Merge branch 'main' into codex/fix-zero-mutation-prob

Author: opensource-SantanderAI

.github/workflows/cla.yml

@@ -16,17 +16,19 @@ on:
   pull_request_target:
     types: [opened, closed, synchronize]
 
-# contents: write is required so the bot can commit the signature file back.
-permissions:
-  actions: write
-  contents: write
-  pull-requests: write
-  statuses: write
+# contents: write is required so the bot can commit the signature file back;
+# all permissions are granted at job level only (top-level default: none).
+permissions: {}
 
 jobs:
   cla:
     name: CLA Assistant
     runs-on: ubuntu-latest
+    permissions:
+      actions: write
+      contents: write
+      pull-requests: write
+      statuses: write
     if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target'
     steps:
       - name: CLA Assistant

.github/workflows/dep-scan.yml

@@ -32,7 +32,7 @@ jobs:
           python-version: "3.11"
           cache: pip
       - name: Upgrade pip
-        run: python -m pip install --upgrade pip
+        run: python -m pip install --upgrade pip "setuptools>=83.0.0"
       - name: Run pip-audit
         uses: pypa/gh-action-pip-audit@1220774d901786e6f652ae159f7b6bc8fea6d266  # v1.1.0
         with:

.github/workflows/sbom.yml

@@ -0,0 +1,70 @@
+# Generates a Software Bill of Materials for each published release, stamps
+# Santander Group as document creator, signs a build provenance attestation
+# (Sigstore, verifiable with `gh attestation verify`) and attaches both
+# standard formats (SPDX + CycloneDX) as release assets.
+# Manual runs (workflow_dispatch) upload the SBOMs as workflow artifacts only.
+name: SBOM
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+permissions: {}
+
+env:
+  BASE: ${{ github.event.repository.name }}-${{ github.ref_name }}
+
+jobs:
+  sbom:
+    name: Generate, attest and attach SBOM
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write      # upload release assets
+      id-token: write      # sign the attestation (Sigstore)
+      attestations: write  # store the attestation
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Generate SPDX SBOM
+        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610  # v0.24.0
+        with:
+          format: spdx-json
+          output-file: ${{ env.BASE }}.spdx.json
+          upload-artifact: false
+          upload-release-assets: false
+      - name: Generate CycloneDX SBOM
+        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610  # v0.24.0
+        with:
+          format: cyclonedx-json
+          output-file: ${{ env.BASE }}.cdx.json
+          upload-artifact: false
+          upload-release-assets: false
+      - name: Stamp Santander Group as document creator
+        run: |
+          jq '.creationInfo.creators += ["Organization: Santander Group"]' \
+            "$BASE.spdx.json" > tmp.json && mv tmp.json "$BASE.spdx.json"
+          jq '.metadata.authors = [{"name": "Open Source Santander AI", "email": "opensource@gruposantander.com"}]' \
+            "$BASE.cdx.json" > tmp.json && mv tmp.json "$BASE.cdx.json"
+      - name: Attest SBOM build provenance
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373  # v4.1.1
+        with:
+          subject-path: |
+            ${{ env.BASE }}.spdx.json
+            ${{ env.BASE }}.cdx.json
+      - name: Upload SBOMs as workflow artifacts (manual runs)
+        if: github.event_name == 'workflow_dispatch'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: sboms
+          path: |
+            ${{ env.BASE }}.spdx.json
+            ${{ env.BASE }}.cdx.json
+      - name: Attach SBOMs to the release
+        if: github.event_name == 'release'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release upload "${{ github.event.release.tag_name }}" \
+            "$BASE.spdx.json" "$BASE.cdx.json" --clobber

README.md

@@ -178,6 +178,14 @@ Please report security vulnerabilities responsibly. See our [Security Policy](.g
 for how to report (do **not** open a public issue for vulnerabilities). Contact:
 **opensource@gruposantander.com** or use GitHub Security Advisories.
 
+## Disclaimer
+
+This software is an open source project from the **Santander AI Lab**, provided **"as is"** under its [license](LICENSE), without warranties or conditions of any kind. It is **not an official Banco Santander product or service**, carries no commitment of production support, and does not constitute financial, legal or professional advice.
+
+"Santander" and its logo are registered trademarks of **Banco Santander, S.A.** The project license does not grant any right to use them beyond factual attribution.
+
+If you believe you have found a security vulnerability, follow our [security policy](https://github.com/SantanderAI/.github/blob/main/SECURITY.md) — do not open a public issue. You are responsible for assessing the suitability of this software for your use case and for keeping your own deployments up to date.
+
 ## License
 
 This project is licensed under the **Apache License 2.0** — see the [LICENSE](LICENSE)