Merge branch 'fuzzle-sdk-br' of https://github.com/danielmarv/hiero-sdk-python into fuzzle-sdk-br

Author: danielmarv

.github/scripts/coderabbit_plan_trigger.js

@@ -2,14 +2,9 @@
 
 const CODERABBIT_MARKER = '<!-- CodeRabbit Plan Trigger -->';
 
-async function triggerCodeRabbitPlan(github, owner, repo, issue, marker = CODERABBIT_MARKER, isDryRun = false) {
+async function triggerCodeRabbitPlan(github, owner, repo, issue, marker = CODERABBIT_MARKER) {
   const comment = `${marker} @coderabbitai plan`;
 
-  if (isDryRun) {
-    console.log(`[DRY RUN] Would trigger CodeRabbit plan for issue #${issue.number}`);
-    return true;
-  }
-
   try {
     await github.rest.issues.createComment({
       owner,
@@ -105,11 +100,8 @@ async function main({ github, context }) {
       return console.log(`CodeRabbit plan already triggered for #${issue.number}`);
     }
 
-    // Check for dry run (default to true if not specified, for safety)
-    const isDryRun = (process.env.DRY_RUN || 'true').toLowerCase() === 'true';
-
     // Post CodeRabbit plan trigger
-    await triggerCodeRabbitPlan(github, owner, repo, issue, CODERABBIT_MARKER, isDryRun);
+    await triggerCodeRabbitPlan(github, owner, repo, issue, CODERABBIT_MARKER);
 
     logSummary(owner, repo, issue);
   } catch (err) {

.github/scripts/cron-admin-update-spam-list.js

@@ -8,6 +8,7 @@
  */
 
 const fs = require('fs').promises;
+const { LABEL_AUTOMATED } = require('./labels.js');
 
 const SPAM_LIST_PATH = '.github/spam-list.txt';
 const dryRun = (process.env.DRY_RUN || 'false').toString().toLowerCase() === 'true';
@@ -229,7 +230,7 @@ module.exports = async ({github, context, core}) => {
           repo,
           title,
           body,
-          labels: [LABEL_SPAM_LIST_UPDATE, 'automated']
+          labels: [LABEL_SPAM_LIST_UPDATE, LABEL_AUTOMATED]
         });
         console.log('Issue created successfully');
       }

.github/scripts/labels.js

@@ -0,0 +1,11 @@
+/**
+ * Central location for label definitions to facilitate future changes.
+ * This file serves as the single source of truth for all GitHub label names used by automated workflows.
+ */
+const LABEL_BROKEN_MARKDOWN_LINKS = 'notes: broken markdown links';
+const LABEL_AUTOMATED = 'notes: automated';
+
+module.exports = {
+  LABEL_BROKEN_MARKDOWN_LINKS,
+  LABEL_AUTOMATED
+};

.github/spam-list.txt

@@ -10,3 +10,4 @@ OnlyTerp
 shixian-HFUT
 Yuki9814
 ashrafzunaira18
+HrachShah

.github/workflows/bot-coderabbit-plan-trigger.yml

@@ -5,16 +5,6 @@ name: CodeRabbit Plan Trigger
 on:
   issues:
     types: [labeled]
-  workflow_dispatch:
-    inputs:
-      dry_run:
-        description: "Run without posting comments"
-        required: false
-        default: "true"
-        type: choice
-        options:
-          - "true"
-          - "false"
 
 permissions:
   issues: write
@@ -28,10 +18,9 @@ jobs:
       cancel-in-progress: false
     # Only run when the newly added label is beginner, intermediate, or advanced (case-insensitive)
     if: >
-      github.event_name == 'workflow_dispatch' ||
-      (github.event.action == 'labeled' &&
+      github.event.action == 'labeled' &&
       github.event.issue.state == 'open' &&
-      contains(fromJson('["beginner","intermediate","advanced","Beginner","Intermediate","Advanced"]'), github.event.label.name))
+      contains(fromJson('["beginner","intermediate","advanced","Beginner","Intermediate","Advanced"]'), github.event.label.name)
 
     steps:
       - name: Harden the runner
@@ -45,7 +34,6 @@ jobs:
       - name: Trigger CodeRabbit Plan
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run || 'false' }}
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #v9.0.0
         with:
           script: |

.github/workflows/cron-pr-check-broken-links.yml

@@ -1,5 +1,9 @@
 name: Cron – Check Broken Markdown Links
 
+concurrency:
+  group: cron-check-broken-markdown-links
+  cancel-in-progress: false
+
 on:
   schedule:
     - cron: "0 0 1 * *"
@@ -42,12 +46,14 @@ jobs:
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
+            const { LABEL_BROKEN_MARKDOWN_LINKS, LABEL_AUTOMATED } = require('./.github/scripts/labels.js');
+
             // Determine if this is a dry run
             const isManual = context.eventName === 'workflow_dispatch';
-            const dryRun = isManual ? String(context.payload.inputs.dry_run).toLowerCase() === 'true' : false;
+            const dryRun = isManual ? String(context.payload?.inputs?.dry_run).toLowerCase() === 'true' : false;
 
             // Labels configuration
-            const targetLabels = ['broken-markdown-links', 'automated'];
+            const targetLabels = [LABEL_BROKEN_MARKDOWN_LINKS, LABEL_AUTOMATED];
             const issueTitle = "Scheduled Markdown Link Check Found Broken Links";
             const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
 

.github/workflows/request-triage-review.yml

@@ -18,8 +18,13 @@ jobs:
     runs-on: [self-hosted,hl-sdk-py-lin-md]
 
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        with:
+          egress-policy: audit
+
       - name: Request triage review
-        uses: actions/github-script@v9.0.0 #v9.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const tag = "<!-- triage -->";

CONTRIBUTING.md

@@ -32,7 +32,7 @@ Thank you for your interest in contributing to the Hiero Python SDK!
 3. Follow [Setup Guide](docs/sdk_developers/training/setup)
 4. Follow [Workflow Guide](docs/sdk_developers/workflow.md)
 5. GPG and DCO sign commits [Quickstart Signing](docs/sdk_developers/training/workflow/07_signing_requirements.md)
-6. Submit a PR [Quickstart Submit PR](docs/sdk_developers/training/workflow/11_submit_pull_request.md)
+6. Submit a PR [Quickstart Submit PR](docs/sdk_developers/training/workflow/10_submit_pull_request.md)
 
 **Detailed Docs:**
 

docs/roadmap.md

@@ -0,0 +1,24 @@
+# Hiero SDK Python — Roadmap
+
+This is a high-level quarterly roadmap for the Hiero SDK Python project. It is a living document, updated during team discussions.
+
+---
+
+## 2026 Q1 (Underway)
+
+- Implement [TCK](/tck) and [fuzzing tests](/tests/fuzz)
+- Implement [static workflow tests](/.github/workflows/)
+
+## 2026 Q2
+
+- Complete [TCK](/tck) tests
+- Implement 2 new HIPs
+
+## 2026 Q3
+
+- Improve core functionality robustness
+- Implement 2 new HIPs
+
+## 2026 Q4
+
+- Focus on remaining HIP implementations

pyproject.toml

@@ -16,7 +16,7 @@ requires-python = ">=3.10, <4"
 dependencies = [
     "protobuf>=4.21.12,<8",
     "grpcio>=1.76.0,<2",
-    "cryptography>=44.0.1,<47",
+    "cryptography>=44.0.1,<48",
     "requests>=2.31.0,<3",
     "pycryptodome>=3.18.0,<4",
     "eth-abi>=5.1.0,<6",