[COMPLIANCE] Add/Update Copyright Headers

.changes/unreleased/BUG FIXES-20260729-114501.yaml

@@ -1,3 +1,6 @@
+# Copyright IBM Corp. 2026
+# SPDX-License-Identifier: MPL-2.0
+
 kind: BUG FIXES
 body: "Delete permissions now resolve correctly for resources with non-standard API paths (e.g. `explorer-saved-queries`, `run-tasks`)"
 time: 2026-07-29T11:45:01.000000-06:00

.changes/unreleased/BUG FIXES-20260806-170000.yaml

@@ -1,3 +1,6 @@
+# Copyright IBM Corp. 2026
+# SPDX-License-Identifier: MPL-2.0
+
 kind: BUG FIXES
 body: "Credentials returned by the API are no longer printed. A created token, and the `hosted-state-download-url` and `hosted-json-state-download-url` of a state version, which grant access to state without a token, were rendered in every output format including `--json` and `--jq`. `--dry-run` echoed the request body and headers, so previewing a sensitive variable printed the value being set"
 time: 2026-08-06T17:00:00.000000-04:00

.changes/unreleased/BUG FIXES-20260820-083800.yaml

@@ -1,3 +1,6 @@
+# Copyright IBM Corp. 2026
+# SPDX-License-Identifier: MPL-2.0
+
 kind: BUG FIXES
 body: "Fixed a gap in the output masking added in #101: CopyRaw only attempted to parse and mask a raw response body when its Content-Type was application/json (or ended in +json). At least one Terraform Enterprise endpoint (plan JSON export) serves valid JSON labeled application/octet-stream, so its response bypassed masking entirely. A body labeled application/octet-stream is now peeked at, without buffering it, to check whether it opens with a JSON object or array before deciding whether to mask it, so this content type is no longer treated as a blanket mask candidate: genuinely binary or large bodies served under the same label, such as state archives and plan or apply logs, are streamed through exactly as before"
 time: 2026-08-20T08:38:00.000000-04:00

.changes/unreleased/ENHANCEMENTS-20260717-015613.yaml

@@ -1,3 +1,6 @@
+# Copyright IBM Corp. 2026
+# SPDX-License-Identifier: MPL-2.0
+
 kind: ENHANCEMENTS
 body: '`tfctl auth status` now explains why authentication failed instead of printing a bare "Unauthorized". It distinguishes a missing token, a token the server rejected (401), and a request that never reached the server, and prints the matching remedy. On SSO-protected Terraform Enterprise the 401 message also calls out a lapsed browser SSO session. JSON and agent output gain a machine-readable `reason` field.'
 time: 2026-07-17T01:56:13-04:00

.changes/unreleased/ENHANCEMENTS-20260717-023923.yaml

@@ -1,3 +1,6 @@
+# Copyright IBM Corp. 2026
+# SPDX-License-Identifier: MPL-2.0
+
 kind: ENHANCEMENTS
 body: '`run start` now accepts `--wait`, which blocks until the run reaches a terminal state, streaming each status transition and exiting non-zero if the run fails, is canceled, is discarded, or fails a mandatory policy. A run whose plan finishes but needs a manual apply (auto-apply disabled) stops instead of hanging. `--timeout` bounds how long to wait; if it elapses, tfctl stops watching and exits non-zero while the run continues in HCP Terraform. On completion the run URL is printed. `run status` now surfaces the same run URL as well.'
 time: 2026-07-17T02:39:23-04:00

.changes/unreleased/ENHANCEMENTS-20260806-170001.yaml

@@ -1,3 +1,6 @@
+# Copyright IBM Corp. 2026
+# SPDX-License-Identifier: MPL-2.0
+
 kind: ENHANCEMENTS
 body: "Added a `redact` profile property and a `TFCTL_REDACT` environment variable to control masking of sensitive values in output, with modes `strict` (the default), `known`, and `off`, plus a `--no-redact` global flag to show masked values for a single command"
 time: 2026-08-06T17:00:01.000000-04:00

.changes/unreleased/ENHANCEMENTS-20260819-161936.yaml

@@ -1,3 +1,6 @@
+# Copyright IBM Corp. 2026
+# SPDX-License-Identifier: MPL-2.0
+
 kind: ENHANCEMENTS
 body: "Added a `-r name=id` flag to `api` and `create` for setting JSON:API relationships without a full request body. The relationship's linkage type is inferred from the schema (e.g. `-r project=prj-...` links to type `projects`); ambiguous or unknown relationships can be pinned with `-r name:type=id`, and to-many relationships accept comma-separated ids"
 time: 2026-08-19T16:19:36.000000-04:00

.changes/unreleased/NOTES-20260806-170002.yaml

@@ -1,3 +1,6 @@
+# Copyright IBM Corp. 2026
+# SPDX-License-Identifier: MPL-2.0
+
 kind: NOTES
 body: 'Sensitive values in command output are now masked by default. A script that reads a state version download URL, or a newly created token, out of `tfctl` output will see `(redacted)` until it passes `--no-redact` or sets `redact = "off"` in its profile'
 time: 2026-08-06T17:00:02.000000-04:00

.github/dependabot.yml

@@ -5,10 +5,6 @@ updates:
   - package-ecosystem: "docker"
     open-pull-requests-limit: 1
     directory: "/"
-    cooldown:
-      semver-major-days: 14
-      semver-minor-days: 7
-      semver-patch-days: 3
     schedule:
       interval: "weekly"
     labels:
@@ -18,10 +14,6 @@ updates:
   - package-ecosystem: "github-actions"
     open-pull-requests-limit: 3
     directory: "/"
-    cooldown:
-      semver-major-days: 14
-      semver-minor-days: 7
-      semver-patch-days: 3
     schedule:
       interval: "weekly"
     labels:

internal/pkg/checkpoint/checkpoint.go

@@ -1,3 +1,6 @@
+// Copyright IBM Corp. 2026
+// SPDX-License-Identifier: MPL-2.0
+
 // Package checkpoint provides functionality for interacting with HashiCorp's
 // Checkpoint service to check for new versions and alerts related to the
 // current version of the CLI.

scripts/setup.sh

@@ -1,4 +1,7 @@
 #! /usr/bin/env bash
+# Copyright IBM Corp. 2026
+# SPDX-License-Identifier: MPL-2.0
+
 
 set -e
 

skills/existing.go

@@ -1,3 +1,6 @@
+// Copyright IBM Corp. 2026
+// SPDX-License-Identifier: MPL-2.0
+
 package skills
 
 import (

skills/migrate.go

@@ -1,3 +1,6 @@
+// Copyright IBM Corp. 2026
+// SPDX-License-Identifier: MPL-2.0
+
 package skills
 
 import (