reusable-drift-check.yml

name: Reusable Drift Check

on:
  workflow_call:
    inputs:
      strategy_domain:
        required: true
        type: string
      snapshot_repository:
        required: true
        type: string
      snapshot_checkout_path:
        required: true
        type: string
      snapshot_repository_ref:
        required: false
        type: string
        default: "main"
      python_version:
        required: false
        type: string
        default: "3.11"
      quant_platform_kit_ref:
        required: false
        type: string
        default: "main"
      ai_gateway_service_url:
        required: false
        type: string
        default: ""
      lifecycle_performance_bucket:
        required: false
        type: string
        default: ""
      caller_event_name:
        required: true
        type: string
      caller_pr_head_repository:
        required: false
        type: string
        default: ""
      lifecycle_preflight_artifact:
        required: false
        type: string
        default: ""
      strategy_profile:
        required: false
        type: string
        default: ""
    secrets:
      codex_audit_service_url:
        required: false
      snapshot_repository_token:
        required: false

permissions:
  contents: read
  issues: write
  id-token: write

jobs:
  drift:
    runs-on: ubuntu-latest
    # A critical drift can require up to three sequential primary reviews.  Each
    # service review has a 15-minute budget plus its polling grace period.
    timeout-minutes: 60
    env:
      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
      STRATEGY_DOMAIN: ${{ inputs.strategy_domain }}
      QUANT_PROJECTS_ROOT: ${{ github.workspace }}/external
      LIFECYCLE_PERFORMANCE_BUCKET: ${{ inputs.lifecycle_performance_bucket || vars.LIFECYCLE_PERFORMANCE_BUCKET || '' }}
      LIFECYCLE_LOCAL_ROOT: ${{ github.workspace }}/data/lifecycle_store
      LIFECYCLE_STRATEGY_PROFILE: ${{ inputs.strategy_profile }}

    steps:
      - name: Validate trusted caller
        env:
          CALLER_REPOSITORY: ${{ github.repository }}
          CALLER_EVENT_NAME: ${{ inputs.caller_event_name }}
          CALLER_PR_HEAD_REPOSITORY: ${{ inputs.caller_pr_head_repository }}
          SNAPSHOT_REPOSITORY: ${{ inputs.snapshot_repository }}
        shell: bash
        run: |
          set -euo pipefail
          caller_repo="$CALLER_REPOSITORY"
          caller_event="$CALLER_EVENT_NAME"
          caller_pr_head_repo="$CALLER_PR_HEAD_REPOSITORY"
          snapshot_repo="$SNAPSHOT_REPOSITORY"
          expected_snapshot_repo=""
          case "$caller_repo" in
            QuantStrategyLab/CnEquityStrategies)
              expected_snapshot_repo="QuantStrategyLab/CnEquitySnapshotPipelines"
              ;;
            QuantStrategyLab/HkEquityStrategies)
              expected_snapshot_repo="QuantStrategyLab/HkEquitySnapshotPipelines"
              ;;
            QuantStrategyLab/UsEquityStrategies)
              expected_snapshot_repo="QuantStrategyLab/UsEquitySnapshotPipelines"
              ;;
            QuantStrategyLab/CryptoStrategies)
              expected_snapshot_repo="QuantStrategyLab/CryptoLivePoolPipelines"
              ;;
            *)
              echo "::error::Untrusted reusable workflow caller: $caller_repo"
              exit 1
              ;;
          esac
          case "$caller_event" in
            schedule|workflow_dispatch)
              ;;
            pull_request|pull_request_target)
              if [ -n "$caller_pr_head_repo" ] && [ "$caller_pr_head_repo" != "$caller_repo" ]; then
                echo "::error::Fork pull_request callers are not trusted: $caller_pr_head_repo"
              else
                echo "::error::pull_request callers are not trusted: $caller_repo"
              fi
              exit 1
              ;;
            "")
              echo "::error::caller_event_name must be provided by the caller workflow"
              exit 1
              ;;
            *)
              echo "::error::Unsupported caller_event_name: $caller_event"
              exit 1
              ;;
          esac
          if [ "$snapshot_repo" != "$expected_snapshot_repo" ]; then
            echo "::error::snapshot_repository mismatch for caller $caller_repo: $snapshot_repo"
            exit 1
          fi

      - name: Checkout
        uses: actions/checkout@v6

      - name: Checkout snapshot pipeline repo
        uses: actions/checkout@v6
        with:
          repository: ${{ inputs.snapshot_repository }}
          ref: ${{ inputs.snapshot_repository_ref }}
          token: ${{ secrets.snapshot_repository_token || github.token }}
          path: ${{ inputs.snapshot_checkout_path }}

      - name: Checkout QuantPlatformKit
        uses: actions/checkout@v6
        with:
          repository: QuantStrategyLab/QuantPlatformKit
          ref: ${{ inputs.quant_platform_kit_ref }}
          path: external/QuantPlatformKit

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: ${{ inputs.python_version }}

      - name: Install dependencies
        run: |
          set -euo pipefail
          python -m pip install --upgrade pip
          python -m pip install -e . pandas
          python -m pip install --no-deps -e external/QuantPlatformKit

      - name: Download lifecycle preflight artifact
        if: inputs.lifecycle_preflight_artifact != ''
        uses: actions/download-artifact@v7
        with:
          name: ${{ inputs.lifecycle_preflight_artifact }}
          path: ${{ runner.temp }}/lifecycle-preflight

      - name: Restore lifecycle preflight inputs
        if: inputs.lifecycle_preflight_artifact != ''
        env:
          PREFLIGHT_BUNDLE_ROOT: ${{ runner.temp }}/lifecycle-preflight
          SNAPSHOT_CHECKOUT_PATH: ${{ inputs.snapshot_checkout_path }}
        shell: bash
        run: |
          set -euo pipefail
          case "$SNAPSHOT_CHECKOUT_PATH" in
            external/*) ;;
            *) echo "::error::snapshot_checkout_path must remain under external/"; exit 1 ;;
          esac
          if [[ "$SNAPSHOT_CHECKOUT_PATH" == *".."* ]]; then
            echo "::error::snapshot_checkout_path must not contain traversal segments"
            exit 1
          fi
          if find "$PREFLIGHT_BUNDLE_ROOT" -type l -print -quit | grep -q .; then
            echo "::error::lifecycle preflight artifact must not contain symlinks"
            exit 1
          fi
          lifecycle_source="$PREFLIGHT_BUNDLE_ROOT/data/lifecycle_store"
          snapshot_source="$PREFLIGHT_BUNDLE_ROOT/$SNAPSHOT_CHECKOUT_PATH/data/output"
          if [ ! -d "$lifecycle_source" ] || [ ! -d "$snapshot_source" ]; then
            echo "::error::lifecycle preflight artifact is missing required allowlisted directories"
            exit 1
          fi
          snapshot_root="$GITHUB_WORKSPACE/$SNAPSHOT_CHECKOUT_PATH"
          resolved_snapshot_root="$(realpath "$snapshot_root")"
          case "$resolved_snapshot_root" in
            "$GITHUB_WORKSPACE"/external/*) ;;
            *) echo "::error::snapshot checkout resolved outside the external workspace"; exit 1 ;;
          esac
          if find "$snapshot_root" -type l -print -quit | grep -q .; then
            echo "::error::snapshot checkout must not contain symlinks"
            exit 1
          fi
          snapshot_target="$snapshot_root/data/output"
          rm -rf -- "$LIFECYCLE_LOCAL_ROOT" "$snapshot_target"
          mkdir -p "$LIFECYCLE_LOCAL_ROOT" "$GITHUB_WORKSPACE/$SNAPSHOT_CHECKOUT_PATH/data/output"
          cp -a "$lifecycle_source/." "$LIFECYCLE_LOCAL_ROOT/"
          cp -a "$snapshot_source/." "$snapshot_target/"
          if [ "$STRATEGY_DOMAIN" = "crypto" ]; then
            echo "CRYPTO_LIFECYCLE_PREFLIGHT_ROOT=$PREFLIGHT_BUNDLE_ROOT" >> "$GITHUB_ENV"
          fi

      - name: Build lifecycle performance snapshots
        shell: bash
        run: |
          set -euo pipefail
          lifecycle_args=()
          if [ -n "${LIFECYCLE_STRATEGY_PROFILE:-}" ]; then
            lifecycle_args+=(--strategy "${LIFECYCLE_STRATEGY_PROFILE}")
          fi
          quant-lifecycle monitor --domain ${{ inputs.strategy_domain }} "${lifecycle_args[@]}"

      - name: Validate lifecycle prerequisites
        shell: bash
        run: |
          set -euo pipefail
          lifecycle_args=()
          if [ -n "${LIFECYCLE_STRATEGY_PROFILE:-}" ]; then
            lifecycle_args+=(--strategy "${LIFECYCLE_STRATEGY_PROFILE}")
          fi
          quant-lifecycle doctor --domain ${{ inputs.strategy_domain }} --require-snapshot --require-backtest --max-freshness-days 7 "${lifecycle_args[@]}"

      - name: Run drift detection
        shell: bash
        run: |
          set -euo pipefail
          lifecycle_args=()
          if [ -n "${LIFECYCLE_STRATEGY_PROFILE:-}" ]; then
            lifecycle_args+=(--strategy "${LIFECYCLE_STRATEGY_PROFILE}")
          fi
          quant-lifecycle drift --domain ${{ inputs.strategy_domain }} --no-alerts "${lifecycle_args[@]}"

      - name: Sync drift alerts to GitHub Issues
        env:
          GH_TOKEN: ${{ github.token }}
          GITHUB_REPOSITORY: ${{ github.repository }}
        run: |
          python - <<'PY'
          import os

          from quant_platform_kit.strategy_lifecycle.codex_integration import create_issues_for_domain

          owner, _, repository = os.environ["GITHUB_REPOSITORY"].partition("/")
          if not owner or not repository:
              raise RuntimeError("GITHUB_REPOSITORY must identify the reusable workflow caller")
          os.environ["CODEX_AUDIT_ORG"] = owner
          os.environ["CODEX_AUDIT_ORCHESTRATOR_REPO"] = repository
          results = create_issues_for_domain("${{ inputs.strategy_domain }}")
          created = [item for item in results if item.get("issue_url")]
          print({"created_issues": len(created), "results": len(results)})
          PY

      - name: Checkout AIAuditBridge
        uses: actions/checkout@v6
        with:
          repository: QuantStrategyLab/AIAuditBridge
          ref: 5f37f07953a5ced8adc0f055ca7afc6dfee6b6d6
          path: external/AIAuditBridge

      - name: Dual-review critical drift
        env:
          AIAUDIT_BRIDGE_ROOT: external/AIAuditBridge
          CODEX_AUDIT_SERVICE_URL: ${{ secrets.codex_audit_service_url }}
          AI_GATEWAY_SERVICE_URL: ${{ inputs.ai_gateway_service_url }}
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          emit_parked_record() {
            python - "$1" "$2" <<'PY'
          import hashlib
          import json
          import os
          import sys

          reason = sys.argv[1]
          detail = sys.argv[2]
          domain = os.environ["STRATEGY_DOMAIN"]
          dedup_key = hashlib.sha256(f"drift-dual-review/{domain}/{reason}".encode()).hexdigest()
          print(json.dumps({
              "schema": "qsl.drift_dual_review_availability.v1",
              "state": "PARKED",
              "domain": domain,
              "reason": reason,
              "detail": detail[:500],
              "dedup_key": dedup_key,
              "next_action": "retry_on_next_drift_cycle",
          }, sort_keys=True))
          PY
          }
          script="external/AIAuditBridge/scripts/run_drift_dual_review.py"
          if [ ! -f "$script" ]; then
            emit_parked_record "review_script_unavailable" "$script"
            echo "::notice::Dual review parked: the drift detector and issue sync remain active"
            exit 0
          fi
          if [ -z "${CODEX_AUDIT_SERVICE_URL:-}" ]; then
            emit_parked_record "codex_audit_service_unconfigured" "CODEX_AUDIT_SERVICE_URL is empty"
            echo "::notice::Dual review parked: the drift detector and issue sync remain active"
            exit 0
          fi
          review_output="${RUNNER_TEMP}/drift-dual-review.json"
          set +e
          PYTHONPATH=external/AIAuditBridge python "$script" \
            --domain "${STRATEGY_DOMAIN}" --dispatch >"$review_output"
          review_rc=$?
          set -e
          if [ ! -f "$review_output" ]; then
            emit_parked_record "review_output_unavailable" "exit_code=$review_rc output_file_missing"
            echo "::warning::Dual review parked; no review output was produced"
            exit 0
          fi
          cat "$review_output"
          if [ "$review_rc" -ne 0 ]; then
            review_state="$(python - "$review_output" <<'PY'
          import json
          import sys

          try:
              payload = json.load(open(sys.argv[1], encoding="utf-8"))
          except (OSError, json.JSONDecodeError) as exc:
              print(f"invalid_review_json:{exc}")
              raise SystemExit(0)
          if not isinstance(payload, dict):
              print("invalid_review_json:top_level_not_object")
              raise SystemExit(0)
          if payload.get("degraded") is True:
              print("provider_degraded")
              raise SystemExit(0)
          results = payload.get("results")
          completed_outcomes = {"fail", "disagreement"}
          if (
              isinstance(results, list)
              and results
              and all(isinstance(result, dict) for result in results)
              and all(str(result.get("outcome") or "") in completed_outcomes for result in results)
          ):
              print("review_completed_blocked")
              raise SystemExit(0)
          print("review_process_failed")
          PY
            )"
            if [ "$review_state" = "review_completed_blocked" ]; then
              emit_parked_record "review_completed_blocked" "exit_code=$review_rc completed safety review blocked promotion"
              echo "::notice::Dual review completed and blocked promotion; drift remains parked"
              exit 0
            fi
            review_reason="review_process_failed"
            if [ "$review_state" = "provider_degraded" ]; then
              review_reason="review_provider_degraded"
            elif [[ "$review_state" == invalid_review_json:* ]]; then
              review_reason="review_output_invalid_json"
            fi
            emit_parked_record "$review_reason" "exit_code=$review_rc $review_state"
            echo "::warning::Dual review parked; the drift detector and de-duplicated GitHub issue sync remain active"
            exit 0
          fi