Merge pull request #189 from QuantStrategyLab/codex/g17-disabled-runtime-monitoring-20260902

Harden disabled runtime monitoring

Author: Pigbibi

.github/workflows/runtime-heartbeat.yml

@@ -45,6 +45,12 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
+      - name: Install locked dependencies
+        run: |
+          set -euo pipefail
+          python -m pip install --upgrade pip uv
+          uv sync --frozen --no-dev
+
       - name: Check recent Runtime workflow success
         env:
           TG_TOKEN: ${{ secrets.TG_TOKEN }}

.github/workflows/watchdog.yml

@@ -13,10 +13,12 @@ env:
   GCP_PROJECT_ID: ${{ vars.GCP_PROJECT_ID }}
   GCP_WORKLOAD_IDENTITY_PROVIDER: ${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER }}
   GCP_WORKLOAD_IDENTITY_SERVICE_ACCOUNT: ${{ vars.GCP_WORKLOAD_IDENTITY_SERVICE_ACCOUNT }}
+  RUNTIME_TARGET_ENABLED: ${{ vars.RUNTIME_TARGET_ENABLED || 'false' }}
   WATCHDOG_MAX_AGE_SECONDS: ${{ vars.WATCHDOG_MAX_AGE_SECONDS || '4500' }}
 
 jobs:
   check:
+    if: ${{ vars.RUNTIME_TARGET_ENABLED == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:

tests/test_runtime_workflow_security.py

@@ -70,6 +70,19 @@ def test_heartbeat_secrets_are_only_available_to_check_step() -> None:
     assert "GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}" in check_step
 
 
+def test_heartbeat_installs_locked_dependencies_before_importing_qpk() -> None:
+    workflow = HEARTBEAT_WORKFLOW.read_text(encoding="utf-8")
+
+    checkout = workflow.index("      - name: Checkout repository")
+    install = workflow.index("      - name: Install locked dependencies")
+    check = workflow.index("      - name: Check recent Runtime workflow success")
+
+    assert checkout < install < check
+    install_step = workflow[install:check]
+    assert "python -m pip install --upgrade pip uv" in install_step
+    assert "uv sync --frozen --no-dev" in install_step
+
+
 def test_lifecycle_workflow_is_read_only_and_uses_pinned_actions() -> None:
     workflow = LIFECYCLE_WORKFLOW.read_text(encoding="utf-8")
     action_lines = [line.strip() for line in workflow.splitlines() if "uses:" in line]

tests/test_watchdog_workflow.py

@@ -45,6 +45,11 @@ def _preflight_script(workflow_text: str) -> str:
     return "\n".join(lines)
 
 
+def _job_block(workflow_text: str, job: str) -> str:
+    start = workflow_text.index(f"  {job}:\n")
+    return workflow_text[start:]
+
+
 def _run_preflight(script: str, values: dict[str, str]) -> subprocess.CompletedProcess[str]:
     env = {"PATH": os.environ.get("PATH", "")}
     env.update(values)
@@ -106,6 +111,17 @@ def test_watchdog_uses_repository_variables_before_remote_actions(self) -> None:
         self.assertIn("service_account: ${{ env.GCP_WORKLOAD_IDENTITY_SERVICE_ACCOUNT }}", text)
         self.assertIn("WATCHDOG_MAX_AGE_SECONDS: ${{ vars.WATCHDOG_MAX_AGE_SECONDS || '4500' }}", text)
 
+    def test_watchdog_skips_entire_job_when_runtime_target_is_not_explicitly_enabled(self) -> None:
+        text = self.workflow_text
+        job = _job_block(text, "check")
+
+        self.assertIn("RUNTIME_TARGET_ENABLED: ${{ vars.RUNTIME_TARGET_ENABLED || 'false' }}", text)
+        self.assertIn("if: ${{ vars.RUNTIME_TARGET_ENABLED == 'true' }}", job)
+        self.assertLess(
+            job.index("if: ${{ vars.RUNTIME_TARGET_ENABLED == 'true' }}"),
+            job.index("runs-on: ubuntu-latest"),
+        )
+
     def test_oidc_identity_digest_is_fixed_and_shared(self) -> None:
         scripts = (
             _preflight_script(RUNTIME_WORKFLOW.read_text(encoding="utf-8")),