Security scan, dependency audit, and repo hygiene (#203)

* Add LICENSE files, fix workspace license to GPL-3.0-only, and add license metadata

Add LICENSE-GPL3 and LICENSE-APACHE2 at the repo root. Set the workspace
default to GPL-3.0-only (runtime/node crates) and override to Apache-2.0
for library/SDK crates. Fix the repository URL to paritytech/web3-storage.
Add missing workspace metadata to file-system-primitives and
file-system-client. Add license fields to all package.json files.

* Add disclaimer, badges, security section, and fix license refs in READMEs

Add prototype/PoC warning banner, CI and license badges, and a Security
section pointing to the paritytech org-level policy to the root README.
Rewrite the root license section to describe the dual-license setup.
Update existing license references in sub-READMEs to link to the correct
LICENSE file, and add license footers to the 7 READMEs that were missing
them.

* Revise warnings and enhance badge visibility

Updated warning messages and added security and status badges.

* Update badge from Polkadot SDK to Substrate

* Update badge link from Polkadot SDK to Substrate

* Fix security badge URL, trailing whitespace, and disclaimer text

- Security badge now links to web3-storage/security (not
  polkadot-bulletin-chain)
- Remove trailing whitespace on badge line
- Tighten disclaimer: concise but retains "not audited" and
  "use at your own risk"

* Add SPDX license headers to all source files

GPL-3.0-only: provider-node, runtime, runtimes, user-interfaces (excl SDK)
Apache-2.0: pallet, primitives, client, precompiles, storage-interfaces,
user-interfaces/sdk/typescript, examples/papi

Closes #198 (part 3/3)

* Add CONTRIBUTING.md and sub-crate READMEs

Add CONTRIBUTING.md with setup instructions, PR process, code style,
dual-license table, and security policy. Add minimal READMEs to
pallet/, primitives/, provider-node/, and runtime/. Simplify the
Contributing section in the root README to point to CONTRIBUTING.md.

Closes part of #198.

* Add cargo-deny config, gitleaks baseline, and .gitignore fixes

Add deny.toml allowing all licenses found in the dependency tree.
Add .gitleaksignore to suppress false positives from well-known
Substrate dev account addresses in chain specs and docs.
Fix .gitignore: add desktop.ini, remove duplicate __pycache__ entry.

Audit results (PR 5 of #198):
- gitleaks: 9 findings, all false positives (Alice/Bob dev keys)
- cargo deny: all dependencies use permissive or GPL-compatible licenses
- JS deps: all permissive (MIT/Apache/ISC/BSD); 4 UNLICENSED are our own
  packages that already declare Apache-2.0 in source package.json
- No git deps, no personal-namespace forks
- No hardcoded secrets, internal URLs, or stale CI scripts
- Google Doc link in docs/design/ is an intentionally public document

Closes #198.

* ci(security): add cargo-deny + gitleaks workflow

Adds a standalone security workflow that runs license/dependency auditing
(cargo-deny) and secret scanning (gitleaks) on push, PR, and weekly cron.
cargo-deny runs in the ci-unified image; gitleaks installs its binary on a
plain runner. Advisory checks are non-blocking on PRs to avoid DB drift.

* ci(security): run security scan daily instead of weekly

* ci(security): note daily cadence in schedule comment

* ci(security): suppress zizmor unpinned-images for security.yml

Same documented exception as check.yml — the container image is resolved at
runtime from the trusted .github/env via the set-image reusable workflow and
cannot be pinned to a digest in-line.

* ci(security): install current cargo-deny for CVSS v4.0 support

The cargo-deny bundled in the ci-unified image fails to load the advisory
database because it cannot parse RUSTSEC advisories using CVSS v4.0. Install
a current cargo-deny over the bundled one so the advisories check runs.

* ci(security): move GITLEAKS_VERSION to .github/env

Keep tool version pins centralized in .github/env like the other versions;
the gitleaks job loads it via the standard 'cat .github/env >> GITHUB_ENV' step.

* ci(security): run cargo-deny on ubuntu-latest, drop set-image

cargo deny only reads the dependency graph (cargo metadata + Cargo.lock), so
it needs no SDK toolchain or CI container. Running it on ubuntu-latest removes
the set-image dependency and the zizmor unpinned-images exception; RUSTUP_TOOLCHAIN
is set to stable so cargo metadata doesn't pull the pinned toolchain.

* ci(security): install cargo-deny via taiki-e/install-action

Use a prebuilt binary instead of 'cargo install' to avoid the ~2 min compile.
taiki-e/install-action pulls the latest cargo-deny release, which supports
CVSS v4.0 advisories.

---------

Co-authored-by: Branislav Kontur <bkontur@gmail.com>

Author: mudigal

.github/env

@@ -8,3 +8,4 @@ CI_IMAGE=docker.io/paritytech/ci-unified:bullseye-1.93.0-2026-01-27-v20260304235
 NODE_VERSION=22
 SOLC_VERSION=0.8.34
 RESOLC_VERSION=1.1.0
+GITLEAKS_VERSION=8.29.0

.github/workflows/security.yml

@@ -0,0 +1,94 @@
+name: Security
+
+on:
+  push:
+    branches: [main, dev]
+  pull_request:
+    branches: [main, dev]
+  # Daily re-scan of unchanged code for newly-published advisories / leaks.
+  schedule:
+    - cron: '17 6 * * *' # daily at 06:17 UTC
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  cargo-deny:
+    name: Dependency audit (cargo-deny)
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    # cargo deny only reads the dependency graph (cargo metadata + Cargo.lock),
+    # so it needs no SDK toolchain — use stable rather than the pinned one.
+    env:
+      RUSTUP_TOOLCHAIN: stable
+    steps:
+      - name: Checkout sources
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          persist-credentials: false
+
+      - name: Install cargo-deny
+        uses: taiki-e/install-action@15449e3094499af05d8d964a1c884208e4b8b595 # v2.81.11
+        with:
+          tool: cargo-deny
+
+      - name: Check licenses, bans, sources
+        run: cargo deny --locked check licenses bans sources
+
+      # Advisory DB drifts over time, so keep it non-blocking on PRs.
+      - name: Check advisories
+        run: cargo deny --locked check advisories
+        continue-on-error: ${{ github.event_name == 'pull_request' }}
+
+  # gitleaks is not in ci-unified and needs no Rust toolchain — run it standalone.
+  gitleaks:
+    name: Secret scan (gitleaks)
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout sources
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          fetch-depth: 0 # full history so every commit is scanned
+          persist-credentials: false
+
+      - name: Load common environment variables via env file
+        run: cat .github/env >> "$GITHUB_ENV"
+
+      - name: Cache gitleaks
+        id: cache-gitleaks
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+        with:
+          path: ~/.local/bin/gitleaks
+          key: gitleaks-${{ env.GITLEAKS_VERSION }}-${{ runner.os }}
+
+      # Install the binary, not the action — the action needs a license secret in an org.
+      - name: Install gitleaks
+        if: steps.cache-gitleaks.outputs.cache-hit != 'true'
+        run: |
+          mkdir -p ~/.local/bin
+          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
+            | tar -xz -C ~/.local/bin gitleaks
+          chmod +x ~/.local/bin/gitleaks
+
+      # .gitleaksignore is honored automatically; --redact keeps matches out of logs.
+      - name: Scan for secrets
+        run: ~/.local/bin/gitleaks detect --source . --redact --no-banner --verbose
+
+  # Aggregate gate — require this in branch protection (mirrors `basic-checks`).
+  security:
+    name: Security
+    needs: [cargo-deny, gitleaks]
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+      - name: Decide outcome
+        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
+        run: |
+          echo "Security checks failed or were cancelled"
+          exit 1

.gitignore

@@ -12,6 +12,7 @@
 # OS
 .DS_Store
 Thumbs.db
+desktop.ini
 
 # Test artifacts
 *.log
@@ -61,7 +62,4 @@ user-interfaces/**/test-results/
 *.docx
 
 # Screenshots
-Screenshot.png
-
-# Python
-__pycache__
+Screenshot.png

.gitleaksignore

@@ -0,0 +1,15 @@
+# All findings are well-known Substrate development accounts (Alice, Bob, etc.)
+# used in chain specs and documentation — not real secrets.
+
+# Alice's SS58 address in genesis chain specs
+a8829e9e6e82f235be67103d3ced5f0be8e632fc:zombienet/storage-local-spec.json:generic-api-key:105
+ebab9789e0a12d49dc89713bf6d74f67d89c7460:chain-specs/storage-local.json:generic-api-key:26
+865d2deed77a4b2fdb5a28999e38eadeb5e7dc2b:chain-specs/storage-rococo.json:generic-api-key:58
+b8f1c040408903b47c8d1c2f42015a301f0d7c88:scripts/genesis-patch.json:generic-api-key:34
+d1c4b2d63a2c25136cc06e30495438f911d946d9:scripts/genesis-patch.json:generic-api-key:34
+dfb793c101c6a872ebed54701d1c4e339573f105:scripts/genesis-patch.json:generic-api-key:34
+b72a3d9f77f1257b3cee601a9bd096879c02e0d9:scripts/genesis-patch.json:generic-api-key:34
+
+# Alice/Bob public keys in testing documentation
+d7234303b34d5b3f153ff5dbdc4a95555f6d707c:docs/testing/MANUAL_TESTING_GUIDE.md:generic-api-key:294
+d7234303b34d5b3f153ff5dbdc4a95555f6d707c:docs/testing/MANUAL_TESTING_GUIDE.md:generic-api-key:298

README.md

@@ -318,12 +318,6 @@ The security policy for this project is governed by the
 [paritytech organization-level security policy](https://github.com/paritytech/.github/blob/master/SECURITY.md).
 If you discover a vulnerability, please follow the responsible disclosure process described there.
 
-## Security
-
-The security policy for this project is governed by the
-[paritytech organization-level security policy](https://github.com/paritytech/.github/blob/master/SECURITY.md).
-If you discover a vulnerability, please follow the responsible disclosure process described there.
-
 ## License
 
 This project is dual-licensed:

deny.toml

@@ -0,0 +1,37 @@
+# Configuration for cargo-deny (https://embarkstudios.github.io/cargo-deny/)
+#
+# Run: cargo deny check licenses
+
+[licenses]
+version = 2
+allow = [
+    "Apache-2.0",
+    "Apache-2.0 WITH LLVM-exception",
+    "BSD-1-Clause",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "BSL-1.0",
+    "CC0-1.0",
+    "CDLA-Permissive-2.0",
+    "GPL-3.0",
+    "GPL-3.0-only",
+    "ISC",
+    "LGPL-2.1-or-later",
+    "MIT",
+    "MIT-0",
+    "MPL-2.0",
+    "Unicode-3.0",
+    "Unlicense",
+    "Zlib",
+    "0BSD",
+]
+
+# Some older crates use non-SPDX license expressions (e.g. "MIT/Apache-2.0"
+# or "Apache-2.0/GPL-3.0"). cargo-deny emits parse warnings for these but
+# the underlying licenses are all in the allow list above.
+
+# r-efi (LGPL-2.1-or-later) is only compiled for UEFI targets, which are
+# outside our target set. It is allowed above for completeness.
+
+[licenses.private]
+ignore = true