Merge pull request #179 from QuantStrategyLab/fix/binance-reconciliation-artifact-retention

fix: align Binance reconciliation artifact retention

Author: Pigbibi

.github/workflows/main.yml

@@ -250,7 +250,9 @@ jobs:
           name: binance-reconciliation-candidate-${{ github.run_id }}
           path: reports/binance-reconciliation-candidate.json
           if-no-files-found: error
-          retention-days: 30
+          # Repository policy caps Actions artifacts at seven days. Keep the
+          # setting aligned so a successful read-only run is annotation-free.
+          retention-days: 7
 
       - name: 6. Notify Telegram on runtime workflow failure
         if: ${{ failure() && github.event.inputs.validate_only != 'true' && env.RUNTIME_TARGET_ENABLED == 'true' }}

docs/binance_reconciliation_recovery.zh-CN.md

@@ -11,7 +11,7 @@ workflow，并选择 `reconcile_only=true`。它运行独立的
 时间范围最多 24 小时，因此系统按不重叠的日窗口查询并去重；任一窗口达到 API 的 1,000 条
 上限时会失败关闭，而不会猜测分页而遗漏成交。它同时只读本地执行状态。账户
 UID、余额、订单和成交永不写入日志、报告或 artifact。artifact 只保留
-`binance_reconciliation_candidate.v1` 的摘要和稳定阻断码，保存 30 天。
+`binance_reconciliation_candidate.v1` 的摘要和稳定阻断码，保存 7 天。
 
 若交易所未返回账户 UID、受管交易对未配置、任一读取失败、私有预期摘要不存在或任一摘要
 不一致，运行成功完成为“候选被阻断”，而不是重试、降级或恢复交易。

tests/test_runtime_workflow_security.py

@@ -44,6 +44,13 @@ def test_reconciliation_run_does_not_try_to_publish_a_regular_execution_report()
     assert "github.event.inputs.reconcile_only != 'true'" in log_job
 
 
+def test_reconciliation_artifact_retention_matches_repository_policy() -> None:
+    workflow = WORKFLOW.read_text(encoding="utf-8")
+    reconciliation_step = workflow[workflow.index("      - name: 5b. Retain redacted reconciliation candidate") :]
+
+    assert "retention-days: 7" in reconciliation_step
+
+
 def test_oidc_and_notification_workflows_pin_remote_actions() -> None:
     for path in (WATCHDOG_WORKFLOW, HEARTBEAT_WORKFLOW):
         workflow = path.read_text(encoding="utf-8")