Automate strategy switch console deploy

Author: Pigbibi

.github/workflows/deploy-strategy-switch-console.yml

@@ -0,0 +1,138 @@
+name: Deploy Strategy Switch Console
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - ".github/workflows/deploy-strategy-switch-console.yml"
+      - "scripts/sync_strategy_switch_page_asset.py"
+      - "web/strategy-switch-console/**"
+  workflow_dispatch:
+    inputs:
+      sync_strategy_profiles:
+        description: "After deploy, write the bundled strategy profile catalog to KV."
+        required: true
+        type: boolean
+        default: true
+
+permissions:
+  contents: read
+
+concurrency:
+  group: strategy-switch-console-deploy
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    environment: runtime-strategy-switch
+    timeout-minutes: 15
+    env:
+      WORKER_DIR: web/strategy-switch-console
+      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+      CLOUDFLARE_WRANGLER_CONFIG_TOML: ${{ secrets.CLOUDFLARE_WRANGLER_CONFIG_TOML }}
+      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID || vars.CLOUDFLARE_ACCOUNT_ID }}
+      STRATEGY_SWITCH_CONFIG_KV_NAMESPACE_ID: ${{ secrets.STRATEGY_SWITCH_CONFIG_KV_NAMESPACE_ID || vars.STRATEGY_SWITCH_CONFIG_KV_NAMESPACE_ID }}
+      STRATEGY_SWITCH_CONSOLE_URL: ${{ vars.STRATEGY_SWITCH_CONSOLE_URL }}
+      STRATEGY_SWITCH_SYNC_TOKEN: ${{ secrets.STRATEGY_SWITCH_SYNC_TOKEN || secrets.RUNTIME_SETTINGS_GH_TOKEN }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: "22"
+
+      - name: Regenerate bundled assets
+        run: |
+          set -euo pipefail
+          python3 scripts/sync_strategy_switch_page_asset.py
+          git diff --exit-code -- web/strategy-switch-console/page_asset.js web/strategy-switch-console/strategy_profiles_asset.js
+
+      - name: Validate Worker assets
+        run: |
+          set -euo pipefail
+          jq empty web/strategy-switch-console/strategy-profiles.example.json
+          node --experimental-default-type=module tests/strategy_switch_worker_validation.mjs
+          sed -n '/<script>/,/<\/script>/p' web/strategy-switch-console/index.html | sed '1d;$d' | node --check --input-type=commonjs
+          node --check --input-type=module < web/strategy-switch-console/page_asset.js
+          node --check --input-type=module < web/strategy-switch-console/strategy_profiles_asset.js
+          node --check --input-type=module < web/strategy-switch-console/worker.js
+
+      - name: Prepare Wrangler config
+        run: |
+          set -euo pipefail
+          if [ -z "${CLOUDFLARE_API_TOKEN:-}" ] && [ -z "${CLOUDFLARE_WRANGLER_CONFIG_TOML:-}" ]; then
+            echo "CLOUDFLARE_API_TOKEN or CLOUDFLARE_WRANGLER_CONFIG_TOML is required to deploy the strategy switch console." >&2
+            exit 2
+          fi
+          if [ -n "${CLOUDFLARE_WRANGLER_CONFIG_TOML:-}" ]; then
+            mkdir -p "$HOME/.config/.wrangler/config"
+            printf '%s' "$CLOUDFLARE_WRANGLER_CONFIG_TOML" > "$HOME/.config/.wrangler/config/default.toml"
+            chmod 600 "$HOME/.config/.wrangler/config/default.toml"
+          fi
+          if [ -z "${STRATEGY_SWITCH_CONFIG_KV_NAMESPACE_ID:-}" ]; then
+            echo "STRATEGY_SWITCH_CONFIG_KV_NAMESPACE_ID is required so deploy does not drop the STRATEGY_SWITCH_CONFIG binding." >&2
+            exit 2
+          fi
+          python3 - <<'PY'
+          import os
+          from pathlib import Path
+
+          root = Path(os.environ["WORKER_DIR"])
+          source = root / "wrangler.toml.example"
+          target = root / "wrangler.toml"
+          text = source.read_text(encoding="utf-8")
+          account_id = os.environ.get("CLOUDFLARE_ACCOUNT_ID", "").strip()
+          if account_id and "\naccount_id" not in text:
+              text = text.replace("\n[vars]\n", f"\naccount_id = \"{account_id}\"\n\n[vars]\n", 1)
+
+          kv_id = os.environ["STRATEGY_SWITCH_CONFIG_KV_NAMESPACE_ID"].strip()
+          commented_kv = "\n".join([
+              "# [[kv_namespaces]]",
+              "# binding = \"STRATEGY_SWITCH_CONFIG\"",
+              "# id = \"replace-with-cloudflare-kv-namespace-id\"",
+              "",
+          ])
+          active_kv = "\n".join([
+              "[[kv_namespaces]]",
+              "binding = \"STRATEGY_SWITCH_CONFIG\"",
+              f"id = \"{kv_id}\"",
+              "",
+          ])
+          if commented_kv in text:
+              text = text.replace(commented_kv, active_kv, 1)
+          elif 'binding = "STRATEGY_SWITCH_CONFIG"' not in text:
+              text = text.rstrip() + "\n\n" + active_kv
+          target.write_text(text, encoding="utf-8")
+          PY
+
+      - name: Deploy Worker
+        working-directory: web/strategy-switch-console
+        run: npx wrangler@latest deploy --config wrangler.toml
+
+      - name: Sync bundled strategy profiles to KV
+        if: github.event_name != 'workflow_dispatch' || inputs.sync_strategy_profiles
+        run: |
+          set -euo pipefail
+          if [ -z "${STRATEGY_SWITCH_CONSOLE_URL:-}" ]; then
+            echo "STRATEGY_SWITCH_CONSOLE_URL is required to sync strategy profiles." >&2
+            exit 2
+          fi
+          if [ -z "${STRATEGY_SWITCH_SYNC_TOKEN:-}" ]; then
+            echo "STRATEGY_SWITCH_SYNC_TOKEN or RUNTIME_SETTINGS_GH_TOKEN is required to sync strategy profiles." >&2
+            exit 2
+          fi
+          curl --fail --show-error --silent \
+            --request POST \
+            --header "Authorization: Bearer ${STRATEGY_SWITCH_SYNC_TOKEN}" \
+            --header "Content-Type: application/json" \
+            --data '{"source":"github-actions"}' \
+            "${STRATEGY_SWITCH_CONSOLE_URL%/}/api/internal/sync-strategy-profiles" \
+            | python3 -m json.tool

tests/strategy_switch_worker_validation.mjs

@@ -186,6 +186,17 @@ const unauthorizedSyncResponse = await worker.fetch(
 assert.equal(unauthorizedSyncResponse.status, 401);
 assert.match((await unauthorizedSyncResponse.json()).error, /internal sync token is invalid/);
 
+const unauthorizedProfileSyncResponse = await worker.fetch(
+  new Request("https://switch.example/api/internal/sync-strategy-profiles", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: "{}",
+  }),
+  { STRATEGY_SWITCH_SYNC_TOKEN: "test-sync-token" },
+);
+assert.equal(unauthorizedProfileSyncResponse.status, 401);
+assert.match((await unauthorizedProfileSyncResponse.json()).error, /internal sync token is invalid/);
+
 assert.equal(
   await __test.withTimeout(new Promise(() => {}), 1, "fallback"),
   "fallback",
@@ -347,6 +358,48 @@ assert.deepEqual(kvUnboundSyncBody.account_options_sync, {
   skipped: true,
 });
 
+const kvUnboundProfileSyncResponse = await worker.fetch(
+  new Request("https://switch.example/api/internal/sync-strategy-profiles", {
+    method: "POST",
+    headers: {
+      Authorization: "Bearer test-sync-token",
+      "Content-Type": "application/json",
+    },
+    body: "{}",
+  }),
+  { STRATEGY_SWITCH_SYNC_TOKEN: "test-sync-token" },
+);
+assert.equal(kvUnboundProfileSyncResponse.status, 200);
+const kvUnboundProfileSyncBody = await kvUnboundProfileSyncResponse.json();
+assert.equal(kvUnboundProfileSyncBody.ok, true);
+assert.equal(kvUnboundProfileSyncBody.strategy_profiles_sync.reason, "kv_not_bound");
+assert.equal(kvUnboundProfileSyncBody.strategy_profiles_sync.skipped, true);
+
+const profileKvWrites = new Map();
+const profileSyncResponse = await worker.fetch(
+  new Request("https://switch.example/api/internal/sync-strategy-profiles", {
+    method: "POST",
+    headers: {
+      Authorization: "Bearer test-sync-token",
+      "Content-Type": "application/json",
+    },
+    body: "{}",
+  }),
+  {
+    STRATEGY_SWITCH_SYNC_TOKEN: "test-sync-token",
+    STRATEGY_SWITCH_CONFIG: {
+      get: async (key) => (key === "strategy_profiles" ? JSON.stringify([{ profile: "stale" }]) : null),
+      put: async (key, value) => profileKvWrites.set(key, value),
+    },
+  },
+);
+assert.equal(profileSyncResponse.status, 200);
+const profileSyncBody = await profileSyncResponse.json();
+assert.equal(profileSyncBody.ok, true);
+assert.equal(profileSyncBody.strategy_profiles_sync.synced, true);
+assert.equal(profileSyncBody.strategy_profiles_sync.changed, true);
+assert.ok(JSON.parse(profileKvWrites.get("strategy_profiles")).some((item) => item.profile === "ibit_smart_dca"));
+
 const normalizedReservedCashInputs = __test.normalizeSwitchInputs({
   platform: "ibkr",
   target_name: "ibkr-primary",

tests/test_runtime_settings.py

@@ -156,6 +156,20 @@ def test_manual_switch_account_default_sync_is_warning_only(self):
         self.assertIn("::warning::", workflow)
         self.assertIn("raise SystemExit(0)", workflow)
 
+    def test_strategy_switch_console_deploy_workflow_syncs_bundled_profiles(self):
+        workflow = (ROOT / ".github" / "workflows" / "deploy-strategy-switch-console.yml").read_text(
+            encoding="utf-8"
+        )
+
+        self.assertIn("environment: runtime-strategy-switch", workflow)
+        self.assertIn("npx wrangler@latest deploy --config wrangler.toml", workflow)
+        self.assertIn("/api/internal/sync-strategy-profiles", workflow)
+        self.assertIn("STRATEGY_SWITCH_CONSOLE_URL", workflow)
+        self.assertIn("STRATEGY_SWITCH_SYNC_TOKEN", workflow)
+        self.assertIn("CLOUDFLARE_WRANGLER_CONFIG_TOML", workflow)
+        self.assertIn("STRATEGY_SWITCH_CONFIG_KV_NAMESPACE_ID", workflow)
+        self.assertIn("scripts/sync_strategy_switch_page_asset.py", workflow)
+
     def test_plugin_mount_schema_version_must_be_non_empty_string(self):
         _, target = self.load_target("examples/targets/schwab/live.example.json")
         target["plugin_mounts"][0]["expected_schema_version"] = ""

web/strategy-switch-console/README.md

@@ -133,7 +133,7 @@ When adding or renaming a strategy profile:
 - Set `domain` on each strategy profile. Current values are `us_equity` and `hk_equity`.
 - Set each affected account's `default_strategy_profile` and `supported_domains` in `account-options.example.json` and the deployed KV account config.
 - Use `["us_equity", "hk_equity"]` for LongBridge and IBKR accounts unless you intentionally want to narrow a specific account.
-- Update the deployed KV `strategy_profiles` key from `strategy-profiles.example.json`.
+- The main-branch deploy workflow updates the deployed KV `strategy_profiles` key from `strategy-profiles.example.json` after deploying the Worker. For manual deploys, call `/api/internal/sync-strategy-profiles` with the Worker sync token.
 - Make sure the platform repository's current `RUNTIME_TARGET_JSON.strategy_profile` or account-specific `CLOUD_RUN_SERVICE_TARGETS_JSON` uses the same id.
 - Let `manual-strategy-switch.yml` manage platform plugin mounts. It writes an empty `*_STRATEGY_PLUGIN_MOUNTS_JSON` payload for strategies without plugin mounts, so old strategy plugin config is cleared instead of lingering.
 - Use lower-case ids with letters, numbers, dot, underscore, dash, or equals only. Do not encode account names or secrets in profile ids.
@@ -181,6 +181,8 @@ wrangler kv namespace create STRATEGY_SWITCH_CONFIG
 
 Add the returned namespace id to `wrangler.toml`.
 
+For GitHub Actions auto-deploy, configure `STRATEGY_SWITCH_CONFIG_KV_NAMESPACE_ID`, `STRATEGY_SWITCH_CONSOLE_URL`, `STRATEGY_SWITCH_SYNC_TOKEN`, and either `CLOUDFLARE_API_TOKEN` or `CLOUDFLARE_WRANGLER_CONFIG_TOML` in the `runtime-strategy-switch` environment (or reuse `RUNTIME_SETTINGS_GH_TOKEN` only if it matches the Worker sync secret). `CLOUDFLARE_ACCOUNT_ID` is optional when Wrangler can infer it from the token. The workflow deploys the Worker and then syncs the bundled strategy profile catalog into KV so the website is not left with stale profile/plugin metadata.
+
 Deploy:
 
 ```bash

web/strategy-switch-console/README.zh-CN.md

@@ -140,7 +140,7 @@ Worker 会校验 dispatch 参数必须匹配这里的某个账号项，也会校
 - 给每个策略 profile 设置 `domain`。当前支持 `us_equity` 和 `hk_equity`。
 - 在 `account-options.example.json` 和已部署的 KV 账号配置里更新对应账号的 `default_strategy_profile` 和 `supported_domains`。
 - LongBridge 和 IBKR 账号默认写 `["us_equity", "hk_equity"]`，除非你明确要把某个账号限制成单市场。
-- 用 `strategy-profiles.example.json` 更新已部署 KV 的 `strategy_profiles` key。
+- main 分支部署 workflow 会在 Worker 部署后，用 `strategy-profiles.example.json` 自动更新已部署 KV 的 `strategy_profiles` key。手动部署时，可用 Worker 同步 token 调用 `/api/internal/sync-strategy-profiles`。
 - 确认平台仓库当前的 `RUNTIME_TARGET_JSON.strategy_profile` 或账号级 `CLOUD_RUN_SERVICE_TARGETS_JSON` 使用同一个 id。
 - 让 `manual-strategy-switch.yml` 统一管理平台 plugin mounts。策略不需要插件时，它会写入空的 `*_STRATEGY_PLUGIN_MOUNTS_JSON`，清掉旧策略留下的插件配置。
 - profile id 只使用小写字母、数字、点、下划线、短横线或等号。不要把账号名、密码、token、密钥信息写进 profile id。
@@ -188,6 +188,8 @@ wrangler kv namespace create STRATEGY_SWITCH_CONFIG
 
 然后把返回的 namespace id 加到 `wrangler.toml`。
 
+GitHub Actions 自动部署需要在 `runtime-strategy-switch` environment 配置 `STRATEGY_SWITCH_CONFIG_KV_NAMESPACE_ID`、`STRATEGY_SWITCH_CONSOLE_URL`、`STRATEGY_SWITCH_SYNC_TOKEN`，以及 `CLOUDFLARE_API_TOKEN` 或 `CLOUDFLARE_WRANGLER_CONFIG_TOML` 二选一（只有当 `RUNTIME_SETTINGS_GH_TOKEN` 与 Worker 同步密钥相同时才复用它）。如果 Wrangler 能从 token 推断账号，`CLOUDFLARE_ACCOUNT_ID` 可不配。workflow 会先部署 Worker，再把内置策略 profile 目录同步到 KV，避免网站继续使用旧的 profile/plugin 元数据。
+
 部署：
 
 ```bash

web/strategy-switch-console/worker.js

@@ -96,6 +96,9 @@ export default {
       if (url.pathname === "/api/internal/sync-account-default" && request.method === "POST") {
         return await syncAccountDefaultResponse(request, env);
       }
+      if (url.pathname === "/api/internal/sync-strategy-profiles" && request.method === "POST") {
+        return await syncStrategyProfilesResponse(request, env);
+      }
       if (url.pathname === "/api/logout" && request.method === "POST") return logout(request);
       if (url.pathname === "/api/switch" && request.method === "POST") return await dispatchSwitch(request, env);
       return html(PAGE_HTML);
@@ -848,6 +851,52 @@ function requireInternalSyncToken(request, env) {
   if (token !== expected) throw new HttpError("internal sync token is invalid", 401);
 }
 
+async function syncStrategyProfilesResponse(request, env) {
+  requireInternalSyncToken(request, env);
+  const result = await syncStrategyProfilesConfig(env, { login: "github-actions" });
+  const kvSyncSkipped = result.reason === "kv_not_bound";
+  const strategyProfilesSync = kvSyncSkipped ? { ...result, skipped: true } : result;
+  return json(
+    {
+      ok: result.synced || kvSyncSkipped,
+      strategy_profiles_sync: strategyProfilesSync,
+      strategy_profiles_count: result.count,
+    },
+    result.synced || kvSyncSkipped ? 200 : 500,
+  );
+}
+
+async function syncStrategyProfilesConfig(env, session) {
+  const profiles = normalizeStrategyProfilesPayload(DEFAULT_STRATEGY_PROFILES, "DEFAULT_STRATEGY_PROFILES");
+  if (!hasConfigStore(env)) return { synced: false, reason: "kv_not_bound", count: profiles.length };
+  let changed = true;
+  try {
+    const current = await readConfigJson(env, STRATEGY_PROFILES_KEY);
+    if (current) {
+      const normalizedCurrent = normalizeStrategyProfilesPayload(current, STRATEGY_PROFILES_KEY);
+      changed = JSON.stringify(normalizedCurrent) !== JSON.stringify(profiles);
+    }
+  } catch {
+    changed = true;
+  }
+  let auditLogged = false;
+  if (changed) {
+    await writeConfigJson(env, STRATEGY_PROFILES_KEY, profiles);
+    try {
+      await appendAuditLog(env, {
+        ts: new Date().toISOString(),
+        login: session?.login || "",
+        action: "sync_strategy_profiles",
+        count: profiles.length,
+      });
+      auditLogged = true;
+    } catch {
+      auditLogged = false;
+    }
+  }
+  return { synced: true, changed, count: profiles.length, audit_logged: auditLogged };
+}
+
 function updateAccountOptionsDefaultStrategy(accountOptions, inputs) {
   const options = normalizeAccountOptionsPayload(accountOptions || {}, ACCOUNT_OPTIONS_KEY);
   const platformOptions = options[inputs.platform] || [];
@@ -2222,6 +2271,7 @@ export const __test = {
   requireSameOrigin,
   responseHeaders,
   fetchWithTimeout,
+  syncDefaultStrategyProfiles: syncStrategyProfilesConfig,
   syncDefaultStrategyForAccount,
   supportedDomainsForAccount,
   updateAccountOptionsDefaultStrategy,