Merge branch 'main' into chore/update-crypto-public-key

Author: MonaaEid

.github/scripts/bot-p0-issues-notify-team.js

@@ -1,31 +1,37 @@
 // Script to notify the team when a P0 issue is created.
 
+const CRITICAL_LABEL = 'priority: critical';
 const marker = '<!-- P0 Issue Notification -->';
 
-  async function notifyTeam(github, owner, repo, issue, marker) {
-    const comment = `${marker} :rotating_light: Attention Team :rotating_light:
+async function notifyTeam(github, owner, repo, issue, marker) {
+  const safeTitle = String(issue.title || '(no title)')
+    .replace(/[\r\n]+/g, ' ')
+    .replace(/@/g, '@\u200b')
+    .trim();
+
+  const comment = `${marker} :rotating_light: Attention Team :rotating_light:
 @hiero-ledger/hiero-sdk-python-maintainers @hiero-ledger/hiero-sdk-python-committers @hiero-ledger/hiero-sdk-python-triage
 
-A new P0 issue has been created: #${issue.number} - ${issue.title || '(no title)'}
+A new critical priority issue has been created: #${issue.number} - ${safeTitle}
 Please prioritize this issue accordingly.
 
 Best Regards,
 Automated Notification System`;
 
-    try {
-      await github.rest.issues.createComment({
-        owner,
-        repo,
-        issue_number: issue.number,
-        body: comment,
-      });
-      console.log(`Notified team about P0 issue #${issue.number}`);
-      return true;
-    } catch (commentErr) {
-      console.log(`Failed to notify team about P0 issue #${issue.number}:`, commentErr.message || commentErr);
-      return false;
-    }
+  try {
+    await github.rest.issues.createComment({
+      owner,
+      repo,
+      issue_number: issue.number,
+      body: comment,
+    });
+    console.log(`Notified team about ${CRITICAL_LABEL} issue #${issue.number}`);
+    return true;
+  } catch (commentErr) {
+    console.log(`Failed to notify team about ${CRITICAL_LABEL} issue #${issue.number}:`, commentErr.message || commentErr);
+    return false;
   }
+}
 
 module.exports = async ({ github, context }) => {
   try {
@@ -34,8 +40,8 @@ module.exports = async ({ github, context }) => {
 
     // Validations
     if (!issue?.number) return console.log('No issue in payload');
-    if (label?.name?.toLowerCase() !== 'p0') return;
-    if (!issue.labels?.some(l => l?.name?.toLowerCase() === 'p0')) return;
+    if (label?.name?.toLowerCase() !== CRITICAL_LABEL.toLowerCase()) return;
+    if (!issue.labels?.some((l) => l?.name?.toLowerCase() === CRITICAL_LABEL.toLowerCase())) return;
 
     // Check for existing comment
     const comments = await github.paginate(github.rest.issues.listComments, {
@@ -44,7 +50,7 @@ module.exports = async ({ github, context }) => {
     if (comments.some(c => c.body?.includes(marker))) {
       return console.log(`Notification already exists for #${issue.number}`);
     }
-  // Post notification
+    // Post notification
     await notifyTeam(github, owner, repo, issue, marker);
 
     console.log('=== Summary ===');

.github/scripts/cron-admin-update-spam-list.js

@@ -12,6 +12,14 @@ const fs = require('fs').promises;
 const SPAM_LIST_PATH = '.github/spam-list.txt';
 const dryRun = (process.env.DRY_RUN || 'false').toString().toLowerCase() === 'true';
 
+/**
+ * These constants control the GitHub label names used by the spam automation.
+ * To rename labels, update only the constant values here.
+ * Ensure corresponding labels exist in the GitHub repository settings.
+ */
+const LABEL_SPAM = 'notes: spam';
+const LABEL_SPAM_LIST_UPDATE = 'notes: spam-list-update';
+
 // Load current spam list and compute updates based on spam vs rehabilitated users
 
 async function computeSpamListUpdates(spamUsers, rehabilitatedUsers) {
@@ -121,7 +129,7 @@ module.exports = async ({github, context, core}) => {
     const searches = [
       {
         name: 'spam PRs',
-        query: `repo:${owner}/${repo} is:pr is:closed -is:merged label:spam`,
+        query: `repo:${owner}/${repo} is:pr is:closed -is:merged label:"${LABEL_SPAM}"`,
         process: async (pr) => {
           if (!pr.user?.login) {
             console.log(`Skipping PR #${pr.number}: user account unavailable`);
@@ -208,7 +216,7 @@ module.exports = async ({github, context, core}) => {
         const { data: existing } = await github.rest.issues.listForRepo({
           owner,
           repo,
-          labels: 'spam-list-update',
+          labels: LABEL_SPAM_LIST_UPDATE,
           state: 'open',
           per_page: 1
         });
@@ -221,7 +229,7 @@ module.exports = async ({github, context, core}) => {
           repo,
           title,
           body,
-          labels: ['spam-list-update', 'automated']
+          labels: [LABEL_SPAM_LIST_UPDATE, 'automated']
         });
         console.log('Issue created successfully');
       }

.github/scripts/pr-check-test-files.js

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+
+const { execSync } = require("child_process");
+const fs = require("fs");
+
+// These are the directories we want to check for correct naming
+const TEST_DIRS = ["tests/unit", "tests/integration", "tests/tck", "tests/fuzz"];
+
+// These are the excluded paths and file names inside the TEST_DIRS
+const IGNORED = ["tests/fuzz/support"];
+const EXCEPTIONS = ["conftest.py", "__init__.py", "init.py", "mock_server.py", "utils.py"];
+
+// Collect naming errors to report at the end
+const nameErrors = [];
+
+// Use "git ls-files" to get all tracked files in the repository
+const output = execSync("git ls-files", { encoding: "utf-8" });
+// Split output into lines and filter out empty lines for easy manipulation
+// e.g. output = "tests/unit/my_test.py\ntests/integration/other_test.py"
+const files = output.split("\n").filter(Boolean);
+
+for (const file of files) {
+  // --- PATH FILTERING ---
+  // Skip files that are not in any of the specified test directories
+  if (!TEST_DIRS.some(dir => file.startsWith(dir))) continue;
+
+  // Skip ignored paths (e.g. helpers)
+  if (IGNORED.some(path => file.startsWith(path))) continue;
+
+  // Now we have file paths that we need to check for correct naming
+  // e.g. file = "tests/unit/my_test.py"
+
+  // --- Correct PATH now apply NAMING checks ---
+
+  // Extract the file name from the path
+  // e.g. from file = "tests/unit/my_test.py" get name = "my_test.py"
+  const name = file.split("/").pop();
+
+  // Skip allowed special files
+  if (EXCEPTIONS.includes(name)) continue;
+
+  // Enforce naming rule on files
+  if (!name.endsWith("_test.py")) {
+    console.error(`Invalid test file name: ${file}`);
+    console.error(`::error file=${file}::Must end with '_test.py'`);
+    nameErrors.push(file);
+  }
+}
+
+// Generate a summary of the results for the GitHub Actions UI
+const summaryPath = process.env.GITHUB_STEP_SUMMARY;
+
+if (summaryPath) {
+  let summary = `## 🧪 Test File Naming Check\n\n`;
+
+  if (nameErrors.length === 0) {
+    summary += `✅ All test files are correctly named\n`;
+  } else {
+    // Counts and lists all the incorrectly named test files
+    summary += `❌ Found ${nameErrors.length} incorrectly named test files:\n\n`;
+    nameErrors.forEach(f => {
+      summary += `- \`${f}\`\n`;
+    });
+  }
+
+  fs.appendFileSync(summaryPath, summary);
+}
+
+// Fail job if needed
+if (nameErrors.length > 0) {
+  process.exit(1);
+}

.github/scripts/pr-check-test-files.sh

@@ -28,7 +28,7 @@ jobs:
     runs-on: hl-sdk-py-lin-md
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
         with:
           egress-policy: audit
 

.github/workflows/bot-advanced-check.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: hl-sdk-py-lin-md
     steps:
       - name: Harden the runner
-        uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
         with:
           egress-policy: audit
 

.github/workflows/bot-assignment-check.yml

@@ -23,7 +23,7 @@ jobs:
 
         steps:
             - name: Harden runner
-              uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
+              uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
               with:
                   egress-policy: audit
 

.github/workflows/bot-beginner-assign-on-comment.yml

@@ -35,7 +35,7 @@ jobs:
 
     steps:
       - name: Harden the runner
-        uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
         with:
           egress-policy: audit
 

.github/workflows/bot-coderabbit-plan-trigger.yml

@@ -24,7 +24,7 @@ jobs:
 
         steps:
             - name: Harden runner
-              uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
+              uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
               with:
                   egress-policy: audit
 

.github/workflows/bot-gfi-assign-on-comment.yml

@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: Harden the runner
-        uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40
         with:
           egress-policy: audit