Merged the v6.5.2.202603 changes ahead of the release

.git-blame-ignore-revs

@@ -0,0 +1,26 @@
+# Commits that changed file headers, copyright lines or version constants across
+# the whole tree. They carry no behavioural change, so `git blame` should look
+# through them to the commit that last touched the code itself.
+#
+# GitHub applies this file automatically. To use it locally, run once:
+#
+#     git config blame.ignoreRevsFile .git-blame-ignore-revs
+#
+# Add a commit here only when it is mechanical and repository-wide. A commit
+# that changes behaviour does not belong in this file, however large it is.
+
+# 2024-01-29  Update copyright.
+# 62 files
+151863ad7c9bc0898649b73853bbcb54c85884e4
+
+# 2026-03-05  Updated copyright headers and removed trailing whitespace
+# 71 files
+b9ba4a97bfb60cfbf1ed49919a135d4595d22275
+
+# 2026-06-06  Added copyright headers to files missing them
+# 10 files
+123218cc51a55adc9b0c3a57e862206a6b8b4432
+
+# 2026-09-15  Normalized the AI disclosure comment to one fixed line per file (#85)
+# 15 files
+a9283d3a81eeb1254ea8a30697a7b61301cef8eb

.github/dependabot.yml

@@ -0,0 +1,7 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    target-branch: dev

.github/workflows/regression_test.yml

@@ -1,25 +1,29 @@
-# This is a basic workflow that is manually triggered
-
 name: regression_test
 
-# Controls when the action will run. Triggers the workflow on push or pull request
-# events but only for the master branch
 on:
   workflow_dispatch:
   push:
-    branches: [ master ]
+    branches: [dev, master]
   pull_request:
-    branches: [ master ]
+    branches: [dev, master]
+
+concurrency:
+  group: levelx-regression-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
-# A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
-  # This workflow contains a single job called "linux_job"
   run_tests:
     permissions:
       contents: read
       issues: read
       checks: write
       pull-requests: write
+      # GitHub validates deployment permissions even when deployment is skipped.
+      # The reusable test job scopes its token separately.
       pages: write
       id-token: write
-    uses: eclipse-threadx/threadx/.github/workflows/regression_template.yml@master
+    uses: eclipse-threadx/threadx/.github/workflows/regression_template.yml@b37cd4a81a1cb8c2ebefc438220ab7f009e13362
+    with:
+      coverage_name: merged
+      coverage_thresholds: '68 100'
+      skip_deploy: ${{ github.ref != 'refs/heads/master' || github.event_name == 'pull_request' }}

.github/workflows/repo_checks.yml

@@ -0,0 +1,63 @@
+###############################################################################
+# Copyright (c) 2026 Eclipse ThreadX contributors
+#
+# This program and the accompanying materials are made available under the
+# terms of the MIT License which is available at
+# https://opensource.org/licenses/MIT.
+#
+# AI Disclosure: This file was largely AI-generated by Claude Code (Opus 5).
+# The AI-generated portions may be considered public domain (CC0-1.0)
+# and not subject to the project's licence. The human contributor has
+# reviewed and verified that the code is correct.
+#
+# SPDX-License-Identifier: MIT and CC0-1.0
+###############################################################################
+
+name: repo_checks
+
+# Repository-wide text checks.
+#
+# THIS LIVES IN ITS OWN WORKFLOW BECAUSE IT MUST NOT BE PATH-FILTERED, and a
+# path filter is a property of a workflow rather than of a job.  The check
+# selects its input with `git ls-files` and scans every tracked file, so any
+# file at all can carry a finding.
+#
+# That is not hypothetical here.  The pass that introduced the fixed
+# disclosure line covered source files only, and the drift it was meant to end
+# survived for months afterwards in CMake files, toolchain files, shell and
+# PowerShell scripts, a GDB script and a Visual Studio manifest -- precisely
+# the files a source-path filter would have skipped.  A workflow that gates no
+# pull request anybody opens is worse than no workflow, because it looks like
+# coverage.
+#
+# Cheap enough that running it on everything costs nothing worth measuring: it
+# is grep over a repository this size, with no toolchain, no build and no
+# cache.
+
+on:
+  # No `paths:` on either trigger, deliberately.  See above.
+  push:
+    branches: [ dev, master ]
+  pull_request:
+    branches: [ dev, master ]
+
+# A second push to the same branch makes the first answer irrelevant.
+concurrency:
+  group: repo-checks-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  checks:
+    runs-on: ubuntu-24.04
+    steps:
+    # Actions are pinned to a commit SHA with the version in the trailing
+    # comment.  A tag can be moved; a SHA cannot, which is what makes "which
+    # code ran in our CI" answerable from the repository.
+    - name: Check out the repository
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+    - name: Check the AI disclosure comments
+      run: scripts/check_ai_disclosure.sh