fix: redact notification errors and harden audit workflows #35
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Update QPK Pin | |
| on: | |
| push: | |
| branches: [ main ] | |
| paths-ignore: | |
| - "QPK_PIN" | |
| - "constraints.txt" | |
| - "docs/**" | |
| - "**.md" | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| update-pin: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.11" | |
| - name: Update QPK_PIN and constraints | |
| id: update | |
| run: | | |
| SHA=$(git rev-parse HEAD) | |
| echo "$SHA" > QPK_PIN | |
| # Update SHAs from remote repos. Package names use hyphenated form. | |
| for pair in "us-equity-strategies:UsEquityStrategies" \ | |
| "hk-equity-strategies:HkEquityStrategies" \ | |
| "cn-equity-strategies:CnEquityStrategies" \ | |
| "crypto-strategies:CryptoStrategies"; do | |
| pkg="${pair%%:*}" | |
| repo="${pair##*:}" | |
| RSHA=$(git ls-remote "https://github.com/QuantStrategyLab/$repo.git" HEAD | cut -f1) | |
| [ -n "$RSHA" ] && sed -i "s|$pkg @ git+https://github.com/QuantStrategyLab/$repo.git@[a-f0-9]*|$pkg @ git+https://github.com/QuantStrategyLab/$repo.git@$RSHA|" constraints.txt || true | |
| done | |
| sed -i "s|quant-platform-kit @ git+https://github.com/QuantStrategyLab/QuantPlatformKit.git@[a-f0-9]*|quant-platform-kit @ git+https://github.com/QuantStrategyLab/QuantPlatformKit.git@$SHA|" constraints.txt | |
| if git diff --quiet; then | |
| echo "changed=false" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "changed=true" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Verify downstream compatibility | |
| if: steps.update.outputs.changed == 'true' | |
| run: | | |
| set -euo pipefail | |
| echo "::group::Verifying packages installable with new constraints" | |
| python -m pip install --upgrade pip | |
| # Pre-install runtime deps QPK needs but doesn't declare as dependencies | |
| python -m pip install requests numpy pandas | |
| # Install QPK WITHOUT constraints (avoids self-referencing SHA conflict) | |
| python -m pip install -e . | |
| python -c "import quant_platform_kit; print('QPK import OK')" | |
| python -c "from quant_platform_kit.common.strategies import compute_portfolio_drift; print('strategies OK')" | |
| python -c "from quant_platform_kit.common.platform_runner.loader import load_strategy_definition; print('platform_runner OK')" | |
| python -c "from quant_platform_kit.notifications.telegram import send_telegram_message; print('telegram OK')" | |
| python -c "from quant_platform_kit.common.contracts import SnapshotProfileContract; print('contracts OK')" | |
| # Verify strategy repos installable with NEW constraints | |
| failed=0 | |
| for dep in us-equity-strategies hk-equity-strategies cn-equity-strategies crypto-strategies; do | |
| echo "Checking $dep..." | |
| if python -m pip install --dry-run -c constraints.txt "$dep" >/dev/null 2>&1; then | |
| echo " $dep OK" | |
| else | |
| echo " $dep FAILED" | |
| failed=1 | |
| fi | |
| done | |
| if [ "${failed}" -ne 0 ]; then | |
| echo "One or more downstream dependency checks failed." >&2 | |
| exit 1 | |
| fi | |
| echo "::endgroup::" | |
| echo "All compatibility checks passed." | |
| - name: Create PR for pin update | |
| if: steps.update.outputs.changed == 'true' | |
| uses: peter-evans/create-pull-request@v7 | |
| with: | |
| token: ${{ github.token }} | |
| commit-message: "chore: auto-update QPK_PIN and constraints.txt" | |
| title: "chore: auto-update QPK_PIN and constraints.txt" | |
| body: | | |
| Automated update of QPK_PIN and dependency constraint SHAs. | |
| Compatibility checks passed ✅ — all downstream-critical QPK modules verified importable. | |
| Updated SHAs: | |
| - QPK: `${{ github.sha }}` | |
| - Strategy repos: latest HEAD from each | |
| 🤖 Generated with [Claude Code](https://claude.com/claude-code) | |
| branch: auto/qpk-pin-update | |
| delete-branch: true | |
| base: main |