VPS Codex Service Ops #53
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: VPS Codex Service Ops | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| mode: | |
| description: "Operation mode" | |
| required: true | |
| type: choice | |
| default: inspect | |
| options: | |
| - inspect | |
| - deploy | |
| - repair-ssh | |
| ssh_unban_ip: | |
| description: "Optional IP to unban from sshd/fail2ban" | |
| required: false | |
| default: "" | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: vps-codex-service-ops | |
| cancel-in-progress: false | |
| jobs: | |
| vps-codex-service-ops: | |
| # Bind to a protected environment when available so deploy/repair-ssh requires approval. | |
| environment: codex-vps-ops | |
| runs-on: | |
| - self-hosted | |
| - codex-vps | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Checkout Bridge | |
| uses: actions/checkout@v6.0.3 | |
| - name: Verify trusted QPK drift workflow refs | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| set -euo pipefail | |
| for ref in \ | |
| 644cd9002ae92f2aaca6f7efb4afa4986fae05ea \ | |
| d0a081ca5868faaf1a6dd870cf4b93643978cd11 \ | |
| fcddef20eea5deb876e739263042acdcb3e9cd1b \ | |
| 4f8465b28a6787d39d21e50f9d95a77841d6ad56 \ | |
| 651c9ac4f37ce6e7fe1bac84dc7646cd5abc9e6e; do | |
| gh api \ | |
| "repos/QuantStrategyLab/QuantPlatformKit/contents/.github/workflows/reusable-drift-check.yml?ref=${ref}" \ | |
| --jq '.sha' >/dev/null | |
| done | |
| - name: Run VPS service operation | |
| env: | |
| CODEX_AUDIT_SSH_UNBAN_IP: ${{ inputs.ssh_unban_ip }} | |
| CODEX_AUDIT_SERVICE_ALLOWED_REPOSITORIES: QuantStrategyLab/AIAuditBridge,QuantStrategyLab/BinancePlatform,QuantStrategyLab/CharlesSchwabPlatform,QuantStrategyLab/CnEquitySnapshotPipelines,QuantStrategyLab/CnEquityStrategies,QuantStrategyLab/CryptoLivePoolPipelines,QuantStrategyLab/CryptoStrategies,QuantStrategyLab/FirstradePlatform,QuantStrategyLab/HkEquitySnapshotPipelines,QuantStrategyLab/HkEquityStrategies,QuantStrategyLab/IBKRGatewayManager,QuantStrategyLab/InteractiveBrokersPlatform,QuantStrategyLab/LongBridgePlatform,QuantStrategyLab/MarketSignalSources,QuantStrategyLab/PoliticalEventTrackingResearch,QuantStrategyLab/QmtPlatform,QuantStrategyLab/QuantAdvisorResearch,QuantStrategyLab/QuantPlatformKit,QuantStrategyLab/QuantRuntimeSettings,QuantStrategyLab/QuantStrategyPlugins,QuantStrategyLab/ResearchSignalContextPipelines,QuantStrategyLab/SchwabTokenAutoRefresher,QuantStrategyLab/UsEquitySnapshotPipelines,QuantStrategyLab/UsEquityStrategies | |
| # workflow_dispatch emits protected-main workflow_ref claims; the deploy script pins delegated QPK code by exact job_workflow_ref SHA. | |
| CODEX_AUDIT_SERVICE_ALLOWED_WORKFLOW_REFS: QuantStrategyLab/AIAuditBridge/.github/workflows/codex_audit.yml@refs/heads/main,QuantStrategyLab/AIAuditBridge/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/BinancePlatform/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/CharlesSchwabPlatform/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/CnEquitySnapshotPipelines/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/CnEquityStrategies/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/CryptoLivePoolPipelines/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/CryptoStrategies/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/FirstradePlatform/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/HkEquitySnapshotPipelines/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/HkEquityStrategies/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/IBKRGatewayManager/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/InteractiveBrokersPlatform/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/LongBridgePlatform/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/MarketSignalSources/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/PoliticalEventTrackingResearch/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/QmtPlatform/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/QuantAdvisorResearch/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/QuantPlatformKit/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/QuantRuntimeSettings/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/QuantStrategyPlugins/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/ResearchSignalContextPipelines/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/SchwabTokenAutoRefresher/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/UsEquitySnapshotPipelines/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/UsEquityStrategies/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/CnEquityStrategies/.github/workflows/drift-check.yml@refs/heads/main,QuantStrategyLab/UsEquityStrategies/.github/workflows/drift-check.yml@refs/heads/main,QuantStrategyLab/CryptoStrategies/.github/workflows/drift-check.yml@refs/heads/main | |
| CODEX_AUDIT_SERVICE_ALLOWED_REFS: refs/heads/main,refs/pull/*/merge | |
| # Rotation tracked in #64; remove the old SHA by 2026-07-18 after final strategy-run verification. | |
| # Must match the immutable QPK `uses:` ref pinned by all strategy drift callers. | |
| CODEX_AUDIT_SERVICE_ALLOWED_JOB_WORKFLOW_REFS: QuantStrategyLab/AIAuditBridge/.github/workflows/codex_pr_review.yml@refs/heads/main,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@644cd9002ae92f2aaca6f7efb4afa4986fae05ea,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@d0a081ca5868faaf1a6dd870cf4b93643978cd11,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@fcddef20eea5deb876e739263042acdcb3e9cd1b,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@4f8465b28a6787d39d21e50f9d95a77841d6ad56,QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml@651c9ac4f37ce6e7fe1bac84dc7646cd5abc9e6e | |
| CODEX_AUDIT_SERVICE_ALLOWED_DIRECT_REPOSITORIES: QuantStrategyLab/AIAuditBridge | |
| CODEX_AUDIT_SERVICE_ALLOWED_SOURCE_REPOSITORIES: QuantStrategyLab/AIAuditBridge,QuantStrategyLab/BinancePlatform,QuantStrategyLab/CharlesSchwabPlatform,QuantStrategyLab/CnEquitySnapshotPipelines,QuantStrategyLab/CnEquityStrategies,QuantStrategyLab/CryptoLivePoolPipelines,QuantStrategyLab/CryptoStrategies,QuantStrategyLab/FirstradePlatform,QuantStrategyLab/HkEquitySnapshotPipelines,QuantStrategyLab/HkEquityStrategies,QuantStrategyLab/IBKRGatewayManager,QuantStrategyLab/InteractiveBrokersPlatform,QuantStrategyLab/LongBridgePlatform,QuantStrategyLab/MarketSignalSources,QuantStrategyLab/PoliticalEventTrackingResearch,QuantStrategyLab/QmtPlatform,QuantStrategyLab/QuantAdvisorResearch,QuantStrategyLab/QuantPlatformKit,QuantStrategyLab/QuantRuntimeSettings,QuantStrategyLab/QuantStrategyPlugins,QuantStrategyLab/ResearchSignalContextPipelines,QuantStrategyLab/SchwabTokenAutoRefresher,QuantStrategyLab/UsEquitySnapshotPipelines,QuantStrategyLab/UsEquityStrategies | |
| CODEX_AUDIT_SERVICE_MODEL: ${{ vars.CODEX_AUDIT_SERVICE_MODEL }} | |
| CODEX_AUDIT_SERVICE_REASONING_EFFORT: ${{ vars.CODEX_AUDIT_SERVICE_REASONING_EFFORT }} | |
| CODEX_AUDIT_SERVICE_CODEX_ACCOUNT_USAGE: "1" | |
| CODEX_AUDIT_SERVICE_OPENAI_USAGE_WINDOW_DAYS: "7" | |
| CODEX_AUDIT_SERVICE_ANTHROPIC_USAGE_WINDOW_DAYS: "7" | |
| OPENAI_ADMIN_KEY: ${{ secrets.OPENAI_ADMIN_KEY }} | |
| ANTHROPIC_ADMIN_KEY: ${{ secrets.ANTHROPIC_ADMIN_KEY }} | |
| CODEX_AUDIT_SERVICE_TOKEN: ${{ secrets.CODEX_AUDIT_SERVICE_TOKEN }} | |
| run: bash scripts/deploy_codex_audit_service.sh "${{ inputs.mode }}" |