Add repository hardening files (#14)

* Added repository hardening files

* Remove Travis CI configuration

Author: vnovitskyi

.github/CODEOWNERS

@@ -0,0 +1,6 @@
+# Reviews are required by
+#
+# - @pennylane-hq/transactions-hub as main usage of this gem is for transactions-hub,
+# maintained by this squad
+
+* @pennylane-hq/transactions-hub

.github/RECOMMENDED_CODEOWNERS

@@ -0,0 +1,5 @@
+# It is recommended to receive reviews from
+#
+# - @pennylane-hq/security as this gem handles financial data parsing and should be modified carefully
+
+* @pennylane-hq/security

.github/workflows/ci.yml

@@ -0,0 +1,34 @@
+name: Ruby
+
+on:
+  - push
+  - pull_request
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        ruby: [3.3, head]
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ${{ matrix.ruby }}
+          bundler-cache: true
+      - name: Run tests
+        run: bundle exec rspec
+
+  summary:
+    name: CI Summary
+    runs-on: ubuntu-latest
+    needs:
+      - test
+    if: always()
+
+    steps:
+      - name: Successful builds?
+        run: |
+          if ${{ needs.test.result != 'success' }}; then exit 1; fi

.github/workflows/config.yml

@@ -0,0 +1,39 @@
+repos:
+  - repo: local
+    hooks:
+      - id: do_not_commit
+        name: Break on DO NOT COMMIT comment
+        language: pygrep
+        entry: (?i)(NOT.{,3}COMMIT)
+        exclude: (?x)(.pre-commit-config.yaml)$
+      - id: rubocop
+        name: Rubocop
+        language: system
+        entry: bundle exec rubocop
+        require_serial: true # for proper cache behavior
+        files: (?x)(
+          \.(rb|rake)$|Gemfile$|Rakefile|.irbrc$)
+        args:
+          - --autocorrect
+          - --color
+          - --server
+          - --config=.rubocop.yml
+      - id: encrypted_ssh_keys
+        name: Encrypted SSH keys
+        language: system
+        entry: .pre-commit/check_ssh_keys_passphrase.sh
+        pass_filenames: false
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.0.1
+    hooks:
+      - id: trailing-whitespace
+
+  - repo: https://github.com/tdeo/pre-commit-hooks
+    rev: v4.0.1
+    hooks:
+      - id: end-of-file-fixer
+
+  - repo: https://github.com/pennylane-hq/pre-commit-hooks
+    rev: d8b38e22631ed3597b2c8277f64cbd60afc1515a
+    hooks:
+      - id: actionlint

.pre-commit-config.yaml

@@ -0,0 +1,25 @@
+#!/bin/bash
+
+exitcode=0
+SSH_KEYS_DIR="$HOME"/.ssh/
+
+while IFS= read -r keyfile
+do
+    (grep -l "OPENSSH PRIVATE" "$keyfile" 2>/dev/null | grep -v personal 1>/dev/null 2>&1) || continue
+    if ssh-keygen -y -P "" -f "$keyfile" 1>/dev/null 2>&1 ; then
+        echo SSH key with no passphrase: "$keyfile"
+        exitcode=1
+    fi
+done < <(find "$SSH_KEYS_DIR" -maxdepth 1 -type f 2> /dev/null)
+
+if [ $exitcode == 1 ]; then
+    cat << EOF
+
+At least one of your SSH keys doesn't have a passphrase. For security reasons,
+a passphrase is needed on all non-personal SSH keys. Please refer to the 'Signed commits'
+section of the 'Repositories hardening' page on Notion for more information:
+https://www.notion.so/scribetech/Repositories-hardening-1cfc3cfcebe842bc88c3ac4fae4a0506
+EOF
+fi
+
+exit $exitcode