Add compliance CI checks and scripts

.github/semgrep-rules.yml

@@ -0,0 +1,20 @@
+rules:
+  - id: rust-no-dbg-in-runtime
+    message: Avoid dbg! in runtimes and pallets; use logging macros instead.
+    severity: WARNING
+    languages: [rust]
+    pattern: dbg!($X)
+    paths:
+      include:
+        - /runtime/**
+        - /zrml/**
+
+  - id: rust-no-println-in-runtime
+    message: Avoid println! in runtimes and pallets; use logging macros instead.
+    severity: WARNING
+    languages: [rust]
+    pattern: println!($X)
+    paths:
+      include:
+        - /runtime/**
+        - /zrml/**

.github/workflows/compliance.yml

@@ -0,0 +1,154 @@
+name: Compliance
+
+on:
+  pull_request:
+    types: [ labeled ]
+  push:
+    branches: [ main ]
+
+concurrency:
+  group: compliance-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  cargo-deny:
+    name: Cargo Deny
+    if: |
+      github.event_name == 'pull_request' && 
+        (contains(github.event.pull_request.labels.*.name, 's:review-needed') ||
+        contains(github.event.pull_request.labels.*.name, 's:accepted')) ||
+      github.event_name == 'push'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Install cargo-deny
+        uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-deny
+      - name: Run cargo-deny
+        run: |
+          cargo deny check licenses bans sources advisories
+
+  semgrep:
+    name: Semgrep
+    if: |
+      github.event_name == 'pull_request' && 
+        (contains(github.event.pull_request.labels.*.name, 's:review-needed') ||
+        contains(github.event.pull_request.labels.*.name, 's:accepted')) ||
+      github.event_name == 'push'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Run semgrep
+        uses: returntocorp/semgrep-action@v1
+        with:
+          config: .github/semgrep-rules.yml
+
+  node-licenses:
+    name: Node Licenses
+    if: |
+      github.event_name == 'pull_request' && 
+        (contains(github.event.pull_request.labels.*.name, 's:review-needed') ||
+        contains(github.event.pull_request.labels.*.name, 's:accepted')) ||
+      github.event_name == 'push'
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: integration-tests
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          run_install: false
+          version: 9
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: 'pnpm'
+          cache-dependency-path: integration-tests/pnpm-lock.yaml
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+      - name: Check licenses
+        run: pnpm dlx license-checker --production --summary
+      - name: Audit npm
+        run: pnpm audit --prod
+
+  gitleaks:
+    name: Gitleaks
+    if: |
+      (
+        github.event_name == 'pull_request' && 
+          (contains(github.event.pull_request.labels.*.name, 's:review-needed') ||
+          contains(github.event.pull_request.labels.*.name, 's:accepted'))
+      ) ||
+      github.event_name == 'push'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Install gitleaks (OSS)
+        run: |
+          set -euo pipefail
+          version="$(
+            curl -sI https://github.com/gitleaks/gitleaks/releases/latest \
+              | tr -d '\r' \
+              | awk 'tolower($1) == "location:" {print $2}' \
+              | sed -E 's#.*/tag/v?##; s#^v##'
+          )"
+
+          if [[ -z "${version}" || "${version}" == "null" ]]; then
+            echo "Failed to determine gitleaks version" >&2
+            exit 1
+          fi
+
+          arch="$(uname -m)"
+          os="$(uname -s | tr '[:upper:]' '[:lower:]')"
+
+          case "${arch}" in
+            x86_64) arch="x64" ;;
+            aarch64 | arm64) arch="arm64" ;;
+            *)
+              echo "Unsupported architecture: ${arch}" >&2
+              exit 1
+              ;;
+          esac
+
+          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${version}/gitleaks_${version}_${os}_${arch}.tar.gz" \
+            | tar -xz -C /tmp gitleaks
+          chmod +x /tmp/gitleaks
+          /tmp/gitleaks version
+      - name: Run gitleaks
+        run: /tmp/gitleaks detect --redact
+
+  sbom-vuln:
+    name: SBOM and Vulnerability Scan
+    if: |
+      github.event_name == 'pull_request' && 
+        (contains(github.event.pull_request.labels.*.name, 's:review-needed') ||
+        contains(github.event.pull_request.labels.*.name, 's:accepted')) ||
+      github.event_name == 'push'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Generate SBOM
+        uses: anchore/sbom-action@v0
+        with:
+          path: .
+          output-file: sbom.json
+          format: cyclonedx-json
+          syft-version: latest
+      - name: Scan SBOM
+        uses: anchore/scan-action@v3
+        env:
+          GRYPE_CONFIG: ${{ github.workspace }}/.grype.yaml
+        with:
+          sbom: sbom.json
+          grype-version: latest
+          fail-build: false
+          severity-cutoff: medium

.github/workflows/integration-tests.yml

@@ -80,13 +80,13 @@ jobs:
           mkdir -p integration-tests/tmp
 
       - name: Download runtime
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v4.1.8
         with:
           name: runtimes
           path: target/release/wbuild/zeitgeist-runtime/
 
       - name: Download binary
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v4.1.8
         with:
           name: binaries
           path: target/release
@@ -137,13 +137,13 @@ jobs:
           mkdir -p integration-tests/tmp
 
       - name: Download runtime
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v4.1.8
         with:
           name: runtimes
           path: target/release/wbuild/zeitgeist-runtime/
 
       - name: Download binary
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v4.1.8
         with:
           name: binaries
           path: target/release
@@ -193,7 +193,7 @@ jobs:
           mkdir -p integration-tests/tmp/node_logs
 
       - name: Download runtime
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v4.1.8
         with:
           name: runtimes
           path: target/release/wbuild/battery-station-runtime/
@@ -248,7 +248,7 @@ jobs:
           mkdir -p integration-tests/tmp/node_logs
 
       - name: "Download runtime"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v4.1.8
         with:
           name: runtimes
           path: target/release/wbuild/zeitgeist-runtime/

.github/workflows/scancode.yml

@@ -0,0 +1,24 @@
+name: Scancode
+
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - "^v[0-9]+.[0-9]+.[0-9]+(-rc[0-9]+)?$"
+
+jobs:
+  scancode:
+    name: Scancode
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Install scancode
+        run: pip install scancode-toolkit
+      - name: Run scancode
+        run: scancode --processes 4 -clp . --json-pp compliance-report.json
+      - name: Upload scancode report
+        uses: actions/upload-artifact@v4
+        with:
+          name: scancode-report
+          path: compliance-report.json

.gitignore

@@ -159,4 +159,7 @@ dmypy.json
 
 /integration-tests/tmp
 
-/integration-tests/specs
+/integration-tests/specs
+
+# Compliance artifacts
+sbom.json

.gitleaks.toml

@@ -0,0 +1,15 @@
+description = "Allow known public addresses and test keys that gitleaks flags"
+title = "Zeitgeist gitleaks allowlist"
+
+[allowlist]
+paths = [
+    '''^integration-tests/scripts/chopsticks-relay-timestamp-hook\.js$''',
+    '''^integration-tests/configs/rococo\.yml$''',
+    '''^integration-tests/configs/battery-station\.yml$''',
+    '''^runtime/battery-station/src/parachain_params\.rs$''',
+    '''^runtime/zeitgeist/src/parachain_params\.rs$''',
+    '''^scripts/runtime-upgrade/test_runtime_upgrade\.sh$''',
+    '''^node/res/bs_parachain\.json$''',
+    '''^node/res/bp\.json$''',
+    '''^node/res/bp_parachain\.json$''',
+]