runtime-target-lifecycle.yml

name: Runtime Target Lifecycle

on:
  workflow_dispatch:
  workflow_run:
    workflows: ["Deploy Cloud Run"]
    types: [completed]
  schedule:
    - cron: "34 * * * *"

env:
  GCP_PROJECT_ID: charlesschwabquant
  GCP_WORKLOAD_IDENTITY_PROVIDER: projects/401309731911/locations/global/workloadIdentityPools/github-actions/providers/github-main
  GCP_WORKLOAD_IDENTITY_SERVICE_ACCOUNT: schwab-platform-deploy@charlesschwabquant.iam.gserviceaccount.com

concurrency:
  group: ${{ github.workflow }}-${{ github.ref_name }}
  cancel-in-progress: false

jobs:
  lifecycle:
    name: Publish Schwab target lifecycle
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
      id-token: write
    env:
      RUNTIME_TARGET_ENABLED: ${{ vars.RUNTIME_TARGET_ENABLED }}
      RUNTIME_TARGET_JSON: ${{ vars.RUNTIME_TARGET_JSON || secrets.RUNTIME_TARGET_JSON }}
      SCHWAB_DRY_RUN_ONLY: ${{ vars.SCHWAB_DRY_RUN_ONLY }}
      CLOUD_RUN_REGION: ${{ vars.CLOUD_RUN_REGION }}
      CLOUD_RUN_SERVICE: ${{ secrets.CLOUD_RUN_SERVICE }}
      CLOUD_RUN_SERVICES: ${{ secrets.CLOUD_RUN_SERVICES }}
      CLOUD_RUN_SERVICE_TARGETS_JSON: ${{ vars.CLOUD_RUN_SERVICE_TARGETS_JSON || secrets.CLOUD_RUN_SERVICE_TARGETS_JSON }}
      RUNTIME_GUARD_LOOKBACK_MINUTES: ${{ vars.RUNTIME_GUARD_LOOKBACK_MINUTES || '180' }}
      RUNTIME_GUARD_REQUIRE_SUCCESS: ${{ vars.RUNTIME_GUARD_REQUIRE_SUCCESS || 'false' }}
      RUNTIME_HEARTBEAT_GCS_URIS: ${{ vars.RUNTIME_HEARTBEAT_GCS_URIS || vars.EXECUTION_REPORT_GCS_URI }}
      RUNTIME_HEARTBEAT_LOOKBACK_HOURS: ${{ vars.RUNTIME_HEARTBEAT_LOOKBACK_HOURS || '36' }}
      RUNTIME_HEARTBEAT_ACCEPT_STATUSES: ${{ vars.RUNTIME_HEARTBEAT_ACCEPT_STATUSES }}
      RUNTIME_HEARTBEAT_REJECT_STATUSES: ${{ vars.RUNTIME_HEARTBEAT_REJECT_STATUSES }}
      RUNTIME_HEARTBEAT_MARKET_AWARE: ${{ vars.RUNTIME_HEARTBEAT_MARKET_AWARE || 'true' }}
      RUNTIME_HEARTBEAT_MARKET_CALENDAR: ${{ vars.SCHWAB_MARKET_CALENDAR }}
      RUNTIME_HEARTBEAT_MARKET_TIMEZONE: ${{ vars.SCHWAB_MARKET_TIMEZONE }}
      RUNTIME_HEARTBEAT_PUBLICATION_GRACE_MINUTES: ${{ vars.RUNTIME_HEARTBEAT_PUBLICATION_GRACE_MINUTES || '30' }}
      RUNTIME_HEARTBEAT_SCHEDULER_AWARE: ${{ vars.RUNTIME_HEARTBEAT_SCHEDULER_AWARE || 'true' }}
      RUNTIME_HEARTBEAT_SCHEDULER_LOCATION: ${{ vars.RUNTIME_HEARTBEAT_SCHEDULER_LOCATION || vars.CLOUD_RUN_REGION || 'us-central1' }}
      EXECUTION_EVIDENCE_SYNC_URL: ${{ vars.EXECUTION_EVIDENCE_SYNC_URL }}
      LIFECYCLE_PERFORMANCE_BUCKET: ${{ vars.LIFECYCLE_PERFORMANCE_BUCKET }}
      PRODUCTION_DRIFT_DOMAIN: ${{ vars.PRODUCTION_DRIFT_DOMAIN }}
      PRODUCTION_DRIFT_STRATEGY_PROFILE: ${{ vars.PRODUCTION_DRIFT_STRATEGY_PROFILE }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Set up uv
        uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0

      - name: Resolve declared no-order target state
        id: target_state
        run: |
          set -euo pipefail
          python3 scripts/runtime_target_lifecycle_state.py >> "$GITHUB_OUTPUT"

      - name: Authenticate to Google Cloud
        uses: google-github-actions/auth@v3
        with:
          workload_identity_provider: ${{ env.GCP_WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ env.GCP_WORKLOAD_IDENTITY_SERVICE_ACCOUNT }}

      - name: Set up gcloud
        uses: google-github-actions/setup-gcloud@v3
        with:
          project_id: ${{ env.GCP_PROJECT_ID }}

      - name: Install locked runtime dependencies
        run: |
          set -euo pipefail
          uv sync --frozen --no-dev

      - name: Check Cloud Run runtime without notification side effects
        id: runtime_guard
        env:
          RUNTIME_GUARD_NAME: CharlesSchwabPlatform lifecycle
          RUNTIME_GUARD_FAIL_WORKFLOW_ON_ALERT: "true"
          RUNTIME_GUARD_IGNORE_ACTIVE_LKG_RECONCILE_GATE_REJECTS: "true"
        run: |
          set -uo pipefail
          set +e
          uv run --no-sync python scripts/cloud_run_runtime_guard.py > runtime-guard.log 2>&1
          exit_code=$?
          set -e
          cat runtime-guard.log
          if [ "$exit_code" -eq 0 ]; then
            status=pass
          elif grep -Eqi 'traceback|importerror|modulenotfounderror|log query failed|internal error|network|timed out|unable to list' runtime-guard.log; then
            status=unavailable
          else
            status=attention
          fi
          echo "status=$status" >> "$GITHUB_OUTPUT"
          exit 0

      - name: Check enabled execution heartbeat without notification side effects
        id: execution_heartbeat
        env:
          RUNTIME_HEARTBEAT_NAME: CharlesSchwabPlatform lifecycle
          RUNTIME_HEARTBEAT_REPORT_PLATFORM: charles_schwab
          RUNTIME_HEARTBEAT_REQUIRED_SERVICES: ${{ secrets.CLOUD_RUN_SERVICE }}
          RUNTIME_HEARTBEAT_FAIL_WORKFLOW_ON_ALERT: "true"
        run: |
          set -uo pipefail
          if [ "${{ steps.target_state.outputs.configured_state }}" = "disabled" ]; then
            echo "status=not_applicable" >> "$GITHUB_OUTPUT"
            echo "Execution heartbeat is not applicable because this target is deliberately disabled."
            exit 0
          fi

          set +e
          uv run --no-sync python scripts/execution_report_heartbeat.py > execution-heartbeat.log 2>&1
          exit_code=$?
          set -e
          cat execution-heartbeat.log
          if [ "$exit_code" -eq 0 ] && grep -qi 'heartbeat skipped' execution-heartbeat.log; then
            status=not_due
          elif [ "$exit_code" -eq 0 ]; then
            status=pass
          elif grep -Eqi 'traceback|importerror|modulenotfounderror|gcloud|storage|network|timed out|internal error|unable to list' execution-heartbeat.log; then
            status=unavailable
          else
            status=attention
          fi
          echo "status=$status" >> "$GITHUB_OUTPUT"
          exit 0

      - name: Observe production drift without optimization side effects
        id: production_drift
        run: |
          set -uo pipefail
          set +e
          uv run --no-sync python scripts/production_drift_health_observe.py > production-drift.log 2>&1
          exit_code=$?
          set -e
          cat production-drift.log
          if [ "$exit_code" -ne 0 ]; then
            status=unavailable
          else
            status="$(python3 - <<'PY'
          import json
          from pathlib import Path
          raw = Path("production-drift.log").read_text().strip().splitlines()
          payload = {}
          for line in reversed(raw):
              line = line.strip()
              if line.startswith("{") and line.endswith("}"):
                  payload = json.loads(line)
                  break
          status = str(payload.get("status") or "unavailable").strip().lower()
          if status in {"healthy", "parked"}:
              print("pass" if status == "healthy" else "not_due")
          elif status in {"review", "critical", "watch"}:
              print("attention")
          else:
              print("unavailable")
          PY
            )"
          fi
          echo "status=$status" >> "$GITHUB_OUTPUT"
          exit 0

      - name: Detect unified control-plane ingress
        id: lifecycle_ingress
        env:
          EXECUTION_EVIDENCE_SYNC_TOKEN: ${{ secrets.EXECUTION_EVIDENCE_SYNC_TOKEN }}
        run: |
          set -euo pipefail
          if [ -n "${EXECUTION_EVIDENCE_SYNC_URL:-}" ] && [ -n "${EXECUTION_EVIDENCE_SYNC_TOKEN:-}" ]; then
            echo "enabled=true" >> "$GITHUB_OUTPUT"
          else
            echo "enabled=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Publish lifecycle to the unified control plane
        if: ${{ steps.lifecycle_ingress.outputs.enabled == 'true' }}
        uses: QuantStrategyLab/QuantRuntimeSettings/actions/publish-runtime-target-lifecycle@b26858b6d7049d960e226c8922556854f24139b5
        with:
          source-id: schwab.primary
          target-id: schwab.primary
          platform: schwab
          observe-gcp: 'true'
          gcp-project: ${{ env.GCP_PROJECT_ID }}
          cloud-run-region: ${{ env.CLOUD_RUN_REGION }}
          cloud-run-service: ${{ env.CLOUD_RUN_SERVICE }}
          scheduler-location: ${{ env.RUNTIME_HEARTBEAT_SCHEDULER_LOCATION }}
          configured-state: ${{ steps.target_state.outputs.configured_state }}
          execution-mode: ${{ steps.target_state.outputs.execution_mode }}
          runtime-guard: ${{ steps.runtime_guard.outputs.status }}
          execution-heartbeat: ${{ steps.execution_heartbeat.outputs.status }}
          sync-url: ${{ env.EXECUTION_EVIDENCE_SYNC_URL }}
        env:
          EXECUTION_EVIDENCE_SYNC_TOKEN: ${{ secrets.EXECUTION_EVIDENCE_SYNC_TOKEN }}

      - name: Explain missing lifecycle ingress configuration
        if: ${{ steps.lifecycle_ingress.outputs.enabled != 'true' }}
        run: |
          echo "Lifecycle was checked but not centrally published: configure EXECUTION_EVIDENCE_SYNC_URL and EXECUTION_EVIDENCE_SYNC_TOKEN." >&2

      - name: Summarize no-order lifecycle
        run: |
          {
            echo "## Runtime target lifecycle"
            echo
            echo "| Field | Value |"
            echo "| --- | --- |"
            echo "| Target | schwab.primary |"
            echo "| Configured state | ${{ steps.target_state.outputs.configured_state }} |"
            echo "| Intended lane | ${{ steps.target_state.outputs.execution_mode }} |"
            echo "| Runtime guard | ${{ steps.runtime_guard.outputs.status }} |"
            echo "| Execution heartbeat | ${{ steps.execution_heartbeat.outputs.status }} |"
            echo "| Production drift | ${{ steps.production_drift.outputs.status }} |"
            echo
            echo "This workflow is read-only: it cannot enable a target, alter its lane, or submit an order."
          } >> "$GITHUB_STEP_SUMMARY"