargo fmt --all --check 2>/dev/null; then
+    echo "pre-commit: cargo fmt found unformatted code."
+    echo ""
+    echo "  Run: cargo fmt --all"
+    echo "  Bypass with: git commit --no-verify"
+    exit 1
+  fi
+fi
+
+# Check SPDX license headers on staged source files
+mapfile -t staged < <(
+    git diff --cached --name-only --diff-filter=d -- '*.rs' '*.proto' '*.py' '*.sh' '**/Dockerfile*'
+)
+
+if [ ${#staged[@]} -gt 0 ]; then
+  REPO_ROOT="$(git rev-parse --show-toplevel)"
+  "$REPO_ROOT/scripts/check-license-headers.sh" "${staged[@]}" || exit 1
+fi

.github/workflows/pr-lint.yml

@@ -0,0 +1,37 @@
+name: PR Lint
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize]
+
+permissions:
+  contents: read
+
+jobs:
+  validate-pr-title:
+    runs-on: ubuntu-latest
+    env:
+      PATTERN: "^(feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert)(\\([a-zA-Z0-9_-]+\\))?!?: .+$"
+
+    steps:
+      - name: Validate PR title
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+        run: |
+          echo "Checking PR title: '$PR_TITLE'"
+          if ! echo "$PR_TITLE" | grep -Eq "$PATTERN"; then
+            echo "FAIL: PR title does not match conventional commits format."
+            echo "Expected: type(scope): description  (e.g. 'feat(spur-cloud-api): add session API')"
+            echo "Valid types: feat fix docs style refactor perf test build ci chore revert"
+            exit 1
+          fi
+          echo "PASS: PR title is valid."
+
+  license-headers:
+    name: SPDX License Headers
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Check SPDX license headers
+        run: ./scripts/check-license-headers.sh

crates/spur-cloud-api/src/auth/github.rs

@@ -1,3 +1,6 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 use axum::{
     extract::{Query, State},
     http::StatusCode,

crates/spur-cloud-api/src/auth/jwt.rs

@@ -1,3 +1,6 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 use chrono::{Duration, Utc};
 use jsonwebtoken::{decode, encode, DecodingKey, EncodingKey, Header, Validation};
 use serde::{Deserialize, Serialize};

crates/spur-cloud-api/src/auth/middleware.rs

@@ -1,3 +1,6 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 use axum::{
     extract::{Request, State},
     http::StatusCode,

crates/spur-cloud-api/src/auth/mod.rs

@@ -1,3 +1,6 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 pub mod github;
 pub mod jwt;
 pub mod middleware;

crates/spur-cloud-api/src/auth/oidc_common.rs

@@ -1,3 +1,6 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 use axum::http::HeaderMap;
 use serde::Deserialize;
 use tracing::debug;

crates/spur-cloud-api/src/auth/okta.rs

@@ -1,3 +1,6 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 use axum::{
     extract::{Query, State},
     http::StatusCode,

crates/spur-cloud-api/src/auth/principal.rs

@@ -1,3 +1,6 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 use uuid::Uuid;
 
 /// Authenticated caller normalized at the application boundary.

crates/spur-cloud-api/src/config.rs

@@ -1,3 +1,6 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 use serde::Deserialize;
 
 #[derive(Debug, Clone, Deserialize, Default, PartialEq)]