Merge branch 'main' into fix/issue-common-math

Author: Emelie-Dev

.github/ISSUE_TEMPLATE/security_disclosure.md

@@ -0,0 +1,37 @@
+---
+name: Security disclosure
+about: Report a security vulnerability privately
+title: '[SECURITY] '
+labels: 'security'
+assignees: ''
+
+---
+
+> **⚠️ Do not use this template for public vulnerability reports.**
+> Email security@quantara.protocol instead. This template is for maintainer use
+> when triaging disclosed vulnerabilities.
+
+**Severity**
+<!-- Critical / High / Medium / Low -->
+
+**Component**
+<!-- Soroban contracts / FastAPI backend / React frontend / CI pipeline -->
+
+**Vulnerability type**
+<!-- e.g., auth bypass, injection, IDOR, reentrancy, XSS, secret leakage -->
+
+**Description**
+<!-- Brief description of the vulnerability and its impact. -->
+
+**Steps to reproduce**
+1. ...
+2. ...
+
+**Suggested fix (if any)**
+<!-- Optional. A proposed mitigation or patch. -->
+
+**Disclosure timeline**
+- Report received:
+- Assessment complete:
+- Fix deployed:
+- Public disclosure:

.github/workflows/bandit.yml

@@ -0,0 +1,46 @@
+name: "Bandit Security Scan"
+
+on:
+  push:
+    branches: [ "main", "develop" ]
+  pull_request:
+    branches: [ "main", "develop" ]
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  bandit:
+    name: Bandit Scan
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout Repository
+      uses: actions/checkout@v4
+
+    - name: Set up Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: '3.10'
+
+    # bandit-sarif-formatter is required to successfully output the .sarif format
+    - name: Install Bandit and Dependencies
+      run: |
+        pip install bandit bandit-sarif-formatter
+
+    # Added an explicit check to make sure the file exists before running the upload step
+    - name: Run Bandit Scan
+      run: |
+        bandit -r . -f sarif -o bandit-results.sarif || true
+        if [ ! -f bandit-results.sarif ]; then
+          echo "Bandit failed to generate SARIF output. Creating an empty fallback report."
+          echo '{"$schema":"https://schemastore.azurewebsites.net/schemas/json/sarif-2.1.0-rtm.5.json","version":"2.1.0","runs":[]}' > bandit-results.sarif
+        fi
+
+    # Upgraded action from v3 to v4 to fix the runner deprecation warning shown in your logs
+    - name: Upload Bandit Scan Results to GitHub Security
+      uses: github/codeql-action/upload-sarif@v4
+      with:
+        sarif_file: bandit-results.sarif
+        category: bandit

.github/workflows/ci.yml

@@ -24,10 +24,16 @@ on:
 
 jobs:
   test:
+    name: Test Suite (Python ${{ matrix.python-version }})
     runs-on: ubuntu-latest
     permissions:
       contents: read
 
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.12", "3.13"]
+
     services:
       postgres:
         image: postgres:16
@@ -55,12 +61,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4
 
-      - name: Set up Python
-        uses: actions/setup-python@v6
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
         with:
-          python-version: "3.12"
+          python-version: ${{ matrix.python-version }}
           cache: 'pip'
 
       - name: Install Poetry
@@ -87,4 +93,12 @@ jobs:
       - name: Run tests
         working-directory: ./quantara
         run: |
-          poetry run pytest web_app/tests -v --tb=short
+          poetry run pytest web_app/tests -v --tb=short --cov-fail-under=80
+
+      - name: Upload coverage report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage-report
+          path: quantara/coverage.xml
+          retention-days: 14

.github/workflows/codeql.yml

@@ -0,0 +1,50 @@
+name: "CodeQL SAST Analysis"
+
+on:
+  push:
+    branches: [ "main", "develop" ]
+  pull_request:
+    branches: [ "main", "develop" ]
+  schedule:
+    - cron: '30 4 * * 6' # Runs every Saturday at 04:30 UTC
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: CodeQL Scan
+    runs-on: ubuntu-latest
+    timeout-minutes: 360
+
+    strategy:
+      fail-fast: false
+      matrix:
+        # CodeQL supports: 'cpp', 'csharp', 'go', 'java-bytecode', 'javascript-typescript', 'python', 'ruby', 'swift'
+        # Adjust languages based on your repository stack (e.g., python, javascript-typescript)
+        language: [ 'python', 'javascript-typescript' ]
+
+    steps:
+    - name: Checkout Repository
+      uses: actions/checkout@v4
+
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v3
+      with:
+        languages: ${{ matrix.language }}
+        queries: security-extended,security-and-quality
+
+    # Autobuild attempts to build any compiled languages if present
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@v3
+
+    # If Autobuild fails, uncomment and adjust manual build steps for compiled languages:
+    # - run: |
+    #     make build
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v3
+      with:
+        category: "/language:${{matrix.language}}"

.github/workflows/docs-check.yml

@@ -0,0 +1,45 @@
+name: Docs Check
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - '*.md'
+      - '.github/**/*.md'
+      - '.github/**/*.yml'
+
+jobs:
+  docs:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Validate issue template frontmatter
+        run: |
+          failed=0
+          for f in .github/ISSUE_TEMPLATE/*.md; do
+            if ! head -1 "$f" | grep -q '^---'; then
+              echo "::error file=$f::Missing YAML frontmatter (must start with ---)"
+              failed=1
+            fi
+          done
+          if [ "$failed" -eq 1 ]; then exit 1; fi
+          echo "All issue templates have valid frontmatter."
+
+      - name: Check required sections in SECURITY.md
+        run: |
+          for section in "Reporting a Vulnerability" "Response SLA" "Bounty Scope" "Responsible Disclosure"; do
+            if ! grep -q "## $section" SECURITY.md; then
+              echo "::error file=SECURITY.md::Missing required section: $section"
+              exit 1
+            fi
+          done
+          echo "SECURITY.md has all required sections."

.github/workflows/release-please.yml

@@ -0,0 +1,18 @@
+name: Release Please
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: googleapis/release-please-action@v4
+        with:
+          release-type: simple