automatiabcn
diff --git a/‎.github/workflows/codeql.yml‎
Lines changed: 65 additions & 0 deletions b/‎.github/workflows/codeql.yml‎
Lines changed: 65 additions & 0 deletions
diff --git a/‎.github/workflows/docs.yml‎
Lines changed: 8 additions & 2 deletions b/‎.github/workflows/docs.yml‎
Lines changed: 8 additions & 2 deletions
diff --git a/‎.github/workflows/license-check.yml‎
Lines changed: 89 additions & 21 deletions b/‎.github/workflows/license-check.yml‎
Lines changed: 89 additions & 21 deletions
diff --git a/‎.github/workflows/release.yml‎
Lines changed: 155 additions & 0 deletions b/‎.github/workflows/release.yml‎
Lines changed: 155 additions & 0 deletions
diff --git a/‎.gitignore‎
Lines changed: 3 additions & 0 deletions b/‎.gitignore‎
Lines changed: 3 additions & 0 deletions
diff --git a/‎CONTRIBUTING.md‎
Lines changed: 5 additions & 2 deletions b/‎CONTRIBUTING.md‎
Lines changed: 5 additions & 2 deletions
@@ -0,0 +1,65 @@
+# CodeQL Advanced — Sprint 2G ITEM 6
+#
+# Replaces GitHub's default-setup CodeQL with an advanced workflow that
+# honours .github/codeql/codeql-config.yml. Default-setup ignores the
+# in-repo config file, which is why 9 path-injection alerts (#33, #47,
+# #48, #49, #50, #51, #53, #54, #55) on _safe_path.py + its three call
+# sites + infra/piper/server.py stayed open after Sprint 2E shipped the
+# sanitizer + the config exclusion. Advanced setup picks the config up.
+#
+# Before this workflow can take over scanning, default-setup must be
+# disabled (founder action):
+#   gh api -X DELETE /repos/automatiabcn/abs/code-scanning/default-setup
+#
+# Schedule mirrors the previous default-setup cadence (Monday 06:00 UTC)
+# plus PR + push triggers on main so every commit gets scanned.
+#
+# Security: this workflow uses only safe context references — matrix.language
+# (workflow-defined enum) and github.ref (internal git ref) for the
+# concurrency group identifier. No untrusted user input (issue title, PR
+# body, commit message, etc.) is ever interpolated into a run: block.
+
+name: CodeQL Advanced
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "0 6 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+  actions: read
+
+concurrency:
+  group: codeql-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [python, javascript-typescript]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+          config-file: ./.github/codeql/codeql-config.yml
+          queries: security-extended,security-and-quality
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:${{ matrix.language }}"
@@ -48,10 +48,16 @@ jobs:
         run: pip install -e .
       - name: Install docs deps
         run: |
+          # Sprint 2G ITEM 3 — dropped `mkdocs-algolia-docsearch>=0.4`:
+          # the PyPI package never existed, so `pip install` failed on
+          # every docs.yml run since T-R07 (Sprint 18). The matching
+          # `algolia_docsearch:` plugin entry has been removed from
+          # mkdocs.yml. MkDocs Material's built-in search covers site
+          # search; Algolia DocSearch can be re-introduced later as a
+          # template override (no PyPI plugin).
           pip install \
             "mkdocs-material[imaging]>=9.5" \
-            "mike>=2.1" \
-            "mkdocs-algolia-docsearch>=0.4"
+            "mike>=2.1"
       - name: Configure git author for mike
         run: |
           git config --global user.name "abs-docs-bot"
 
@@ -1,3 +1,29 @@
+# License Detection — Sprint 2G ITEM 4
+#
+# Original workflow used `licensee detect LICENSE --confidence=90` and
+# expected MATCH_KEY to be `bsl-1.1` or `busl-1.1`. That can never
+# succeed: the licensee gem (any version through 9.16+) bundles
+# choosealicense.com's `_licenses` directory, which contains
+# `bsl-1.0.txt` (Boost Software License 1.0) but no BUSL-1.1 entry.
+# choosealicense.com itself does not ship a BUSL-1.1 template either.
+# So Licensee structurally cannot return key `busl-1.1`, and the
+# workflow has been failing on every run since it was introduced.
+#
+# This rewrite drops the `licensee detect` strict-match in favour of a
+# body-shape verification: confirm the LICENSE file is unambiguously
+# the BUSL-1.1 canonical body (header phrase + the five required
+# Parameters + the MariaDB Covenants block + the BSL Notice block).
+# The check still catches accidental drift (e.g. someone replacing the
+# body with MIT or deleting a Parameter) but does not depend on a
+# template Licensee never had.
+#
+# Linguist NOASSERTION on the repo home page is an expected upstream
+# consequence of the same gap and is documented in README "License".
+#
+# Security: no untrusted user input is interpolated into any run: block.
+# All markers are hardcoded strings; the LICENSE/NOTICE.md paths are
+# checked-out repository files, not user-supplied data.
+
 name: License Detection
 
 on:
@@ -20,34 +46,76 @@ permissions:
 jobs:
   check:
     runs-on: ubuntu-latest
-    timeout-minutes: 10
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4
 
-      - uses: ruby/setup-ruby@v1
-        with:
-          ruby-version: "3.3"
-
-      - name: Install licensee
-        run: gem install licensee --version "~> 9.16"
+      - name: Verify LICENSE body shape (BUSL-1.1 canonical markers)
+        run: |
+          set -euo pipefail
+          if [ ! -s LICENSE ]; then
+            echo "::error::LICENSE file is missing or empty."
+            exit 1
+          fi
+          MISS=0
+          for MARKER in \
+            "Business Source License 1.1" \
+            "Licensor:" \
+            "Licensed Work:" \
+            "Additional Use Grant:" \
+            "Change Date:" \
+            "Change License:" \
+            "Covenants of Licensor" \
+            "MariaDB"
+          do
+            if ! grep -q -F "$MARKER" LICENSE; then
+              echo "::error::LICENSE missing required canonical marker: $MARKER"
+              MISS=$((MISS + 1))
+            fi
+          done
+          if [ "$MISS" -gt 0 ]; then
+            echo "::error::LICENSE drift detected ($MISS markers missing)."
+            exit 1
+          fi
+          # Sanity: full body should be at least 2.5 KB. Sprint 2F
+          # canonical body is ~3.5 KB; anything under 2500 means the
+          # body was truncated or replaced with a stub.
+          SIZE=$(wc -c < LICENSE)
+          if [ "$SIZE" -lt 2500 ]; then
+            echo "::error::LICENSE size ($SIZE bytes) below 2500-byte canonical floor."
+            exit 1
+          fi
+          echo "LICENSE: BUSL-1.1 canonical markers present, size=${SIZE}B."
 
-      - name: Detect LICENSE with confidence threshold
+      - name: Verify NOTICE.md attribution block (Sprint 2F)
         run: |
           set -euo pipefail
-          licensee detect LICENSE --confidence=90 --json > /tmp/license.json
-          cat /tmp/license.json
-          MATCH_KEY=$(jq -r '.licenses[0].key // "none"' /tmp/license.json)
-          MATCH_CONFIDENCE=$(jq -r '.matched_files[0].matcher.confidence // 0' /tmp/license.json)
-          echo "Detected license key: $MATCH_KEY"
-          echo "Match confidence: $MATCH_CONFIDENCE"
-          if [ "$MATCH_KEY" != "bsl-1.1" ] && [ "$MATCH_KEY" != "busl-1.1" ]; then
-            echo "::error::Expected BUSL-1.1 license key (bsl-1.1 / busl-1.1); got '$MATCH_KEY'."
-            echo "::error::LICENSE may have drifted from canonical BUSL-1.1 body."
+          if [ ! -s NOTICE.md ]; then
+            echo "::error::NOTICE.md is missing or empty."
+            exit 1
+          fi
+          if ! grep -q -F "Automatia BCN" NOTICE.md; then
+            echo "::error::NOTICE.md missing 'Automatia BCN' attribution."
             exit 1
           fi
-          OK=$(awk -v c="$MATCH_CONFIDENCE" 'BEGIN{ exit !(c+0 >= 90) }' && echo 1 || echo 0)
-          if [ "$OK" != "1" ]; then
-            echo "::error::Licensee confidence ($MATCH_CONFIDENCE) below 90% — LICENSE drift detected."
+          if ! grep -q -F "Business Source License 1.1" NOTICE.md; then
+            echo "::error::NOTICE.md missing BUSL-1.1 reference."
             exit 1
           fi
-          echo "License detected as $MATCH_KEY at $MATCH_CONFIDENCE% confidence."
+          echo "NOTICE.md: canonical attribution block present."
+
+      - name: Informational licensee probe (non-gating)
+        continue-on-error: true
+        run: |
+          set -euo pipefail
+          # Best-effort Licensee output for diagnostics. NOASSERTION
+          # is expected (see workflow header) — never used to fail
+          # the job.
+          if command -v gem >/dev/null 2>&1; then
+            gem install licensee --version "~> 9.16" --no-document >/dev/null 2>&1 || true
+            if command -v licensee >/dev/null 2>&1; then
+              echo "--- licensee informational output ---"
+              licensee detect LICENSE --json 2>/dev/null || echo "(licensee returned non-zero — expected for BUSL-1.1)"
+              echo "--- end licensee output ---"
+            fi
+          fi
@@ -0,0 +1,155 @@
+# Release — Sprint 2G ITEM 11
+#
+# Trigger: push of a semver tag (v1.0.0, v1.0.0-rcN). Creates the GitHub
+# Release entry which then triggers sbom.yml (release: published) to
+# attach the CycloneDX SBOMs as release assets.
+#
+# Distinct from cicd.yml which also runs on tags but targets staging /
+# production Kubernetes deploys that require KUBECONFIG_* secrets and
+# pushes images to ghcr.io/automatiabcn/abs-backend. Customer-facing
+# images live at ghcr.io/enzoemir1/abs-{backend,landing} (per
+# scripts/release.sh) — release.yml only touches GitHub release + SBOM
+# + cosign keyless signature.
+#
+# Cosign keyless attestation is best-effort: signing a package in a
+# different GHCR namespace (enzoemir1/*) from this workflow's identity
+# (github.com/automatiabcn/abs/...) is conditional on package
+# permissions enzoemir1 explicitly grants. If the signature step fails
+# the release still publishes — verifiable provenance comes from the
+# SBOM + the image digest in the GHCR registry.
+#
+# Security: every interpolation routes through env: blocks. The only
+# refs used are github.ref_name (tag), github.repository, github.actor
+# and secrets.GITHUB_TOKEN — all controlled by the workflow context,
+# not by external user input. No issue/PR/commit text is consumed.
+
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: write
+  packages: write
+  id-token: write
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    name: Create GitHub Release
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    outputs:
+      tag_name: ${{ steps.tag.outputs.tag }}
+      is_prerelease: ${{ steps.tag.outputs.prerelease }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # full history so release-notes can diff against the previous tag
+
+      - name: Identify tag metadata
+        id: tag
+        env:
+          REF_NAME: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          echo "tag=$REF_NAME" >> "$GITHUB_OUTPUT"
+          if [[ "$REF_NAME" == *-rc* || "$REF_NAME" == *-beta* || "$REF_NAME" == *-alpha* ]]; then
+            echo "prerelease=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "prerelease=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Generate release body (commit log since previous tag)
+        id: notes
+        env:
+          REF_NAME: ${{ github.ref_name }}
+          REPO_FULL: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          PREV=$(git describe --tags --abbrev=0 "${REF_NAME}^" 2>/dev/null || echo "")
+          VERSION="${REF_NAME#v}"
+          {
+            echo "# Automatia ABS ${REF_NAME}"
+            echo
+            if [ -n "$PREV" ]; then
+              echo "## Changes since ${PREV}"
+              echo
+              git log --no-merges --pretty=format:"- %s (%h)" "${PREV}..${REF_NAME}"
+            else
+              echo "## Changes"
+              echo
+              git log --no-merges --pretty=format:"- %s (%h)" -n 50 "${REF_NAME}"
+            fi
+            echo
+            echo
+            echo "## Docker images"
+            echo
+            echo "- \`ghcr.io/enzoemir1/abs-backend:${VERSION}\`"
+            echo "- \`ghcr.io/enzoemir1/abs-landing:${VERSION}\`"
+            echo
+            echo "## Provenance"
+            echo
+            echo "- SBOM (CycloneDX) attached as release asset by .github/workflows/sbom.yml."
+            echo "- Cosign keyless signature published to Sigstore Rekor (where package permissions allow)."
+            echo "- Source: https://github.com/${REPO_FULL}/tree/${REF_NAME}"
+          } > /tmp/release-body.md
+          echo "body_path=/tmp/release-body.md" >> "$GITHUB_OUTPUT"
+
+      - name: Publish GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ steps.tag.outputs.tag }}
+          name: ${{ steps.tag.outputs.tag }}
+          body_path: ${{ steps.notes.outputs.body_path }}
+          prerelease: ${{ steps.tag.outputs.is_prerelease }}
+          generate_release_notes: false
+          make_latest: ${{ steps.tag.outputs.is_prerelease == 'false' }}
+
+  cosign-sign:
+    name: Cosign keyless sign (best-effort)
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    needs: publish
+    continue-on-error: true
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+    steps:
+      - name: Install cosign
+        uses: sigstore/cosign-installer@v3
+        with:
+          cosign-release: v2.4.1
+
+      - name: Cosign login to ghcr.io
+        env:
+          GHCR_USER: ${{ github.actor }}
+          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: cosign login ghcr.io -u "$GHCR_USER" -p "$GHCR_TOKEN"
+
+      - name: Sign backend + landing images (keyless)
+        env:
+          TAG: ${{ needs.publish.outputs.tag_name }}
+          COSIGN_EXPERIMENTAL: "1"
+        run: |
+          set -euo pipefail
+          VERSION="${TAG#v}"
+          for IMAGE in \
+            "ghcr.io/enzoemir1/abs-backend:${VERSION}" \
+            "ghcr.io/enzoemir1/abs-landing:${VERSION}"; do
+            echo "==> Signing $IMAGE"
+            # -y accepts the OIDC identity prompt non-interactively.
+            # If the image is not accessible from this workflow's
+            # token (cross-namespace), the step exits non-zero and
+            # continue-on-error: true keeps the release pipeline green.
+            cosign sign -y "$IMAGE" || {
+              echo "::warning::cosign sign failed for $IMAGE — package permission may be needed in enzoemir1/* namespace"
+              exit 0
+            }
+          done
@@ -62,6 +62,9 @@ playwright/.cache/
 # Internal worker briefs — founder ↔ worker coordination, not for distribution
 _agent-tasks/
 
+# Generated research assets (social previews, image experiments, scratch)
+_research/
+
 # Per-customer SSH deploy keys + license tokens — NEVER commit
 customer-keys/
 
 
@@ -48,5 +48,8 @@ welcome and reviewed quickly.
 Open a [GitHub Discussion](https://github.com/automatiabcn/abs/discussions) or email
 [support@automatiabcn.com](mailto:support@automatiabcn.com).
 
-By contributing, you agree your contribution is licensed under
-[Apache 2.0](LICENSE).
+By contributing, you agree your contribution is licensed under the
+[Business Source License 1.1](LICENSE) (the project's source-available
+license). The Change Date (2030-05-07) converts the entire codebase —
+including all accepted contributions — to Apache License 2.0
+automatically.