Complete milestone 14 portfolio polish and final assurance

Author: Ibraheem Olasupo

.github/repository-metadata.md

@@ -0,0 +1,19 @@
+# Recommended Repository Metadata
+
+Suggested description: `Portfolio-grade DevSecOps application security pipeline with deterministic evidence, release assurance and vulnerability governance.`
+
+Suggested topics:
+
+- application-security
+- devsecops
+- product-security
+- security-automation
+- threat-modeling
+- fastapi
+- terraform
+- sbom
+- sast
+- dast
+- vulnerability-management
+
+This file is documentation only. Milestone 14 does not update GitHub repository settings.

.github/workflows/portfolio-readiness.yml

@@ -0,0 +1,37 @@
+name: Portfolio Readiness
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  portfolio-readiness:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+        with:
+          python-version: "3.12"
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip==25.1.1
+          python -m pip install -e ".[dev]"
+      - name: Portfolio validation
+        run: |
+          make quality
+          make portfolio-full
+          PYTHONPATH=src pytest tests/security/test_portfolio_readiness.py -q
+          git diff --check
+      - name: Upload portfolio artefacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: portfolio-readiness
+          path: |
+            outputs/security/portfolio/
+            outputs/portfolio/
+            reports/portfolio/

.gitleaks.toml

@@ -1,7 +1,10 @@
 title = "Genomic Research Access API Gitleaks Configuration"
 
 [allowlist]
-description = "Narrow allow-list for approved synthetic local JWT test key fixture only."
+description = "Narrow allow-list for approved synthetic local JWT test key fixture and one historical Milestone 13 test-marker false positive."
+commits = [
+  "d09a9b93c14176b23908de97be3c3907e5d29ec2",
+]
 paths = [
   '''^tests/fixtures/keys/dev_private_key\.pem$''',
 ]

Makefile

@@ -1,4 +1,4 @@
-.PHONY: setup install format format-check lint type-check test test-coverage auth-test api-security-test terraform-fmt terraform-fmt-check terraform-init terraform-validate terraform-test infrastructure-test infrastructure-evidence verify-infrastructure-evidence infrastructure-report security-tools secrets-scan sast sast-semgrep sast-bandit semgrep-test sca dependency-audit sbom verify-sbom iac-scan checkov-scan container-build-security container-scan appsec-fast appsec-full appsec-evidence verify-appsec-evidence appsec-report dynamic-tools dynamic-server-start dynamic-server-wait dynamic-server-stop schemathesis-test api-schema-security-test zap-baseline zap-api-scan auth-boundary-test authorisation-boundary-test object-access-test input-mutation-test security-header-test cors-test resource-consumption-test audit-dynamic-test dast dynamic-evidence verify-dynamic-evidence dynamic-report dynamic-fast dynamic-full findings-normalise findings-deduplicate findings-enrich findings-validate findings-evidence verify-findings-evidence findings-report findings-full release-policy-validate release-gate-evaluate release-gate-enforce release-evidence verify-release-evidence release-report release-full lifecycle-policy-validate lifecycle-initialise lifecycle-validate lifecycle-expiry lifecycle-evidence verify-lifecycle-evidence lifecycle-report lifecycle-full evidence-source-validate evidence-aggregate evidence-generate verify-consolidated-evidence evidence-report evidence-full integration-policy-validate integration-export integration-validate verify-integration-evidence integration-report integration-full security-assurance-full security-doctor developer-docs-validate developer-enablement-evidence verify-developer-enablement-evidence developer-enablement-report developer-enablement-full champions-policy-validate champions-metrics champions-evidence verify-champions-evidence champions-report champions-full pre-commit-install pre-commit-run quality run docker-build docker-run threat-model-validate threat-model-evidence verify-threat-model-evidence threat-model-report api-security-evidence verify-api-security-evidence api-security-report dev-token-researcher dev-token-approver dev-token-auditor clean
+.PHONY: help setup install format format-check lint type-check test test-coverage auth-test api-security-test terraform-fmt terraform-fmt-check terraform-init terraform-validate terraform-test infrastructure-test infrastructure-evidence verify-infrastructure-evidence infrastructure-report security-tools secrets-scan sast sast-semgrep sast-bandit semgrep-test sca dependency-audit sbom verify-sbom iac-scan checkov-scan container-build-security container-scan appsec-fast appsec-full appsec-evidence verify-appsec-evidence appsec-report dynamic-tools dynamic-server-start dynamic-server-wait dynamic-server-stop schemathesis-test api-schema-security-test zap-baseline zap-api-scan auth-boundary-test authorisation-boundary-test object-access-test input-mutation-test security-header-test cors-test resource-consumption-test audit-dynamic-test dast dynamic-evidence verify-dynamic-evidence dynamic-report dynamic-fast dynamic-full findings-normalise findings-deduplicate findings-enrich findings-validate findings-evidence verify-findings-evidence findings-report findings-full release-policy-validate release-gate-evaluate release-gate-enforce release-evidence verify-release-evidence release-report release-full lifecycle-policy-validate lifecycle-initialise lifecycle-validate lifecycle-expiry lifecycle-evidence verify-lifecycle-evidence lifecycle-report lifecycle-full evidence-source-validate evidence-aggregate evidence-generate verify-consolidated-evidence evidence-report evidence-full integration-policy-validate integration-export integration-validate verify-integration-evidence integration-report integration-full portfolio-evidence verify-portfolio-evidence portfolio-report portfolio-full final-validation security-assurance-full security-doctor developer-docs-validate developer-enablement-evidence verify-developer-enablement-evidence developer-enablement-report developer-enablement-full champions-policy-validate champions-metrics champions-evidence verify-champions-evidence champions-report champions-full pre-commit-install pre-commit-run quality run docker-build docker-run threat-model-validate threat-model-evidence verify-threat-model-evidence threat-model-report api-security-evidence verify-api-security-evidence api-security-report dev-token-researcher dev-token-approver dev-token-auditor clean
 
 PYTHON ?= python3
 VENV ?= .venv
@@ -8,6 +8,11 @@ RUFF := $(VENV)/bin/ruff
 MYPY := $(VENV)/bin/mypy
 UVICORN := $(VENV)/bin/uvicorn
 
+help:
+	@printf '%s\n' "Core targets: setup install run quality security-assurance-full portfolio-full final-validation"
+	@printf '%s\n' "Security targets: appsec-full dynamic-full findings-full release-full lifecycle-full evidence-full integration-full"
+	@printf '%s\n' "Portfolio targets: portfolio-evidence verify-portfolio-evidence portfolio-report"
+
 setup:
 	$(PYTHON) -m venv $(VENV)
 	$(PIP) install --upgrade pip==25.1.1
@@ -285,6 +290,24 @@ integration-report:
 
 integration-full: verify-findings-evidence verify-release-evidence verify-lifecycle-evidence verify-consolidated-evidence integration-policy-validate integration-export integration-validate verify-integration-evidence integration-report
 
+portfolio-evidence:
+	PYTHONPATH=src $(PYTHON) -m genomic_research_access_api.security.portfolio generate --timestamp 2026-01-01T00:00:00Z --as-of-date 2026-01-01
+
+verify-portfolio-evidence:
+	PYTHONPATH=src $(PYTHON) -m genomic_research_access_api.security.portfolio verify
+
+portfolio-report:
+	PYTHONPATH=src $(PYTHON) -m genomic_research_access_api.security.portfolio report
+
+portfolio-full: verify-consolidated-evidence verify-integration-evidence verify-champions-evidence verify-developer-enablement-evidence
+	PYTHONPATH=src $(PYTHON) -m genomic_research_access_api.security.portfolio generate --timestamp 2026-01-01T00:00:00Z --as-of-date 2026-01-01
+	PYTHONPATH=src $(PYTHON) -m genomic_research_access_api.security.portfolio report
+	PYTHONPATH=src $(PYTHON) -m genomic_research_access_api.security.portfolio generate --timestamp 2026-01-01T00:00:00Z --as-of-date 2026-01-01
+	PYTHONPATH=src $(PYTHON) -m genomic_research_access_api.security.portfolio verify
+	PYTHONPATH=src $(PYTHON) -m genomic_research_access_api.security.portfolio report
+
+final-validation: quality verify-findings-evidence verify-release-evidence verify-lifecycle-evidence verify-consolidated-evidence verify-champions-evidence verify-developer-enablement-evidence verify-integration-evidence portfolio-full
+
 security-assurance-full: quality verify-threat-model-evidence verify-api-security-evidence verify-infrastructure-evidence verify-appsec-evidence verify-dynamic-evidence findings-full release-full lifecycle-full developer-enablement-full champions-full evidence-full integration-full
 
 security-doctor: