fix: allow public snapshot checkout with workflow token (#238) #85
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Update QPK Pin | |
| on: | |
| push: | |
| branches: [ main ] | |
| paths-ignore: | |
| - "QPK_PIN" | |
| - "qsl-pins.txt" | |
| - "constraints.txt" | |
| - "docs/**" | |
| - "**.md" | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| update-pin: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.11" | |
| - name: Update QPK_PIN and pin manifests | |
| id: update | |
| run: | | |
| SHA=$(git rev-parse HEAD) | |
| echo "$SHA" > QPK_PIN | |
| # Update SHAs from remote repos. Package names use hyphenated form. | |
| for pair in "us-equity-strategies:UsEquityStrategies" \ | |
| "hk-equity-strategies:HkEquityStrategies" \ | |
| "cn-equity-strategies:CnEquityStrategies" \ | |
| "crypto-strategies:CryptoStrategies"; do | |
| pkg="${pair%%:*}" | |
| repo="${pair##*:}" | |
| RSHA=$(git ls-remote "https://github.com/QuantStrategyLab/$repo.git" HEAD | cut -f1) | |
| if [ -n "$RSHA" ]; then | |
| sed -i "s|$pkg @ git+https://github.com/QuantStrategyLab/$repo.git@[a-f0-9]*|$pkg @ git+https://github.com/QuantStrategyLab/$repo.git@$RSHA|" qsl-pins.txt | |
| sed -i "s|$pkg @ git+https://github.com/QuantStrategyLab/$repo.git@[a-f0-9]*|$pkg @ git+https://github.com/QuantStrategyLab/$repo.git@$RSHA|" constraints.txt | |
| fi | |
| done | |
| sed -i "s|quant-platform-kit @ git+https://github.com/QuantStrategyLab/QuantPlatformKit.git@[a-f0-9]*|quant-platform-kit @ git+https://github.com/QuantStrategyLab/QuantPlatformKit.git@$SHA|" qsl-pins.txt | |
| sed -i "s|quant-platform-kit @ git+https://github.com/QuantStrategyLab/QuantPlatformKit.git@[a-f0-9]*|quant-platform-kit @ git+https://github.com/QuantStrategyLab/QuantPlatformKit.git@$SHA|" constraints.txt | |
| if git diff --quiet; then | |
| echo "changed=false" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "changed=true" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Verify downstream compatibility | |
| if: steps.update.outputs.changed == 'true' | |
| run: | | |
| set -euo pipefail | |
| echo "::group::Verifying packages installable with new constraints" | |
| python -m pip install --upgrade pip | |
| # Pre-install runtime deps QPK needs but doesn't declare as dependencies | |
| python -m pip install requests numpy pandas | |
| # Install QPK WITHOUT constraints (avoids self-referencing SHA conflict) | |
| python -m pip install -e . | |
| python -c "import quant_platform_kit; print('QPK import OK')" | |
| python -c "from quant_platform_kit.common.strategies import compute_portfolio_drift; print('strategies OK')" | |
| python -c "from quant_platform_kit.common.platform_runner.loader import load_strategy_definition; print('platform_runner OK')" | |
| python -c "from quant_platform_kit.notifications.telegram import send_telegram_message; print('telegram OK')" | |
| python -c "from quant_platform_kit.common.contracts import SnapshotProfileContract; print('contracts OK')" | |
| # Verify strategy repo refs are fetchable and package metadata is buildable. | |
| # | |
| # Strategy packages currently carry their own direct QPK pin. A full | |
| # dependency solve with the newly generated top-level QPK constraint | |
| # would conflict until downstream repos update those pins, so keep this | |
| # check focused on the package refs generated above. | |
| failed=0 | |
| pin_file="qsl-pins.txt" | |
| for dep in us-equity-strategies hk-equity-strategies cn-equity-strategies crypto-strategies; do | |
| echo "Checking $dep..." | |
| log_file="$(mktemp)" | |
| if python -m pip install --dry-run --no-deps -c "$pin_file" "$dep" >"${log_file}" 2>&1; then | |
| echo " $dep OK" | |
| else | |
| echo " $dep FAILED" | |
| sed -n '1,160p' "${log_file}" | |
| failed=1 | |
| fi | |
| rm -f "${log_file}" | |
| done | |
| if [ "${failed}" -ne 0 ]; then | |
| echo "One or more downstream dependency checks failed." >&2 | |
| exit 1 | |
| fi | |
| echo "::endgroup::" | |
| echo "All compatibility checks passed." | |
| - name: Create PR for pin update | |
| id: create_pin_pr | |
| if: steps.update.outputs.changed == 'true' | |
| continue-on-error: true | |
| uses: peter-evans/create-pull-request@v7 | |
| with: | |
| token: ${{ secrets.QSL_REPO_SYNC_TOKEN || github.token }} | |
| commit-message: "chore: auto-update QPK_PIN and pin manifests" | |
| title: "chore: auto-update QPK_PIN and pin manifests" | |
| body: | | |
| Automated update of QPK_PIN and QSL Git SHA pin manifests. | |
| Compatibility checks passed ✅ — all downstream-critical QPK modules verified importable. | |
| Updated SHAs: | |
| - QPK: `${{ github.sha }}` | |
| - Strategy repos: latest HEAD from each | |
| 🤖 Generated with [Claude Code](https://claude.com/claude-code) | |
| branch: auto/qpk-pin-update | |
| delete-branch: true | |
| base: main | |
| - name: Report blocked pin PR creation | |
| if: steps.update.outputs.changed == 'true' && steps.create_pin_pr.outcome == 'failure' | |
| run: | | |
| cat >> "$GITHUB_STEP_SUMMARY" <<'MD' | |
| ## QPK pin update PR not created | |
| The generated `QPK_PIN` / `qsl-pins.txt` / `constraints.txt` update was verified, but PR creation failed. | |
| Ensure `QSL_REPO_SYNC_TOKEN` is configured as a **QuantPlatformKit repository secret** | |
| (see `docs/qpk_repo_sync_auth.zh-CN.md`). Org policy blocks `GITHUB_TOKEN` PR creation. | |
| MD | |
| echo "::warning::QPK pin update PR was not created because repository policy blocks GitHub Actions PR creation." |