feat(security,devops): resolve issues #1194, #1195, #1200, #1205

[bitcoindev817-hue]

🚀 Feature & Security Overview

This Pull Request provides a comprehensive resolution for issues #1194, #1195, #1200, and #1205 on StellarDevHub/Web3-Student-Lab.

---

🔑 Resolved Issues & Detailed Changes

1. Security: Password Strength Meter & HaveIBeenPwned k-Anonymity Check (#1194)

• Entropy Estimator (frontend/src/utils/passwordStrength.ts): Implemented zxcvbn password strength calculation algorithm evaluating entropy bits ($E = L \times \log_2(N)$), length requirements, character set diversity, and common pattern penalties. Requires score $\ge 3$ for user registration.
• HaveIBeenPwned k-Anonymity API Client (frontend/src/utils/pwnedPasswordCheck.ts): Integrated k-Anonymity breach verification hashing passphrases locally with SHA-1 via Web Crypto API (crypto.subtle.digest) and querying api.pwnedpasswords.com/range/{first5Hex} so raw passphrases and full hashes never leave the client.
• Interactive UI Component (frontend/src/components/auth/PasswordStrengthMeter.tsx): Added real-time visual progress bar (score 0-4), minimum requirement indicator (score $\ge 3$), live breach status badge, and actionable passphrase improvement suggestions.
• Registration Integration (frontend/src/app/auth/register/page.tsx): Enforced strength score $\ge 3$ and HaveIBeenPwned breach checks on form submission.
• Automated Tests (frontend/src/utils/__tests__/passwordStrength.test.ts): Added unit tests verifying score calculation (0-4), entropy edge cases, minimum score validation, and HaveIBeenPwned k-anonymity mock testing.

2. DevOps: Clean Up Repository Root & Organize Automation Scripts (#1195)

• Directory Organization (scripts/): Moved python generator scripts (generate_issues.py, generate_gh_payload.py) and JSON issue payload dumps (github_issues_payload.json, github_issues_payload_fixed.json, contract_issues_batch1.json, 70_new_issues.md) into scripts/.
• Path References: Updated script execution paths using os.path.join(os.path.dirname(__file__), ...) so scripts execute reliably from repository root or inside scripts/.
• Git Ignore: Updated .gitignore to ignore temporary script outputs and cache artifacts (scripts/*.tmp, *.payload.tmp).
• Documentation: Updated root README.md adding a dedicated Development Automation Scripts table documenting script usage.

3. DevOps: Enforce Conventional Commits & PR Title Linting (#1200)

• Commitlint Config (commitlint.config.js): Configured @commitlint/config-conventional rules (feat, fix, docs, style, refactor, perf, test, build, ci, chore, revert).
• Husky Pre-commit Hook (.husky/commit-msg): Added commitlint execution to validate local commit messages prior to commit creation.
• GitHub Action Workflow (.github/workflows/commitlint.yml): Added automated workflow using amannn/action-semantic-pull-request@v5 to validate PR titles against Conventional Commits formatting on PR opening/edits.
• Dependencies (package.json): Added @commitlint/cli and @commitlint/config-conventional devDependencies.
• Documentation (CONTRIBUTING.md): Created comprehensive contribution guidelines documenting Conventional Commits format, PR rules, and local environment setup.

4. DevOps: Automated Release Drafter & SemVer Changelog Generator (#1205)

• Release Drafter Config (.github/release-drafter.yml): Configured Release Drafter template categorizing changes into Features, Bug Fixes, Security, Documentation, and Maintenance, and mapping PR labels (major, minor, patch) to automatic SemVer bumps.
• Draft Workflow (.github/workflows/release-drafter.yml): Created workflow triggering release-drafter/release-drafter on push to main to dynamically maintain draft release notes.
• Release & Notification Workflow (.github/workflows/release.yml): Created workflow triggered on release publication to compile Soroban smart contract WASM binaries, package frontend release archives, attach artifacts to the GitHub Release, and notify Discord/Slack webhooks.

---

✅ Verification

• Password Strength & HIBP Unit Tests: Passed (npx vitest run src/utils/__tests__/passwordStrength.test.ts)
• Commitlint Validation: Verified commit message and PR title linting via commitlint.
• Automation Scripts: Verified execution of python3 scripts/generate_issues.py and python3 scripts/generate_gh_payload.py.

Fixes #1194
Fixes #1195
Fixes #1200
Fixes #1205

[vercel]

Someone is attempting to deploy a commit to the Ayomide Adeniran's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@bitcoindev817-hue Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits