ci: report blocked qpk pin pr creation #37
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Update QPK Pin | |
| on: | |
| push: | |
| branches: [ main ] | |
| paths-ignore: | |
| - "QPK_PIN" | |
| - "constraints.txt" | |
| - "docs/**" | |
| - "**.md" | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| update-pin: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.11" | |
| - name: Update QPK_PIN and constraints | |
| id: update | |
| run: | | |
| SHA=$(git rev-parse HEAD) | |
| echo "$SHA" > QPK_PIN | |
| # Update SHAs from remote repos. Package names use hyphenated form. | |
| for pair in "us-equity-strategies:UsEquityStrategies" \ | |
| "hk-equity-strategies:HkEquityStrategies" \ | |
| "cn-equity-strategies:CnEquityStrategies" \ | |
| "crypto-strategies:CryptoStrategies"; do | |
| pkg="${pair%%:*}" | |
| repo="${pair##*:}" | |
| RSHA=$(git ls-remote "https://github.com/QuantStrategyLab/$repo.git" HEAD | cut -f1) | |
| [ -n "$RSHA" ] && sed -i "s|$pkg @ git+https://github.com/QuantStrategyLab/$repo.git@[a-f0-9]*|$pkg @ git+https://github.com/QuantStrategyLab/$repo.git@$RSHA|" constraints.txt || true | |
| done | |
| sed -i "s|quant-platform-kit @ git+https://github.com/QuantStrategyLab/QuantPlatformKit.git@[a-f0-9]*|quant-platform-kit @ git+https://github.com/QuantStrategyLab/QuantPlatformKit.git@$SHA|" constraints.txt | |
| if git diff --quiet; then | |
| echo "changed=false" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "changed=true" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Verify downstream compatibility | |
| if: steps.update.outputs.changed == 'true' | |
| run: | | |
| set -euo pipefail | |
| echo "::group::Verifying packages installable with new constraints" | |
| python -m pip install --upgrade pip | |
| # Pre-install runtime deps QPK needs but doesn't declare as dependencies | |
| python -m pip install requests numpy pandas | |
| # Install QPK WITHOUT constraints (avoids self-referencing SHA conflict) | |
| python -m pip install -e . | |
| python -c "import quant_platform_kit; print('QPK import OK')" | |
| python -c "from quant_platform_kit.common.strategies import compute_portfolio_drift; print('strategies OK')" | |
| python -c "from quant_platform_kit.common.platform_runner.loader import load_strategy_definition; print('platform_runner OK')" | |
| python -c "from quant_platform_kit.notifications.telegram import send_telegram_message; print('telegram OK')" | |
| python -c "from quant_platform_kit.common.contracts import SnapshotProfileContract; print('contracts OK')" | |
| # Verify strategy repo refs are fetchable and package metadata is buildable. | |
| # | |
| # Strategy packages currently carry their own direct QPK pin. A full | |
| # dependency solve with the newly generated top-level QPK constraint | |
| # would conflict until downstream repos update those pins, so keep this | |
| # check focused on the package refs generated above. | |
| failed=0 | |
| for dep in us-equity-strategies hk-equity-strategies cn-equity-strategies crypto-strategies; do | |
| echo "Checking $dep..." | |
| log_file="$(mktemp)" | |
| if python -m pip install --dry-run --no-deps -c constraints.txt "$dep" >"${log_file}" 2>&1; then | |
| echo " $dep OK" | |
| else | |
| echo " $dep FAILED" | |
| sed -n '1,160p' "${log_file}" | |
| failed=1 | |
| fi | |
| rm -f "${log_file}" | |
| done | |
| if [ "${failed}" -ne 0 ]; then | |
| echo "One or more downstream dependency checks failed." >&2 | |
| exit 1 | |
| fi | |
| echo "::endgroup::" | |
| echo "All compatibility checks passed." | |
| - name: Create PR for pin update | |
| id: create_pin_pr | |
| if: steps.update.outputs.changed == 'true' | |
| continue-on-error: true | |
| uses: peter-evans/create-pull-request@v7 | |
| with: | |
| token: ${{ github.token }} | |
| commit-message: "chore: auto-update QPK_PIN and constraints.txt" | |
| title: "chore: auto-update QPK_PIN and constraints.txt" | |
| body: | | |
| Automated update of QPK_PIN and dependency constraint SHAs. | |
| Compatibility checks passed ✅ — all downstream-critical QPK modules verified importable. | |
| Updated SHAs: | |
| - QPK: `${{ github.sha }}` | |
| - Strategy repos: latest HEAD from each | |
| 🤖 Generated with [Claude Code](https://claude.com/claude-code) | |
| branch: auto/qpk-pin-update | |
| delete-branch: true | |
| base: main | |
| - name: Report blocked pin PR creation | |
| if: steps.update.outputs.changed == 'true' && steps.create_pin_pr.outcome == 'failure' | |
| run: | | |
| cat >> "$GITHUB_STEP_SUMMARY" <<'MD' | |
| ## QPK pin update PR not created | |
| The generated `QPK_PIN` / `constraints.txt` update was verified, but repository policy prevented `GITHUB_TOKEN` from creating a pull request. | |
| Manual follow-up: | |
| - Enable the repository setting that allows GitHub Actions to create pull requests, or | |
| - Run the pin update manually from a reviewed maintainer branch. | |
| This workflow intentionally does not fall back to a PAT-based bypass. | |
| MD | |
| echo "::warning::QPK pin update PR was not created because repository policy blocks GitHub Actions PR creation." |