ci: standardize pytest invocation and add security scanning

- Changed pytest calls to use `venv/bin/python -m pytest` with explicit config
- Added `--rootdir "$PWD"` and `--import-mode=importlib` for consistent imports
- Fixed PYTHONPATH to use absolute paths with $PWD prefix
- Added smart contract security scanning for Solidity files
- Added Circom circuit security checks for ZK proof circuits
- Added ZK proof implementation security validation
- Added contracts/** to security scanning workflow

.gitea/workflows/build-miner-binary.yml

@@ -0,0 +1,85 @@
+name: Build Debian Miner Binary
+
+on:
+  push:
+    tags:
+      - 'v*.*.*'
+  workflow_dispatch:
+
+jobs:
+  build-miner:
+    runs-on: debian
+    timeout-minutes: 30
+
+    steps:
+      - name: Clone repository
+        run: |
+          WORKSPACE="/var/lib/aitbc-workspaces/build-miner"
+          rm -rf "$WORKSPACE"
+          mkdir -p "$WORKSPACE"
+          cd "$WORKSPACE"
+          git clone --depth 1 http://gitea.bubuit.net:3000/oib/aitbc.git repo
+
+      - name: Initialize job logging
+        run: |
+          cd /var/lib/aitbc-workspaces/build-miner/repo
+          bash scripts/ci/setup-job-logging.sh
+
+      - name: Install dependencies
+        run: |
+          cd /var/lib/aitbc-workspaces/build-miner/repo
+          apt update
+          apt install -y \
+            python3 \
+            python3-venv \
+            python3-dev \
+            build-essential \
+            nvidia-driver-full \
+            nvidia-cuda-toolkit \
+            git \
+            wget \
+            curl
+
+      - name: Setup Python environment
+        run: |
+          cd /var/lib/aitbc-workspaces/build-miner/repo
+          rm -rf venv
+          python3 -m venv venv
+          venv/bin/pip install --upgrade pip
+          venv/bin/pip install pyinstaller vllm torch transformers
+
+      - name: Build binary
+        run: |
+          cd /var/lib/aitbc-workspaces/build-miner/repo
+          venv/bin/pyinstaller scripts/gpu/miner.spec
+
+      - name: Package distribution
+        run: |
+          cd /var/lib/aitbc-workspaces/build-miner/repo/scripts/gpu
+          cp dist/aitbc-miner-debian .
+          sha256sum aitbc-miner-debian > SHA256SUMS
+          tar -czf aitbc-miner-debian-package.tar.gz \
+            aitbc-miner-debian \
+            README.md \
+            install.sh \
+            verify-install.sh \
+            miner.env.template \
+            SHA256SUMS
+          sha256sum aitbc-miner-debian-package.tar.gz >> SHA256SUMS
+
+      - name: Get version
+        id: version
+        run: |
+          cd /var/lib/aitbc-workspaces/build-miner/repo
+          VERSION=${GITHUB_REF#refs/tags/v}
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "version=$VERSION"
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v3
+        with:
+          name: miner-binary
+          path: |
+            /var/lib/aitbc-workspaces/build-miner/repo/scripts/gpu/aitbc-miner-debian
+            /var/lib/aitbc-workspaces/build-miner/repo/scripts/gpu/aitbc-miner-debian-package.tar.gz
+            /var/lib/aitbc-workspaces/build-miner/repo/scripts/gpu/SHA256SUMS