Skip to content

Commit b705e62

Browse files
opensource-SantanderAIopensource-SantanderAI
committed
Initial public release
0 parents  commit b705e62

45 files changed

Lines changed: 4002 additions & 0 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/ISSUE_TEMPLATE/bug_report.yml‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
name: Bug report
2+
description: Report a reproducible problem with causal-perception-implementation
3+
title: "[bug]: "
4+
labels: ["bug", "triage"]
5+
body:
6+
- type: markdown
7+
attributes:
8+
value: |
9+
Thanks for taking the time to file a bug report. Please fill in the
10+
sections below — the more reproducibility info you provide, the
11+
faster we can help.
12+
13+
> For security vulnerabilities, do NOT open a public issue. Follow
14+
> the process in [SECURITY.md](../blob/main/.github/SECURITY.md).
15+
16+
- type: textarea
17+
id: summary
18+
attributes:
19+
label: Summary
20+
description: A clear, concise description of the bug.
21+
placeholder: When I run the fair-decisions experiment, load_data() raises…
22+
validations:
23+
required: true
24+
25+
- type: textarea
26+
id: repro
27+
attributes:
28+
label: Steps to reproduce
29+
description: Minimal commands or code that trigger the issue.
30+
placeholder: |
31+
1. `pip install -e ".[dev,viz]"`
32+
2. Run `python -m src.run_fair_decisions`
33+
3. See traceback
34+
render: shell
35+
validations:
36+
required: true
37+
38+
- type: textarea
39+
id: expected
40+
attributes:
41+
label: Expected behaviour
42+
validations:
43+
required: true
44+
45+
- type: textarea
46+
id: actual
47+
attributes:
48+
label: Actual behaviour (incl. full traceback if any)
49+
render: shell
50+
validations:
51+
required: true
52+
53+
- type: input
54+
id: python
55+
attributes:
56+
label: Python version
57+
placeholder: "3.11.9"
58+
validations:
59+
required: true
60+
61+
- type: input
62+
id: os
63+
attributes:
64+
label: Operating system
65+
placeholder: "macOS 14.5 / Ubuntu 22.04 / Windows 11"
66+
validations:
67+
required: true
68+
69+
- type: checkboxes
70+
id: checks
71+
attributes:
72+
label: Pre-flight
73+
options:
74+
- label: I have searched existing issues and this is not a duplicate
75+
required: true
76+
- label: I have read the documentation in the README
77+
required: true
78+
- label: I agree to follow the project's Code of Conduct
79+
required: true

‎.github/ISSUE_TEMPLATE/config.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
blank_issues_enabled: false
2+
contact_links:
3+
- name: Security vulnerability
4+
url: https://github.com/SantanderAI/causal-perception-implementation/security/advisories/new
5+
about: Report a security vulnerability privately (do NOT open a public issue).

‎.github/ISSUE_TEMPLATE/feature_request.yml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
name: Feature request
2+
description: Suggest a new feature or improvement
3+
title: "[feat]: "
4+
labels: ["enhancement", "triage"]
5+
body:
6+
- type: markdown
7+
attributes:
8+
value: |
9+
Thanks for proposing a new feature. Please describe the *problem*
10+
you are trying to solve first, then your suggested solution.
11+
12+
- type: textarea
13+
id: problem
14+
attributes:
15+
label: Problem
16+
description: What problem does this feature solve? Who feels the pain?
17+
placeholder: Reproducing the experiments on Linux fails because…
18+
validations:
19+
required: true
20+
21+
- type: textarea
22+
id: solution
23+
attributes:
24+
label: Proposed solution
25+
description: How would you solve it? API sketch, CLI flag, etc.
26+
validations:
27+
required: true
28+
29+
- type: textarea
30+
id: alternatives
31+
attributes:
32+
label: Alternatives considered
33+
34+
- type: textarea
35+
id: context
36+
attributes:
37+
label: Additional context
38+
description: Links, papers, prior art, screenshots, etc.
39+
40+
- type: checkboxes
41+
id: checks
42+
attributes:
43+
label: Pre-flight
44+
options:
45+
- label: I have searched existing issues and this is not a duplicate
46+
required: true
47+
- label: I have read CONTRIBUTING.md and I am willing to discuss the design before implementation
48+
required: true
49+
- label: I agree to follow the project's Code of Conduct
50+
required: true

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
<!--
2+
Thanks for your contribution! Please fill in this template and remove the
3+
comment markers before submitting.
4+
-->
5+
6+
## Summary
7+
8+
<!-- One or two sentences describing what this PR does and why. -->
9+
10+
## Type of change
11+
12+
- [ ] `feat` — new feature
13+
- [ ] `fix` — bug fix
14+
- [ ] `docs` — documentation only
15+
- [ ] `test` — adding or updating tests
16+
- [ ] `refactor` — code refactoring (no feature/fix)
17+
- [ ] `ci` — CI/CD changes
18+
- [ ] `chore` — maintenance
19+
20+
## Linked issues
21+
22+
<!-- e.g. Closes #123, Refs #456 -->
23+
24+
## Checklist
25+
26+
- [ ] Commit messages follow [Conventional Commits](https://www.conventionalcommits.org/)
27+
- [ ] Tests added or updated (`pytest tests/ -v --cov=src`)
28+
- [ ] Coverage stays at or above 80%
29+
- [ ] Lint/format/type pass locally (`ruff check . && black --check . && mypy src/`)
30+
- [ ] Documentation updated (README, CHANGELOG, docstrings) if behaviour changed
31+
- [ ] No third-party data (e.g. the German Credit dataset) is committed
32+
- [ ] I have signed the CLA (the bot will prompt me if not)
33+
- [ ] I agree to follow the project's [Code of Conduct](../blob/main/CODE_OF_CONDUCT.md)
34+
35+
## Notes for reviewers
36+
37+
<!-- Anything reviewers should pay special attention to: tricky logic,
38+
reproduction steps, benchmark numbers, etc. -->

‎.github/SECURITY.md‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
# Security Policy
2+
3+
## Reporting a Vulnerability
4+
5+
If you discover a security vulnerability in this project, please report it responsibly. **Do not open a public GitHub issue for security vulnerabilities.**
6+
7+
### How to Report
8+
9+
1. **Email**: Send a detailed report to **security-opensource@gruposantander.com**
10+
2. **GitHub Security Advisories**: Alternatively, use [GitHub Security Advisories](../../security/advisories/new) to report privately.
11+
12+
### What to Include
13+
14+
- Description of the vulnerability
15+
- Steps to reproduce
16+
- Potential impact
17+
- Suggested fix (if any)
18+
19+
### Response SLA
20+
21+
| Stage | SLA |
22+
|:---|:---|
23+
| Acknowledgment of report | < 48 hours |
24+
| Initial assessment and severity classification | < 7 days |
25+
| Fix for Critical/High severity | < 30 days |
26+
| Fix for Medium/Low severity | < 90 days |
27+
28+
### What Happens Next
29+
30+
1. We will acknowledge your report within 48 hours.
31+
2. We will investigate and determine the severity.
32+
3. We will develop and test a fix.
33+
4. We will release the fix and publish a security advisory.
34+
5. We will credit you publicly in the advisory and CHANGELOG (unless you prefer to remain anonymous).
35+
36+
## Scope
37+
38+
This security policy applies **only** to code in this repository. It does not cover:
39+
40+
- Santander's internal infrastructure or systems
41+
- Other Santander products or services
42+
- Third-party dependencies (report those to the respective maintainers)
43+
- The third-party German Credit dataset (not redistributed here; see `data/README.md`)
44+
45+
## Supported Versions
46+
47+
| Version | Supported |
48+
|:---|:---|
49+
| Latest release | Yes |
50+
| Previous minor release | Security fixes only |
51+
| Older versions | No |
52+
53+
## Security Best Practices for Contributors
54+
55+
- Never commit secrets, API keys, tokens, or credentials
56+
- Never commit internal URLs, IP addresses, or corporate email addresses
57+
- Never commit personally identifiable information (PII) or customer data
58+
- Never commit the German Credit dataset or any other third-party data
59+
- Use environment variables for any configuration that could be sensitive
60+
- Keep dependencies up to date (Dependabot is enabled on this repository)
61+
62+
## Disclosure Policy
63+
64+
We follow a coordinated disclosure process. We ask that you:
65+
66+
- Give us reasonable time to fix the vulnerability before public disclosure
67+
- Do not exploit the vulnerability beyond what is necessary to demonstrate it
68+
- Do not access or modify data that does not belong to you

‎.github/dependabot.yml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# Copyright (c) 2026 Santander Group
2+
# SPDX-License-Identifier: Apache-2.0
3+
#
4+
# Dependabot configuration.
5+
# Docs: https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
6+
7+
version: 2
8+
updates:
9+
# Python runtime + dev dependencies declared in pyproject.toml
10+
- package-ecosystem: pip
11+
directory: /
12+
schedule:
13+
interval: monthly
14+
day: monday
15+
time: "06:00"
16+
timezone: Europe/Madrid
17+
open-pull-requests-limit: 5
18+
labels:
19+
- dependencies
20+
- python
21+
commit-message:
22+
prefix: "chore(deps)"
23+
include: scope
24+
groups:
25+
python-minor-patch:
26+
update-types:
27+
- minor
28+
- patch
29+
30+
# GitHub Actions used by workflows in .github/workflows/
31+
# Dependabot keeps SHA pins fresh and bumps the human-readable version comment.
32+
# Grouped so a single PR covers all minor/patch action bumps.
33+
- package-ecosystem: github-actions
34+
directory: /
35+
schedule:
36+
interval: monthly
37+
day: monday
38+
time: "06:00"
39+
timezone: Europe/Madrid
40+
open-pull-requests-limit: 5
41+
labels:
42+
- dependencies
43+
- github-actions
44+
commit-message:
45+
prefix: "ci(deps)"
46+
include: scope
47+
groups:
48+
gha-minor-patch:
49+
update-types:
50+
- minor
51+
- patch

‎.github/pattern-check-allowlist.txt‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# Allowlist for `.github/workflows/pattern-check.yml`.
2+
# One literal substring per line. A scanned line that contains ANY of these
3+
# substrings is allowed even if it matches a pattern.
4+
#
5+
# Use this ONLY for legitimate public-facing contacts and identifiers.
6+
# Do NOT add internal URLs, IPs or hostnames here — fix the source instead.
7+
8+
# Public security & code-of-conduct mailboxes (intentionally on the public
9+
# corporate domain — these are the documented contact points published in
10+
# SECURITY.md and CODE_OF_CONDUCT.md):
11+
opensource@gruposantander.com
12+
security-opensource@gruposantander.com

‎.github/workflows/ci.yml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
# Copyright (c) 2026 Santander Group
2+
# SPDX-License-Identifier: Apache-2.0
3+
#
4+
# Lint + format + type-check + tests + coverage.
5+
# All third-party action references are pinned to 40-char commit SHAs.
6+
7+
name: CI
8+
9+
on:
10+
push:
11+
branches: [main, development]
12+
pull_request:
13+
14+
permissions:
15+
contents: read
16+
17+
concurrency:
18+
group: ci-${{ github.ref }}
19+
cancel-in-progress: true
20+
21+
jobs:
22+
lint:
23+
name: Lint & format & type-check
24+
runs-on: ubuntu-latest
25+
steps:
26+
- name: Checkout
27+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
28+
- name: Set up Python
29+
uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
30+
with:
31+
python-version: "3.11"
32+
cache: pip
33+
- name: Install dev dependencies
34+
run: |
35+
python -m pip install --upgrade pip
36+
pip install -e ".[dev]"
37+
- name: Ruff
38+
run: ruff check .
39+
- name: Black --check
40+
run: black --check .
41+
- name: Mypy
42+
run: mypy src/
43+
44+
test:
45+
name: Test (Python ${{ matrix.python-version }})
46+
runs-on: ubuntu-latest
47+
strategy:
48+
fail-fast: false
49+
matrix:
50+
python-version: ["3.10", "3.11", "3.12"]
51+
steps:
52+
- name: Checkout
53+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
54+
- name: Set up Python ${{ matrix.python-version }}
55+
uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
56+
with:
57+
python-version: ${{ matrix.python-version }}
58+
cache: pip
59+
- name: Install package
60+
run: |
61+
python -m pip install --upgrade pip
62+
pip install -e ".[dev]"
63+
- name: Run tests with coverage
64+
run: pytest --cov=src --cov-report=xml --cov-report=term-missing
65+
- name: Upload coverage to Codecov
66+
if: matrix.python-version == '3.11'
67+
uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4.6.0
68+
with:
69+
files: ./coverage.xml
70+
fail_ci_if_error: false
71+
env:
72+
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

0 commit comments

Comments
 (0)