Sidebranch

.env.example

@@ -175,57 +175,6 @@ INGESTION_STATE_FILE=.open-audit/ingestion-state.json
 # Default: 100
 INGESTION_COLD_START_LOOKBACK_LEDGERS=100
 
-# Starting ledger sequence number for captive-core ingestion.
-# Only used when STELLAR_CORE_BINARY is set.
-# Set to 0 to start from the most recent checkpoint.
-# Default: 0
-INGESTION_START_LEDGER=0
-
-
-# -----------------------------------------------------------------------------
-# Stellar Captive Core  (advanced / high-throughput ingestion)
-# [OPTIONAL] — leave these unset unless you are running a local Stellar Core
-#              node for full-history or high-throughput indexing.
-# -----------------------------------------------------------------------------
-
-# Absolute path to the stellar-core binary.
-# When unset, captive-core ingestion is disabled and the indexer falls back
-# to polling via the Soroban RPC.
-# Example: /usr/local/bin/stellar-core
-STELLAR_CORE_BINARY=
-
-# Transport protocol for the captive-core IPC channel.
-# stdio — communicate over stdin/stdout (default, simplest setup).
-# tcp   — communicate over a TCP socket (set STELLAR_CORE_STREAM_HOST and
-#         STELLAR_CORE_STREAM_PORT as well).
-# Default: stdio
-STELLAR_CORE_TRANSPORT=stdio
-
-# Host and port for captive-core TCP transport.
-# Only used when STELLAR_CORE_TRANSPORT=tcp.
-STELLAR_CORE_STREAM_HOST=127.0.0.1
-STELLAR_CORE_STREAM_PORT=11625
-
-# JSON object mapping archive names to Stellar history-archive URLs.
-# Required for captive-core to validate and catch up to the network.
-# Example (testnet):
-#   STELLAR_HISTORY_ARCHIVES={"sdf_testnet":"https://history.stellar.org/prd/core-testnet/core_testnet_001"}
-STELLAR_HISTORY_ARCHIVES=
-
-# How long (milliseconds) to wait for a heartbeat from the captive-core
-# process before treating it as unresponsive and triggering a restart.
-# Default: 30000
-STELLAR_CORE_HEARTBEAT_TIMEOUT_MS=30000
-
-# Delay (milliseconds) between captive-core restart attempts after a crash.
-# Default: 5000
-STELLAR_CORE_RESTART_DELAY_MS=5000
-
-# Maximum number of times the indexer will attempt to restart a failed
-# captive-core process before giving up.
-# Default: 2
-STELLAR_CORE_MAX_RESTARTS=2
-
 
 # -----------------------------------------------------------------------------
 # Data Retention & Archival

.github/dependabot.yml

@@ -0,0 +1,30 @@
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 10
+    versioning-strategy: increase
+    labels:
+      - "dependencies"
+      - "security"
+    commit-message:
+      prefix: "fix"
+      prefix-development: "chore"
+      include: "scope"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "security"
+    commit-message:
+      prefix: "fix"
+      prefix-development: "chore"
+      include: "scope"

.github/workflows/codeql.yml

@@ -0,0 +1,45 @@
+name: "CodeQL Advanced SAST"
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "0 6 * * 0"
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      packages: read
+      actions: read
+      contents: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: javascript-typescript
+            build-mode: none
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+          queries: security-extended
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:${{matrix.language}}"
+          # analyze@v4 uploads results to GitHub Security internally.
+          # Do NOT add a separate upload-sarif step here — it would fail
+          # because the SARIF file path is managed by the action itself.

.github/workflows/registry-lint.yml

@@ -0,0 +1,134 @@
+name: Registry Linter - 3-Tier Validation
+
+on:
+  pull_request:
+    paths:
+      - "lib/translator/registry.json"
+      - "lib/translator/registry.schema.json"
+      - "scripts/lint-registry.ts"
+      - "scripts/validate-registry.ts"
+  push:
+    branches: [main, master]
+    paths:
+      - "lib/translator/registry.json"
+      - "lib/translator/registry.schema.json"
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  lint-registry:
+    name: Validate Translation Registry
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: 📥 Checkout Repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: 🟢 Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: 📦 Install Dependencies
+        run: npm ci
+
+      - name: 🔍 Run Tier 1 - JSON Schema Validation
+        id: schema-validation
+        run: |
+          echo "::group::JSON Schema Validation"
+          node scripts/validate-registry.js
+          echo "::endgroup::"
+        continue-on-error: true
+
+      - name: 🔍 Run Tier 2 & 3 - Advanced Linting
+        id: advanced-linting
+        run: |
+          echo "::group::Template Variable Cross-Examination & Consistency Checks"
+          npx tsx scripts/lint-registry.ts
+          echo "::endgroup::"
+        continue-on-error: true
+
+      - name: 📊 Validation Summary
+        if: always()
+        run: |
+          echo "## 🔍 Registry Validation Results" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+
+          if [ "${{ steps.schema-validation.outcome }}" == "success" ] && [ "${{ steps.advanced-linting.outcome }}" == "success" ]; then
+            echo "### ✅ All validation checks passed!" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "- ✓ Tier 1: JSON Schema validation" >> $GITHUB_STEP_SUMMARY
+            echo "- ✓ Tier 2: Template variable cross-examination" >> $GITHUB_STEP_SUMMARY
+            echo "- ✓ Tier 3: Logical consistency checks" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "### ❌ Validation failed!" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "| Validation Tier | Status |" >> $GITHUB_STEP_SUMMARY
+            echo "|----------------|---------|" >> $GITHUB_STEP_SUMMARY
+
+            if [ "${{ steps.schema-validation.outcome }}" == "success" ]; then
+              echo "| Tier 1: JSON Schema | ✅ Passed |" >> $GITHUB_STEP_SUMMARY
+            else
+              echo "| Tier 1: JSON Schema | ❌ Failed |" >> $GITHUB_STEP_SUMMARY
+            fi
+
+            if [ "${{ steps.advanced-linting.outcome }}" == "success" ]; then
+              echo "| Tier 2 & 3: Advanced Linting | ✅ Passed |" >> $GITHUB_STEP_SUMMARY
+            else
+              echo "| Tier 2 & 3: Advanced Linting | ❌ Failed |" >> $GITHUB_STEP_SUMMARY
+            fi
+
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "Please check the job logs above for detailed error messages." >> $GITHUB_STEP_SUMMARY
+          fi
+
+      - name: ❌ Fail if validation failed
+        if: steps.schema-validation.outcome != 'success' || steps.advanced-linting.outcome != 'success'
+        run: |
+          echo "::error::Registry validation failed. Please fix the errors above."
+          exit 1
+
+      - name: 📝 Comment on PR (on failure)
+        if: failure() && github.event_name == 'pull_request'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            const body = `## ❌ Translation Registry Validation Failed
+
+            The automated registry linter has detected issues with your translation registry changes.
+
+            ### What went wrong?
+
+            The validation pipeline runs 3 tiers of checks:
+
+            1. **JSON Schema Validation** - Ensures proper structure and data types
+            2. **Template Variable Cross-Examination** - Verifies all \`{variables}\` in templates match the \`event_structure\` fields
+            3. **Logical Consistency** - Checks for duplicates and alignment issues
+
+            ### How to fix:
+
+            1. Review the detailed error logs in the [Actions tab](${context.payload.pull_request.html_url}/checks)
+            2. Look for error messages like:
+               - \`Template references '{amount}' but event_structure only provides [value, from, to]\`
+               - \`Schema validation failed: must have required property 'contract_id'\`
+               - \`Topics array length mismatch\`
+            3. Fix the issues in your registry entry
+            4. Push your changes to re-trigger validation
+
+            ### Need help?
+
+            Check the [contribution guidelines](../CONTRIBUTING.md) or ask in the community Discord.
+            `;
+
+            github.rest.issues.createComment({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: body
+            });

.github/workflows/registry-preview.yml

@@ -0,0 +1,74 @@
+name: Registry Translation Preview
+
+on:
+  pull_request:
+    paths:
+      - "lib/translator/registry.json"
+
+permissions:
+  pull-requests: write
+
+jobs:
+  preview:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Generate preview
+        id: preview
+        run: |
+          OUTPUT=$(node scripts/registry-preview.js 2>&1)
+          EXIT_CODE=$?
+
+          # Store multiline output for the comment step
+          echo "body<<EOF" >> $GITHUB_OUTPUT
+          echo "$OUTPUT" >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+          echo "success=$( [ $EXIT_CODE -eq 0 ] && echo true || echo false )" >> $GITHUB_OUTPUT
+
+          # Always exit 0 here so the comment step can run and post the error feedback
+          exit 0
+
+      - name: Post or update PR comment
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const marker = '<!-- registry-preview -->';
+            const body = `${marker}\n${process.env.PREVIEW_BODY}`;
+
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+            });
+
+            const existing = comments.find(c => c.body.startsWith(marker));
+
+            if (existing) {
+              await github.rest.issues.updateComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: existing.id,
+                body,
+              });
+            } else {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.issue.number,
+                body,
+              });
+            }
+        env:
+          PREVIEW_BODY: ${{ steps.preview.outputs.body }}
+
+      - name: Fail if preview generation failed
+        if: steps.preview.outputs.success == 'false'
+        run: |
+          echo "Preview failed — see PR comment for details."
+          exit 1