ci: update canonical lint configs from org-wide rollout retrospective

.editorconfig

@@ -14,8 +14,18 @@ indent_size = 4
 [*.{rs,go}]
 indent_size = 4
 
+[*.{kt,kts}]
+indent_size = 4
+
+[*.java]
+indent_size = 4
+
 [*.md]
 trim_trailing_whitespace = false
+indent_size = unset
+
+[LICENSE]
+indent_size = unset
 
 [Makefile]
 indent_style = tab

.git-blame-ignore-revs

@@ -0,0 +1,3 @@
+# style: auto-fix markdown formatting and fix broken table
+# Mass formatting. No logic changes.
+33fb67d62513845ee758ed176dd6749c390f118f

.markdownlint-cli2.yaml

@@ -0,0 +1,12 @@
+# markdownlint-cli2 configuration — canonical Identus baseline
+# https://github.com/DavidAnson/markdownlint-cli2
+#
+# Repos should prepend this baseline and append repo-specific ignores.
+
+# Ignore patterns (common across all repos)
+ignores:
+  - ".claude/**"
+  - "**/node_modules/**"
+  - "**/target/**"
+  - "**/build/**"
+  - "CHANGELOG.md"

.markdownlint.yml

@@ -1,17 +1,61 @@
-# markdownlint configuration
+# markdownlint configuration — canonical Identus baseline
 # https://github.com/DavidAnson/markdownlint/blob/main/doc/Rules.md
+#
+# Repos may append additional relaxations below this baseline.
+# Rules disabled here were needed in 5+ repos during the org-wide rollout.
 
 default: true
 
 # Allow long lines (common in tables, URLs, and generated content)
 MD013: false
 
-# Allow multiple top-level headings (common in multi-section docs)
+# Allow heading increment jumps (h1 → h3)
+MD001: false
+
+# Allow duplicate headings (common in multi-section docs)
+MD024: false
+
+# Allow multiple top-level headings
 MD025: false
 
-# Allow inline HTML (needed for badges, details/summary, etc.)
+# Allow any ordered list numbering style
+MD029: false
+
+# Allow inline HTML (needed for badges, details/summary, admonitions)
 MD033: false
 
-# Allow duplicate headings in different sections
-MD024:
-  siblings_only: true
+# Allow bare URLs
+MD034: false
+
+# Allow emphasis used as headings
+MD036: false
+
+# Allow code blocks without language specifier
+MD040: false
+
+# Allow first line to not be a heading (centered logos in READMEs)
+MD041: false
+
+# Allow any heading style (atx and setext)
+MD003: false
+
+# Allow any list style (dash, asterisk, plus)
+MD004: false
+
+# Allow inconsistent list indentation
+MD005: false
+
+# Allow any list indentation
+MD007: false
+
+# Allow trailing punctuation in headings
+MD026: false
+
+# Allow link fragments that don't match headings (common with HTML anchors)
+MD051: false
+
+# Allow non-descriptive link text like "[here]"
+MD059: false
+
+# Allow compact and misaligned table styles
+MD060: false

.yamllint.yml

@@ -1,4 +1,9 @@
 ---
+# yamllint configuration — canonical Identus baseline
+#
+# Repos may append additional relaxations or ignore patterns below.
+# Rules here were needed in 7+ repos during the org-wide rollout.
+
 extends: default
 
 rules:
@@ -11,3 +16,27 @@ rules:
 
   # Relaxed comment indentation
   comments-indentation: disable
+
+  # Don't require document start marker (---)
+  document-start: disable
+
+  # Relaxed bracket/brace spacing (common in Docker Compose port mappings)
+  brackets:
+    min-spaces-inside: 0
+    max-spaces-inside: 1
+  braces:
+    min-spaces-inside: 0
+    max-spaces-inside: 1
+
+  # Allow 1 space before inline comments
+  comments:
+    min-spaces-from-content: 1
+
+  # Relaxed indentation (k8s manifests, Helm charts use various styles)
+  indentation:
+    spaces: consistent
+    indent-sequences: whatever
+
+  # Allow trailing blank line at end of file
+  empty-lines:
+    max-end: 1

DCO.md

@@ -3,6 +3,7 @@
 Identus requires all contributions to acknowledge the Developer Certificate of Origin (DCO) and be signed with a PGP key. These measures protect the project's integrity and ensure that everyone involved understands the code's origin and licensing.
 
 ## Table Of Contents
+
   - [DCO](#dco)
     - [How to sign-off](#how-to-sign-off)
     - [Setting up your signoff](#setting-up-your-signoff)
@@ -12,7 +13,6 @@ Identus requires all contributions to acknowledge the Developer Certificate of O
     - [Setting up PGP](#setting-up-pgp)
     - [Troubleshooting](#troubleshooting)
 
-
 ## DCO
 
 The DCO is a way to confirm that you are able to submit your contribution to our repository under the license of the repository, and for the contribution to be redistributed under that same license. By adding a "Signed-off-by" line to your commit messages, you acknowledge the following:
@@ -51,7 +51,7 @@ Add a line like this to each commit message in your pull request:
 
 ```text
 Signed-off-by: Your Legal Name <email-address>
-``` 
+```
 
 The text can either be manually added to your commit body, or you can add either `-s` or `--signoff` to your usual git commit commands.
 
@@ -95,7 +95,7 @@ If you've pushed your changes to GitHub already you'll need to force push your b
 
 ### DCO Failures
 
-The project uses a DCO bot for all GitHub pulls to verify that each commit is signed off. When you create your pull request, it will automatically be verified by this bot. 
+The project uses a DCO bot for all GitHub pulls to verify that each commit is signed off. When you create your pull request, it will automatically be verified by this bot.
 
 If your Pull Request fails the DCO check, it's necessary to fix the entire commit history in the PR. Although this is a situation we'd like to avoid the best practice is to squash the commit history to a single commit, append the DCO sign-off as described above or interactively in the rebase comment editing process, and force push. For example, if you have 2 commits in your history (Note the ~2):
 
@@ -112,6 +112,7 @@ git push origin --force
 PGP (Pretty Good Privacy) is a method for encrypting and signing data. By signing your commits with PGP, you add another layer of security and verification.
 
 ### Setting up PGP
+
 1. Install gnupg
     * Linux: `sudo apt-get install gnupg`
     * Mac: `brew install gnupg`
@@ -120,24 +121,31 @@ PGP (Pretty Good Privacy) is a method for encrypting and signing data. By signin
 2. Generating a key
 
     In case you've already generated your PGP key pair before, you need to import a private key
+
     ```bash
     gpg --import private.key
     ```
+
     If you have not generated your PGP key pair yet
+
     ```bash
     gpg --full-generate-key
     ```
+
     and follow the instructions, make sure to associate this key with your email address. For key size, choose 4096
 
 3. Using the key
 
     * **Local setup**: Set up git to automatically sign every commit with your PGP key, first get your GPG key id
+
       ```bash
       gpg --list-keys
       ```
+
       will list all the keys you have available. copy the id of the key associated with your email address.
 
       configure git to use this key to sign every commit automatically
+
       ```bash
       git config user.signingkey <your key id here> && 
       git config commit.gpgsign true
@@ -146,24 +154,30 @@ PGP (Pretty Good Privacy) is a method for encrypting and signing data. By signin
       ```
 
     * **Remote setup**: You need to add the public key to Github, so that it can verify commits signed by the associated private key. Export your public key:
+
       ```bash
       gpg --armor --export firstname.lastname@example.com
       ```
+
       This will output the key into your terminal. Copy the whole key (including -----BEGIN PGP PUBLIC KEY BLOCK----- and -----END PGP     PUBLIC KEY BLOCK----- part) and add it [into your account](https://github.com/settings/keys)
 
       *NOTE:* Make sure to add your email address into [your github account emails](https://github.com/settings/emails) and confirm it. Github will allow you to add public keys associated with any email, but if this email is not added into your emails, it assumes that you are not the owner of this email address, and even if commits are signed with a proper private key, they will not be verified.
 
 ### Troubleshooting
 
 In case commiting a change fails with the message
+
 ```bash
 error: gpg failed to sign the data
 fatal: failed to write commit object
 ```
+
 try the following
+
 ```bash
 gpgconf --kill gpg-agent
 export GPG_TTY=$(tty)
 echo "test" | gpg --clearsign
 ```
+
 if this problem keeps happening, try adding `export GPG_TTY=$(tty)` into your `~/.bashrc` or `~/.zshrc` file.

MAINTAINERS.md

@@ -30,8 +30,8 @@ Maintainers are assigned the following scopes in this repository:
 | Name | GitHub ID | Scope | LFID | Discord ID | Email | Company Affiliation |
 |----- | --------- | ----- | ---- | ---------- | ----- | ------------------- |
 | Anton Baliasnikov | antonbaliasnikov | Maintainer | | | | |
-| Ahmed Moussa      | hamada147        | Maintainer | | | | |   
-| Timothy Wells      | blockchaintimothy | Maintainer |  | timw_01400 |  |  | 
+| Ahmed Moussa      | hamada147        | Maintainer | | | | |
+| Timothy Wells      | blockchaintimothy | Maintainer |  | timw_01400 |  |  |
 | Cristian Gonzalez  | cristianIOHK | Maintainer |       | chet_to            |  |  |
 | Dale Peek          | Dale-iohk | Maintainer |          | dale.doe           |  |  |
 | Bassam Riman       | CryptoKnightIOG | Maintainer |    | _                  |  |  |
@@ -48,7 +48,6 @@ Maintainers are assigned the following scopes in this repository:
 | Shota Jolbordi     | shotexa | Maintainer |            | xesus1337          |  |  |
 | Kranium Mendoza    | womfoo  | Maintainer |            | kraniumau          |  |  |
 
-
 ## The Duties of a Maintainer
 
 The expectation is for maintainers to perform the following duties for this repository. The responsibilities listed are in high to low-priority order:
@@ -96,7 +95,7 @@ A PR has been created to update this file and add the proposed maintainer to the
 
 ## Removing Maintainers
 
-Being a maintainer is not a status symbol or a title or indefinite. 
+Being a maintainer is not a status symbol or a title or indefinite.
 Moving the maintainer to emeritus status will occasionally be necessary and appropriate.
 The status change can occur in the following situations:
 
@@ -117,9 +116,9 @@ resignation, the Pull Request is mergeable following a maintainer PR approval. I
 - The PR is authored by or has a comment supporting the proposal from an existing maintainer or Hyperledger GitHub organization administrator.
 - The approval timeframe begins upon receipt of the PR and necessary comments.
 - The PR **MAY** be communicated on appropriate channels, including relevant community calls, chat channels, and mailing lists.
-- The PR gets merged, and the maintainer transitions to maintainer emeritus if: 
-  - The PR gets approval from the maintainer to transition, OR 
-  - Two weeks have passed since receipt of at least three (3) Maintainer PR approvals, OR 
+- The PR gets merged, and the maintainer transitions to maintainer emeritus if:
+  - The PR gets approval from the maintainer to transition, OR
+  - Two weeks have passed since receipt of at least three (3) Maintainer PR approvals, OR
   - An absolute majority of maintainers have approved the PR.
 - It may be closed if the PR does not get the requisite PR approvals.
 

profile/README.md

@@ -1,5 +1,6 @@
 ![Identus](../resources/images/hyperledger-identus.svg)
 ---
+
 Identus provides components to develop decentralized identity solutions that adhere to widely recognized self-sovereign identity (SSI) standards.  It offers complete DID and verifiable credential functionality and simplifies the complexities of adopting a decentralized identity solution into existing and new workflows.
 
 ## Community Projects
@@ -29,15 +30,15 @@ Identus provides components to develop decentralized identity solutions that adh
 </picture>
 </a>
 
-
 ## Quick Start Guide and Documentation
 
 To quickly get up and running and explore the project's capabilities:
+
 - Follow the instructions in 💻 [dockerize-identus.md](https://github.com/hyperledger-identus/hyperledger-identus/blob/main/identus-docker/dockerize-identus.md) to have a local environment up and running.
 - Try the ⚡[Quick Start Guide](https://hyperledger-identus.github.io/docs/home/quick-start/) to explore the capabilities of Identus step by step.
 - Find more details about any topic you need by reading the project's 📄 [Documentation](https://hyperledger-identus.github.io/docs/).
 
-## Project Roadmap 
+## Project Roadmap
 
 Are you interested in where Identus is headed? Check out the 🛣️[Project Roadmap](https://github.com/orgs/hyperledger-identus/projects/2) for upcoming features and planned improvements.
 
@@ -48,12 +49,12 @@ Identus consists of several core components, each one with its own repository. T
 - [Cloud Agent](https://github.com/hyperledger/identus-cloud-agent/)
 - [Mediator](https://github.com/hyperledger/identus-mediator/)
 - Edge Agent SDKs:
-  - [TypeScript](https://github.com/hyperledger/identus-edge-agent-sdk-ts/) 
+  - [TypeScript](https://github.com/hyperledger/identus-edge-agent-sdk-ts/)
   - [KMP](https://github.com/hyperledger/identus-edge-agent-sdk-kmp/)
   - [Swift](https://github.com/hyperledger/identus-edge-agent-sdk-swift/)
 - [Apollo Cryptographic Library](https://github.com/hyperledger/identus-apollo/)
 - Verifiable Data Registry (VDR):
-  - [VDR system API](https://github.com/hyperledger-identus/vdr) 
+  - [VDR system API](https://github.com/hyperledger-identus/vdr)
   - [PRISM VDR](https://github.com/hyperledger-identus/prism-vdr-driver)
 - [Documentation](https://github.com/hyperledger/identus-docs/)
 
@@ -65,7 +66,7 @@ The development of Identus relies on community input, and the project maintainer
 
  - 🪲 **Bugs:** Head to the relevant [GitHub repository](https://github.com/hyperledger-identus/hyperledger-identus/blob/main/README.md#repositories) and open an issue in the issue tracker. Detailed reports make fixing things much faster!
 
- - 📝 **Documentation mistakes:** Please report it [here](https://github.com/hyperledger-identus/docs/issues). 
+ - 📝 **Documentation mistakes:** Please report it [here](https://github.com/hyperledger-identus/docs/issues).
 
  - 💡 **Feature Requests:** Do you know how to improve Identus? Share your suggestion in an [issue](https://github.com/hyperledger-identus/hyperledger-identus/issues/new/choose), and we'll discuss how it could fit into the project's roadmap.  
 
@@ -85,4 +86,4 @@ The development of Identus relies on community input, and the project maintainer
 
 ### Community projects
 
-Are you curious about what the community is building with Identus? Explore the 🌍[Community Projects](https://github.com/hyperledger-identus/hyperledger-identus/wiki/Community-Projects) to discover a variety of initiatives and tools created by developers and contributors like you. These projects showcase the versatility of Identus and can serve as inspiration or a foundation for your work. 
+Are you curious about what the community is building with Identus? Explore the 🌍[Community Projects](https://github.com/hyperledger-identus/hyperledger-identus/wiki/Community-Projects) to discover a variety of initiatives and tools created by developers and contributors like you. These projects showcase the versatility of Identus and can serve as inspiration or a foundation for your work.

scripts/check-file-hygiene.py

@@ -26,7 +26,7 @@
 
 ORG = "hyperledger-identus"
 TEMPLATE_REPO = ".github"
-FILES = [".gitattributes", ".editorconfig", ".markdownlint.yml", ".yamllint.yml"]
+FILES = [".gitattributes", ".editorconfig", ".markdownlint.yml", ".markdownlint-cli2.yaml", ".yamllint.yml"]
 
 # Repos to skip (the template repo itself)
 SKIP_REPOS = {TEMPLATE_REPO}