diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 0000000..38ed04b --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1,3 @@ +* @PureSaber +/.github/ @PureSaber +/SECURITY.md @PureSaber diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml new file mode 100644 index 0000000..0a57202 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -0,0 +1,44 @@ +name: Bug report +description: Report a reproducible defect +title: "[Bug]: " +body: + - type: markdown + attributes: + value: Thanks for helping improve this project. Do not include secrets, proprietary market data, or personal data. + - type: textarea + id: summary + attributes: + label: Summary + description: Describe the observed defect and its impact. + validations: + required: true + - type: textarea + id: reproduce + attributes: + label: Reproduction + description: Provide the smallest deterministic reproduction and sanitized inputs. + placeholder: Steps, command, and minimal fixture + validations: + required: true + - type: textarea + id: expected + attributes: + label: Expected behavior + validations: + required: true + - type: input + id: revision + attributes: + label: Revision and environment + description: Commit SHA, operating system, and runtime version. + validations: + required: true + - type: checkboxes + id: safety + attributes: + label: Safety check + options: + - label: I removed credentials, proprietary market data, and personal data. + required: true + - label: This is not a security vulnerability; security reports use the private advisory link. + required: true diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml new file mode 100644 index 0000000..8c7ce0b --- /dev/null +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -0,0 +1,5 @@ +blank_issues_enabled: true +contact_links: + - name: Report a security vulnerability privately + url: https://github.com/PureSaber/quant-execution/security/advisories/new + about: Do not disclose suspected vulnerabilities in a public issue. diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..66c79d4 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,30 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + day: "monday" + time: "04:00" + timezone: "Etc/UTC" + open-pull-requests-limit: 10 + groups: + github-actions: + patterns: + - "*" + commit-message: + prefix: "deps" + - package-ecosystem: "pip" + directory: "/" + schedule: + interval: "weekly" + day: "monday" + time: "04:00" + timezone: "Etc/UTC" + open-pull-requests-limit: 10 + groups: + python-dependencies: + patterns: + - "*" + commit-message: + prefix: "deps" diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md new file mode 100644 index 0000000..74593ed --- /dev/null +++ b/.github/pull_request_template.md @@ -0,0 +1,16 @@ +## Summary + +Describe the problem, root cause, and change. + +## Verification + +- [ ] Tests or reproducible checks cover the change. +- [ ] GitHub Actions pass on this PR. +- [ ] Documentation and contracts are updated when behavior changes. +- [ ] No credentials, proprietary market data, personal data, or generated artifacts are included. +- [ ] Security, dependency, and permission impacts were reviewed. +- [ ] Breaking changes and rollback steps are documented, or are not applicable. + +## Related issue + +Link the issue or explain why no issue is required. diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4a38c9c..ec68613 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,6 +6,9 @@ on: pull_request: branches: [main] +permissions: + contents: read + jobs: test: runs-on: ubuntu-latest @@ -14,8 +17,10 @@ jobs: matrix: python-version: ["3.10", "3.11", "3.12"] steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ matrix.python-version }} - name: Install locked dependencies diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..701a35f --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,39 @@ +name: CodeQL + +on: + push: + branches: [main] + pull_request: + branches: [main] + schedule: + - cron: "23 3 * * 1" + workflow_dispatch: + +permissions: + contents: read + security-events: write + +concurrency: + group: codeql-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +jobs: + analyze: + name: codeql (python) + runs-on: ubuntu-latest + timeout-minutes: 30 + steps: + - name: Checkout repository + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Initialize CodeQL + uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + with: + languages: python + + - name: Analyze + uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + with: + category: "/language:python" diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..754c2dd --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,11 @@ +# Security Policy + +## Supported version + +Security fixes target the current default branch. Older releases may not receive backports. + +## Reporting a vulnerability + +Do not open a public issue for a suspected vulnerability. Use [GitHub private vulnerability reporting](https://github.com/PureSaber/quant-execution/security/advisories/new) and include the affected revision, impact, reproduction steps, and any suggested mitigation. + +Avoid including live credentials, proprietary market data, or personal data in the report. The maintainer will acknowledge the report, assess severity, and coordinate remediation and disclosure through the private advisory.