Merge pull request #248 from rsksmart/feature/GBI-2134

chore: add new GH policy requirements

.github/dependabot.yml

@@ -0,0 +1,13 @@
+version: 2
+updates:
+  # Maintain dependencies for GitHub Actions
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: daily
+
+  # Maintain dependencies for npm and yarn
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: daily

.github/workflows/ci.yml

@@ -12,6 +12,9 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
   # This workflow contains a single job called "build"
@@ -22,16 +25,16 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
       - name: Use Node.js 19.6.0
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@0a44ba7841725637a19e28fa30b79a866c81b0a6 # v4.0.4
         with:
           node-version: '19.6.0'
 
       - name: Install truffle
         run: npm install -g truffle
-      
+
       - name: Install dependencies
         run: npm ci
       # - name: Lint source and tests
@@ -45,4 +48,4 @@ jobs:
       #   with:
       #     github-token: ${{ secrets.GITHUB_TOKEN }}
       # - name: Reproduce build
-      #   run: npm publish --dry-run
+      #   run: npm publish --dry-run

.github/workflows/dependency-review.yml

@@ -0,0 +1,22 @@
+# Dependency Review Action
+#
+# This Action will scan dependency manifest files that change as part of a Pull Request,
+# surfacing known-vulnerable versions of the packages declared or updated in the PR.
+# Once installed, if the workflow run is marked as required,
+# PRs introducing known-vulnerable packages will be blocked from merging.
+#
+# Source repository: https://github.com/actions/dependency-review-action
+name: 'Dependency Review'
+on: [pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: 'Checkout Repository'
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - name: 'Dependency Review'
+        uses: actions/dependency-review-action@72eb03d02c7872a771aacd928f3123ac62ad6d3a # v4.3.3

.github/workflows/scorecard.yml

@@ -0,0 +1,42 @@
+name: Scorecard supply-chain security
+on:
+  branch_protection_rule:
+  schedule:
+    - cron: '0 0 * * 1'
+  push:
+    branches: [ "master" ]
+
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      id-token: write
+
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          persist-credentials: false
+
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@97a0fba1372883ab732affbe8f94b823f91727db # v3.pre.node20
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@1b1aada464948af03b950897e5eb522f92603cc2 # v3.24.9
+        with:
+          sarif_file: results.sarif

.github/workflows/slither.yml

@@ -1,30 +1,34 @@
 name: Slither Analysis
 on: [push]
+
+permissions:
+  contents: read
+
 jobs:
   analyze:
     runs-on: ubuntu-latest
     permissions:
       security-events: write
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
       - name: Use Node.js 19.6.0
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@0a44ba7841725637a19e28fa30b79a866c81b0a6 # v4.0.4
         with:
           node-version: '19.6.0'
 
       - name: Install dependencies
         run: npm ci
 
       - name: Run Slither
-        uses: crytic/[email protected]
+        uses: crytic/slither-action@6ef3a33e56de4e8f59488cf60858b5c1bf4967c0 # v0.3.0
         id: slither
         with:
           sarif: results.sarif
           fail-on: none
           target: .
 
       - name: Upload SARIF file
-        uses: github/codeql-action/upload-sarif@v2
+        uses: github/codeql-action/upload-sarif@85b07cf1e13dd512be7c27c37a33c5864c252fcc # v2
         with:
           sarif_file: ${{ steps.slither.outputs.sarif }}

.pre-commit-config.yaml

@@ -0,0 +1,35 @@
+repos:
+- repo: https://github.com/gitleaks/gitleaks
+  rev: v8.16.3
+  hooks:
+  - id: gitleaks
+- repo: https://github.com/jumanjihouse/pre-commit-hooks
+  rev: 3.0.0
+  hooks:
+  - id: shellcheck
+- repo: https://github.com/pre-commit/pre-commit-hooks
+  rev: v4.4.0
+  hooks:
+    - id: "trailing-whitespace"
+    - id: "end-of-file-fixer"
+      exclude: '\.tf\.json$'
+    - id: "check-yaml"
+      args:
+        - "--unsafe"
+    - id: "check-executables-have-shebangs"
+    - id: "check-case-conflict"
+# Project specific
+- repo: local
+  hooks:
+    - id: code-style
+      name: Project Style Check
+      entry: npm run lint
+      language: system
+      types: [solidity]
+- repo: local
+  hooks:
+    - id: unit-tests
+      name: Project Unit Tests
+      entry: npm run test
+      language: system
+      types: [solidity, javascript]

CONTRIBUTING.md

@@ -0,0 +1,52 @@
+# Contributing
+## How to contribute to RSK
+
+These are mostly guidelines, not rules. Use your best judgment, and feel free to propose changes to this document in a pull request.
+
+### Code Reviews
+
+Continued code reviews and audits are required for security. As such, we encourage interested security researchers to:
+
+* Review our code, even if no contributions are planned.
+* Publish their findings whichever way they choose, even if no particular bug or vulnerability was found. We can all learn from new sets of eyes and benefit from increased scrutiny.
+
+### Code contributions
+
+A code contribution process starts with someone identifying a need for writing code. If you're thinking about making your first contribution, we suggest you take a moment to get in touch and see how your idea fits in the development plan:
+
+* Is it a bug in our [issue tracker](https://github.com/rsksmart/liquidity-bridge-contract/issues)?
+* Is it a novel idea that should be proposed and discussed first?
+
+#### Review process
+
+Once you know what to do, it is important that you provide a full description of the proposed changes. You can also send a draft pull request if you already have code to show.
+
+We make use of GitHub Checks to ensure all changes meet a certain criteria:
+
+1. The `master` branch is protected and only changeable through pull requests
+2. All unit tests must pass
+3. A project maintainer must approve the pull request
+4. An authorized merger must merge the pull request
+
+Since this is a security-sensitive project, we encourage everyone to be proactive and participate in the review process. To help collaboration we propose adhering to these conventions:
+
+* **Request changes** only for correctness and security issues.
+* **Comment** when leaving feedback without explicit approval or rejection. This is useful for design and implementation discussions.
+* **Approve** when changes look good from a correctness, security, design and implementation standpoint.
+
+All unit and integration tests pass without loss of coverage (e.g can't remove tests without writing equivalent or better ones).
+
+All code paths on new code must be unit tested, including sensible edge cases and expected errors. Exceptions to this rule must be justified (i.e. highly similar paths already tested) in written form in the PR description.
+
+In order to ease review, it is expected that the code diff is maintained to a minimum. This includes things like not changing unrelated files, not changing names or reordering code when there isn't an evident benefit.
+
+When automatic code quality and security checks are ready in the pipeline for external PRs, then the PR must pass all PR validations including code coverage (Sonar), code smells (Sonar), Security advisories (Sonar, LGTM).
+
+## Style guidelines
+
+### Pull request etiquette
+
+* Separate your changes into multiple commits
+* If your pull request gets too big, try to split it
+* Each commit should at least compile, and ideally pass all unit tests
+* Avoid merge commits, and always rebase your changes on top of `master`

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 RootstockLabs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

readme.MD → README.md

@@ -1,4 +1,5 @@
 # Liquidity Bridge Contract
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/rsksmart/liquidity-bridge-contract/badge)](https://scorecard.dev/viewer/?uri=github.com/rsksmart/liquidity-bridge-contract)
 
 The Liquidity Bridge Contract (LBC) manages the interaction between users and liquidity providers (LP) in order to achieve fast peg-ins and peg-outs.
 
@@ -31,7 +32,7 @@ PegIn Quotes consist of:
         address lbcAddress;                     // the address of the LBC
         address liquidityProviderRskAddress;    // the RSK address of the LP
         bytes btcRefundAddress;                 // a user BTC refund address
-        address rskRefundAddress;               // a user RSK refund address 
+        address rskRefundAddress;               // a user RSK refund address
         bytes liquidityProviderBtcAddress;      // the BTC address of the LP
         uint callFee;                           // the fee charged by the LP
         uint penaltyFee;                        // the penalty that the LP pays if it fails to deliver the service
@@ -55,7 +56,7 @@ PegOut Quotes consist of:
         address lbcAddress;                     // the address of the LBC
         address lpRskAddress;                   // the RSK address of the LP
         bytes btcRefundAddress;                 // a user BTC refund address
-        address rskRefundAddress;               // a user RSK refund address 
+        address rskRefundAddress;               // a user RSK refund address
         bytes lpBtcAddress;                     // the BTC address of the LP
         uint callFee;                           // the fee charged by the LP
         uint penaltyFee;                        // the penalty that the LP pays if it fails to deliver the service
@@ -82,7 +83,7 @@ PegOut Quotes consist of:
     ) returns bool success
 
 This method performs a call on behalf of a user.
-#### Parameters 
+#### Parameters
     * quote: The quote that identifies the service
 #### Return value
     Boolean indicating whether the call was successful
@@ -104,7 +105,7 @@ This method requests the Bridge contract on RSK a refund for the service.
     * btcRawTransaction The peg-in transaction
     * partialMerkleTree The merkle tree path that proves transaction inclusion
     * height The block that contains the peg-in transaction
-#### Return value    
+#### Return value
     This method returns the amount transferred to the contract or an [error code](https://github.com/rsksmart/RSKIPs/blob/fast-bridge-alternative/IPs/RSKIP176.md#error-codes).
 
 ### **isOperational**