request: Add Reusable copyright boilerplate check CI action #1069

Why we need it?

Every Kubeflow repo needs the same Apache 2.0 header check, and right now each one vendors its own copy of boilerplate.py from this repo. That copy immediately drifts — each repo runs its own ruff/lint config over it, so the "downloaded from kubeflow/testing @ " comment stops being verifiable the moment the file lands.

Creating this issue to add a reusable composite action (.github/actions/verify-boilerplate) that runs the boilerplate check against a repo's changed files, so repos can call it directly instead of vendoring and maintaining a divergent script.

Already vendored / being vendored in:

• trainer https://github.com/kubeflow/trainer/blob/master/hack/boilerplate/boilerplate.py
• sdk — in review as part of kubeflow/sdk#765 (tracking kubeflow/sdk#566)
• mcp-server — planning to adopt once this action exists

Source of truth: hack/boilerplate/boilerplate.py in this repo.

Requirement

• Composite action wrapping hack/boilerplate/boilerplate.py, with the script sourced
  from this repo so callers never vendor it.
• Input for the base ref to diff against, defaulting to the PR base branch
  (github.base_ref), so only changed/new files are checked.
• Input for the boilerplate template directory, for repos that keep custom templates.
• Sets up Python itself so callers don't each add a setup-python step.
• Non-zero exit with the existing remediation output on failure.