chore: add shared EVM key scan

.github/scripts/install-evm-key-scan-hook.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+# Explicit local bootstrap only. It never runs from package installation or CI.
+set -euo pipefail
+
+readonly CENTRAL_REPOSITORY='https://github.com/vana-com/.github.git'
+readonly CENTRAL_POLICY_SHA='5f1b4b1019af6e3a528dd36d471f94be7dd83632'
+
+action=${1:-install}
+case "$action" in
+  install|status|uninstall) shift || true ;;
+  *)
+    printf 'Usage: %s [install|status|uninstall]\n' "${0##*/}" >&2
+    exit 2
+    ;;
+esac
+
+fail() {
+  printf '%s\n' "$1" >&2
+  exit 2
+}
+
+repo_root=$(git rev-parse --show-toplevel 2>/dev/null) || fail 'Run this from a Git work tree.'
+[[ "$CENTRAL_POLICY_SHA" =~ ^[0-9a-f]{40}$ ]] || fail 'This bootstrap needs a reviewed 40-character central policy SHA before use.'
+
+cache_root="${XDG_DATA_HOME:-$HOME/.local/share}/vana-secret-scan/policy"
+policy_dir="$cache_root/$CENTRAL_POLICY_SHA"
+lock_dir="$cache_root/.${CENTRAL_POLICY_SHA}.lock"
+tmp_dir=''
+
+cleanup() {
+  [[ -z "$tmp_dir" ]] || rm -rf "$tmp_dir"
+  rmdir "$lock_dir" 2>/dev/null || true
+}
+
+mkdir -p "$cache_root"
+mkdir "$lock_dir" 2>/dev/null || fail "Policy setup is already running; try again: $lock_dir"
+trap cleanup EXIT
+
+[[ ! -L "$policy_dir" ]] || fail "Refusing symlinked policy cache: $policy_dir"
+if [[ -d "$policy_dir/.git" ]]; then
+  origin=$(git -C "$policy_dir" remote get-url origin) || fail "Refusing unreadable policy cache: $policy_dir"
+  case "$origin" in
+    "$CENTRAL_REPOSITORY"|https://github.com/vana-com/.github|git@github.com:vana-com/.github|git@github.com:vana-com/.github.git) ;;
+    *) fail "Refusing unexpected policy-cache origin: $policy_dir" ;;
+  esac
+  [[ "$(git -C "$policy_dir" rev-parse HEAD)" == "$CENTRAL_POLICY_SHA" ]] || fail "Refusing stale policy cache: $policy_dir"
+  [[ -z "$(git -C "$policy_dir" status --porcelain --untracked-files=all -- ':!/.tools')" ]] || fail "Refusing modified policy cache: $policy_dir"
+else
+  [[ ! -e "$policy_dir" ]] || fail "Refusing invalid policy cache: $policy_dir"
+  tmp_dir=$(mktemp -d "$cache_root/.policy.XXXXXX")
+  git init -q "$tmp_dir"
+  git -C "$tmp_dir" remote add origin "$CENTRAL_REPOSITORY"
+  git -C "$tmp_dir" fetch --depth 1 origin "$CENTRAL_POLICY_SHA"
+  git -C "$tmp_dir" checkout -q --detach FETCH_HEAD
+  [[ "$(git -C "$tmp_dir" rev-parse HEAD)" == "$CENTRAL_POLICY_SHA" ]] || fail 'Fetched policy does not match requested SHA.'
+  mv "$tmp_dir" "$policy_dir"
+  tmp_dir=''
+fi
+
+if [[ "$action" == install ]]; then
+  "$policy_dir/scripts/install-pre-push.sh" prepare \
+    --shared-dir "$policy_dir" \
+    --repo "$repo_root" \
+    --ref "$CENTRAL_POLICY_SHA"
+fi
+
+rmdir "$lock_dir"
+trap - EXIT
+exec "$policy_dir/scripts/install-pre-push.sh" "$action" \
+  --shared-dir "$policy_dir" \
+  --repo "$repo_root" \
+  --ref "$CENTRAL_POLICY_SHA" "$@"

.github/scripts/setup-developer.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# Prepare local developer safeguards; it never starts services or writes config.
+set -euo pipefail
+
+repo_root=$(git rev-parse --show-toplevel 2>/dev/null) || {
+  printf 'Run this from the repository.\n' >&2
+  exit 2
+}
+for command in docker openssl; do
+  command -v "$command" >/dev/null || {
+    printf 'Missing required command: %s\n' "$command" >&2
+    exit 2
+  }
+done
+docker compose version >/dev/null
+exec "$repo_root/.github/scripts/install-evm-key-scan-hook.sh"

.github/workflows/evm-key-scan.yml

@@ -0,0 +1,11 @@
+name: EVM key scan
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  evm-key-scan:
+    uses: vana-com/.github/.github/workflows/evm-key-scan.yml@5f1b4b1019af6e3a528dd36d471f94be7dd83632 # vana-com/.github#1

README.md

@@ -21,7 +21,12 @@ This guide will help you set up a validator node for the Vana Proof-of-Stake (Po
    cd vana
    ```
 
-2. Configure your environment:
+2. Prepare the developer tools and local pre-push scan:
+   ```bash
+   .github/scripts/setup-developer.sh
+   ```
+
+3. Configure your environment:
    ```bash
    # For Moksha testnet
    cp .env.moksha.example .env
@@ -31,12 +36,12 @@ This guide will help you set up a validator node for the Vana Proof-of-Stake (Po
    # Edit .env with your preferred text editor
    ```
 
-3. Start your node:
+4. Start your node:
    ```bash
    docker compose --profile init --profile node up -d
    ```
 
-4. Verify your node is running:
+5. Verify your node is running:
    ```bash
    # View logs for key services
    docker compose logs -f geth    # Execution client
@@ -609,4 +614,4 @@ feat(api)!: change default ports for all services
 The default ports for geth, beacon, and validator services have been updated
 to avoid conflicts with common system services.
 
-BREAKING CHANGE: Users must update their firewall rules and client configurations
+BREAKING CHANGE: Users must update their firewall rules and client configurations