Skip to content

Commit a73dbe9

Browse files
PigbibiPigbibi
authored
Merge pull request #403 from QuantStrategyLab/fix/redact-runtime-config-logs
fix: keep runtime configuration out of logs
2 parents 8d8fc1f + 9e315cf commit a73dbe9

4 files changed

Lines changed: 24 additions & 16 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,14 @@ jobs:
1616
- name: Checkout
1717
uses: actions/checkout@v6
1818

19+
- name: Reject public runtime configuration bindings
20+
run: |
21+
set -euo pipefail
22+
if rg -n '\$\{\{[[:space:]]*vars\.(CLOUD_RUN_SERVICE_TARGETS_JSON|RUNTIME_TARGET_JSON|GLOBAL_TELEGRAM_CHAT_ID|CLOUD_RUN_SERVICES|CLOUD_RUN_SERVICE|RUNTIME_HEARTBEAT_REQUIRED_SERVICES|RUNTIME_GUARD_SCHEDULER_JOB_PATTERN)' .github/workflows; then
23+
echo "Operational runtime configuration must use GitHub Secrets, not GitHub Variables." >&2
24+
exit 1
25+
fi
26+
1927
- name: Resolve QuantPlatformKit ref
2028
id: quant-platform-kit-ref
2129
run: |

‎.github/workflows/execution-report-heartbeat.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ jobs:
3939
env:
4040
RUNTIME_HEARTBEAT_NAME: InteractiveBrokersPlatform
4141
RUNTIME_HEARTBEAT_REPORT_PLATFORM: interactive_brokers
42-
RUNTIME_HEARTBEAT_REQUIRED_SERVICES: ${{ vars.RUNTIME_HEARTBEAT_REQUIRED_SERVICES }}
42+
RUNTIME_HEARTBEAT_REQUIRED_SERVICES: ${{ secrets.RUNTIME_HEARTBEAT_REQUIRED_SERVICES }}
4343
RUNTIME_HEARTBEAT_GCS_URIS: ${{ vars.RUNTIME_HEARTBEAT_GCS_URIS || vars.EXECUTION_REPORT_GCS_URI }}
4444
RUNTIME_HEARTBEAT_LOOKBACK_HOURS: ${{ inputs.lookback_hours || vars.RUNTIME_HEARTBEAT_LOOKBACK_HOURS || '36' }}
4545
RUNTIME_HEARTBEAT_FAIL_WORKFLOW_ON_ALERT: ${{ inputs.fail_workflow_on_alert || vars.RUNTIME_HEARTBEAT_FAIL_WORKFLOW_ON_ALERT || 'true' }}
@@ -52,12 +52,12 @@ jobs:
5252
RUNTIME_HEARTBEAT_SCHEDULER_AWARE: ${{ vars.RUNTIME_HEARTBEAT_SCHEDULER_AWARE || 'true' }}
5353
RUNTIME_HEARTBEAT_SCHEDULER_LOCATION: ${{ vars.RUNTIME_HEARTBEAT_SCHEDULER_LOCATION || vars.CLOUD_RUN_REGION || 'us-central1' }}
5454
RUNTIME_TARGET_ENABLED: ${{ vars.RUNTIME_TARGET_ENABLED }}
55-
RUNTIME_TARGET_JSON: ${{ vars.RUNTIME_TARGET_JSON }}
56-
CLOUD_RUN_SERVICE: ${{ vars.CLOUD_RUN_SERVICE }}
57-
CLOUD_RUN_SERVICES: ${{ vars.CLOUD_RUN_SERVICES }}
58-
CLOUD_RUN_SERVICE_TARGETS_JSON: ${{ vars.CLOUD_RUN_SERVICE_TARGETS_JSON }}
55+
RUNTIME_TARGET_JSON: ${{ secrets.RUNTIME_TARGET_JSON }}
56+
CLOUD_RUN_SERVICE: ${{ secrets.CLOUD_RUN_SERVICE }}
57+
CLOUD_RUN_SERVICES: ${{ secrets.CLOUD_RUN_SERVICES }}
58+
CLOUD_RUN_SERVICE_TARGETS_JSON: ${{ secrets.CLOUD_RUN_SERVICE_TARGETS_JSON }}
5959
CLOUD_SCHEDULER_MAIN_TIME: ${{ vars.CLOUD_SCHEDULER_MAIN_TIME }}
60-
GLOBAL_TELEGRAM_CHAT_ID: ${{ vars.GLOBAL_TELEGRAM_CHAT_ID }}
60+
GLOBAL_TELEGRAM_CHAT_ID: ${{ secrets.GLOBAL_TELEGRAM_CHAT_ID }}
6161
TELEGRAM_TOKEN: ${{ secrets.TELEGRAM_TOKEN }}
6262
TELEGRAM_TOKEN_SECRET_NAME: ${{ vars.TELEGRAM_TOKEN_SECRET_NAME }}
6363
steps:

‎.github/workflows/runtime-guard.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -50,12 +50,12 @@ jobs:
5050
RUNTIME_GUARD_LOOKBACK_MINUTES: ${{ inputs.lookback_minutes || vars.RUNTIME_GUARD_LOOKBACK_MINUTES || '180' }}
5151
RUNTIME_GUARD_REQUIRE_SUCCESS: ${{ inputs.require_success || vars.RUNTIME_GUARD_REQUIRE_SUCCESS || 'false' }}
5252
RUNTIME_GUARD_FAIL_WORKFLOW_ON_ALERT: ${{ inputs.fail_workflow_on_alert || vars.RUNTIME_GUARD_FAIL_WORKFLOW_ON_ALERT || 'true' }}
53-
RUNTIME_GUARD_SCHEDULER_JOB_PATTERN: ${{ vars.RUNTIME_GUARD_SCHEDULER_JOB_PATTERN }}
54-
CLOUD_RUN_SERVICE: ${{ vars.CLOUD_RUN_SERVICE }}
55-
CLOUD_RUN_SERVICES: ${{ vars.CLOUD_RUN_SERVICES }}
56-
CLOUD_RUN_SERVICE_TARGETS_JSON: ${{ vars.CLOUD_RUN_SERVICE_TARGETS_JSON }}
53+
RUNTIME_GUARD_SCHEDULER_JOB_PATTERN: ${{ secrets.RUNTIME_GUARD_SCHEDULER_JOB_PATTERN }}
54+
CLOUD_RUN_SERVICE: ${{ secrets.CLOUD_RUN_SERVICE }}
55+
CLOUD_RUN_SERVICES: ${{ secrets.CLOUD_RUN_SERVICES }}
56+
CLOUD_RUN_SERVICE_TARGETS_JSON: ${{ secrets.CLOUD_RUN_SERVICE_TARGETS_JSON }}
5757
CLOUD_RUN_REGION: ${{ vars.CLOUD_RUN_REGION }}
58-
GLOBAL_TELEGRAM_CHAT_ID: ${{ vars.GLOBAL_TELEGRAM_CHAT_ID }}
58+
GLOBAL_TELEGRAM_CHAT_ID: ${{ secrets.GLOBAL_TELEGRAM_CHAT_ID }}
5959
TELEGRAM_TOKEN: ${{ secrets.TELEGRAM_TOKEN }}
6060
TELEGRAM_TOKEN_SECRET_NAME: ${{ vars.TELEGRAM_TOKEN_SECRET_NAME }}
6161
steps:

‎.github/workflows/sync-cloud-run-env.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -77,16 +77,16 @@ jobs:
7777
INPUT_SYNC_ENV: ${{ inputs.sync_env }}
7878
GCP_ARTIFACT_REGISTRY_HOSTNAME: ${{ vars.GCP_ARTIFACT_REGISTRY_HOSTNAME }}
7979
CLOUD_RUN_REGION: ${{ vars.CLOUD_RUN_REGION }}
80-
CLOUD_RUN_SERVICE: ${{ vars.CLOUD_RUN_SERVICE }}
81-
CLOUD_RUN_SERVICES: ${{ vars.CLOUD_RUN_SERVICES }}
82-
CLOUD_RUN_SERVICE_TARGETS_JSON: ${{ vars.CLOUD_RUN_SERVICE_TARGETS_JSON }}
80+
CLOUD_RUN_SERVICE: ${{ secrets.CLOUD_RUN_SERVICE }}
81+
CLOUD_RUN_SERVICES: ${{ secrets.CLOUD_RUN_SERVICES }}
82+
CLOUD_RUN_SERVICE_TARGETS_JSON: ${{ secrets.CLOUD_RUN_SERVICE_TARGETS_JSON }}
8383
CLOUD_RUN_ENV_SYNC_WAIT_FOR_COMMIT: ${{ vars.CLOUD_RUN_ENV_SYNC_WAIT_FOR_COMMIT }}
8484
CLOUD_SCHEDULER_LOCATION: ${{ vars.CLOUD_SCHEDULER_LOCATION }}
8585
CLOUD_SCHEDULER_MAIN_TIME: ${{ vars.CLOUD_SCHEDULER_MAIN_TIME }}
8686
CLOUD_SCHEDULER_PROBE_TIME: ${{ vars.CLOUD_SCHEDULER_PROBE_TIME }}
8787
CLOUD_SCHEDULER_PRECHECK_TIME: ${{ vars.CLOUD_SCHEDULER_PRECHECK_TIME }}
8888
TELEGRAM_TOKEN_SECRET_NAME: ${{ vars.TELEGRAM_TOKEN_SECRET_NAME }}
89-
RUNTIME_TARGET_JSON: ${{ vars.RUNTIME_TARGET_JSON }}
89+
RUNTIME_TARGET_JSON: ${{ secrets.RUNTIME_TARGET_JSON }}
9090
ACCOUNT_GROUP: ${{ vars.ACCOUNT_GROUP }}
9191
IB_ACCOUNT_GROUP_CONFIG_SECRET_NAME: ${{ vars.IB_ACCOUNT_GROUP_CONFIG_SECRET_NAME }}
9292
IBKR_FEATURE_SNAPSHOT_PATH: ${{ vars.IBKR_FEATURE_SNAPSHOT_PATH }}
@@ -162,7 +162,7 @@ jobs:
162162
STRATEGY_PLUGIN_ALERT_TELEGRAM_BODY_MAX_CHARS: ${{ vars.STRATEGY_PLUGIN_ALERT_TELEGRAM_BODY_MAX_CHARS }}
163163
# Strategy-owned defaults continue to come from UsEquityStrategies; this workflow only syncs platform/runtime inputs.
164164
EXECUTION_REPORT_GCS_URI: ${{ vars.EXECUTION_REPORT_GCS_URI }}
165-
GLOBAL_TELEGRAM_CHAT_ID: ${{ vars.GLOBAL_TELEGRAM_CHAT_ID }}
165+
GLOBAL_TELEGRAM_CHAT_ID: ${{ secrets.GLOBAL_TELEGRAM_CHAT_ID }}
166166
NOTIFY_LANG: ${{ vars.NOTIFY_LANG }}
167167
TELEGRAM_TOKEN: ${{ secrets.TELEGRAM_TOKEN }}
168168
STRATEGY_PLUGIN_ALERT_EMAIL_SENDER_PASSWORD: ${{ secrets.STRATEGY_PLUGIN_ALERT_EMAIL_SENDER_PASSWORD }}

0 commit comments

Comments
 (0)