fix: enforce value targets in static risk gate (#394) #161
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Update QPK Pin | |
| on: | |
| push: | |
| branches: [ main ] | |
| paths-ignore: | |
| - "QPK_PIN" | |
| - "qsl-pins.txt" | |
| - "constraints.txt" | |
| - ".github/workflows/open-downstream-qpk-pin-prs.yml" | |
| - ".github/workflows/advance-staged-qpk-pin.yml" | |
| - ".github/workflows/update-qpk-pin.yml" | |
| - "scripts/check_qpk_pin_consistency.py" | |
| - "scripts/open_downstream_qpk_pin_prs.py" | |
| - "scripts/merge_verified_strategy_qpk_pin_prs.py" | |
| - "tests/test_qpk_pin_consistency.py" | |
| - "tests/test_merge_verified_strategy_qpk_pin_prs.py" | |
| - "tests/test_update_qpk_pin_workflow.py" | |
| - "docs/**" | |
| - "**.md" | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| update-pin: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| steps: | |
| - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.1.0 | |
| with: | |
| python-version: "3.11" | |
| - name: Update QPK_PIN | |
| id: update | |
| run: | | |
| set -euo pipefail | |
| SHA=$(git rev-parse HEAD) | |
| echo "$SHA" > QPK_PIN | |
| if git diff --quiet; then | |
| echo "changed=false" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "changed=true" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Verify QPK candidate | |
| id: verify | |
| if: steps.update.outputs.changed == 'true' | |
| run: | | |
| set -euo pipefail | |
| resolver_env="$(mktemp -d)" | |
| resolver_log="$(mktemp)" | |
| cleanup() { | |
| rm -rf -- "$resolver_env" | |
| rm -f -- "$resolver_log" | |
| } | |
| trap cleanup EXIT | |
| if ! python -m venv "$resolver_env" >"$resolver_log" 2>&1; then | |
| echo "::error title=QPK pin validation::aggregate_dependency_bootstrap_failed" | |
| exit 1 | |
| fi | |
| resolver_python="$resolver_env/bin/python" | |
| qpk_sha=$(tr -d '[:space:]' < QPK_PIN) | |
| qpk_requirement="quant-platform-kit @ git+https://github.com/QuantStrategyLab/QuantPlatformKit.git@${qpk_sha}" | |
| if ! "$resolver_python" -m pip install "$qpk_requirement" >"$resolver_log" 2>&1; then | |
| echo "::error title=QPK pin validation::qpk_candidate_install_failed" | |
| exit 1 | |
| fi | |
| if ! "$resolver_python" -m pip check >"$resolver_log" 2>&1; then | |
| echo "::error title=QPK pin validation::aggregate_dependency_check_failed" | |
| exit 1 | |
| fi | |
| echo "qpk_candidate_install_passed" | |
| - name: Create PR for pin update | |
| id: create_pin_pr | |
| if: steps.update.outputs.changed == 'true' && steps.verify.outcome == 'success' | |
| continue-on-error: true | |
| uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7.0.8 | |
| with: | |
| token: ${{ secrets.QSL_REPO_SYNC_TOKEN || github.token }} | |
| commit-message: "chore: advance staged QPK pin" | |
| title: "chore: advance staged QPK pin" | |
| body: | | |
| Automated first stage of the QPK dependency rollout. | |
| The QPK candidate installation and `pip check` passed. Strategy pins and | |
| the aggregate bundle are advanced separately after their dependency | |
| closure is coherent. | |
| Updated SHA: | |
| - QPK: `${{ github.sha }}` | |
| 🤖 Generated with [Claude Code](https://claude.com/claude-code) | |
| branch: auto/qpk-pin-update | |
| delete-branch: true | |
| base: main | |
| add-paths: | | |
| QPK_PIN | |
| - name: Report blocked pin PR creation | |
| if: steps.update.outputs.changed == 'true' && steps.create_pin_pr.outcome == 'failure' | |
| run: | | |
| cat >> "$GITHUB_STEP_SUMMARY" <<'MD' | |
| ## QPK pin update PR not created | |
| The staged QPK pin update passed candidate verification, but PR creation failed. | |
| Ensure `QSL_REPO_SYNC_TOKEN` is configured as a **QuantPlatformKit repository secret** | |
| (see `docs/qpk_repo_sync_auth.zh-CN.md`). Org policy blocks `GITHUB_TOKEN` PR creation. | |
| MD | |
| echo "::warning::QPK pin update PR was not created because repository policy blocks GitHub Actions PR creation." |