Add security policy (SECURITY.md) #255
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: | |
| inputs: | |
| run_contract_validation: | |
| description: Run live Stripe contract and drift validation | |
| required: false | |
| default: false | |
| type: boolean | |
| jobs: | |
| quality: | |
| name: Quality Checks | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| otp: ['27.0'] | |
| elixir: ['1.18.0', '1.20.0-rc.5'] | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Setup Elixir | |
| uses: erlef/setup-beam@v1 | |
| with: | |
| otp-version: ${{ matrix.otp }} | |
| elixir-version: ${{ matrix.elixir }} | |
| - name: Cache dependencies | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| deps | |
| _build | |
| key: ${{ runner.os }}-mix-${{ hashFiles('**/mix.lock') }} | |
| restore-keys: ${{ runner.os }}-mix- | |
| - name: Install dependencies | |
| run: mix deps.get | |
| - name: Compile (warnings as errors) | |
| run: mix compile --warnings-as-errors | |
| env: | |
| MIX_ENV: test | |
| - name: Check formatting | |
| run: mix format --check-formatted | |
| - name: Run Credo (strict) | |
| run: mix credo --strict --all | |
| - name: Cache Dialyzer PLT | |
| uses: actions/cache@v4 | |
| with: | |
| path: priv/plts | |
| key: ${{ runner.os }}-plt-${{ hashFiles('**/mix.lock') }} | |
| restore-keys: ${{ runner.os }}-plt- | |
| - name: Run Dialyzer | |
| run: mix dialyzer | |
| - name: Run tests | |
| run: mix test --warnings-as-errors | |
| contract-validation: | |
| name: Contract Validation (Stripe API) | |
| runs-on: ubuntu-latest | |
| if: ${{ github.event_name == 'workflow_dispatch' && inputs.run_contract_validation }} | |
| strategy: | |
| matrix: | |
| otp: ['27.0'] | |
| elixir: ['1.18.0', '1.20.0-rc.5'] | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Setup Elixir | |
| uses: erlef/setup-beam@v1 | |
| with: | |
| otp-version: ${{ matrix.otp }} | |
| elixir-version: ${{ matrix.elixir }} | |
| - name: Cache dependencies | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| deps | |
| _build | |
| key: ${{ runner.os }}-mix-${{ hashFiles('**/mix.lock') }} | |
| restore-keys: ${{ runner.os }}-mix- | |
| - name: Install dependencies | |
| run: mix deps.get | |
| - name: Check Stripe API key secret | |
| id: stripe_secret | |
| run: | | |
| if [ -z "$STRIPE_API_KEY" ]; then | |
| echo "configured=false" >> "$GITHUB_OUTPUT" | |
| echo "STRIPE_TEST_API_KEY is not configured; skipping live contract validation." | |
| else | |
| echo "configured=true" >> "$GITHUB_OUTPUT" | |
| fi | |
| env: | |
| STRIPE_API_KEY: ${{ secrets.STRIPE_TEST_API_KEY }} | |
| - name: Run contract tests against Stripe | |
| if: steps.stripe_secret.outputs.configured == 'true' | |
| run: | | |
| mix test \ | |
| test/paper_tiger/contract_test.exs \ | |
| test/paper_tiger/contract/payment_intent_chain_test.exs \ | |
| test/paper_tiger/contract_drift_test.exs | |
| env: | |
| STRIPE_API_KEY: ${{ secrets.STRIPE_TEST_API_KEY }} | |
| VALIDATE_AGAINST_STRIPE: true | |
| VALIDATE_CONTRACT_DRIFT: true |