update-qpk-pin.yml

name: Update QPK Pin

on:
  push:
    branches: [ main ]
    paths-ignore:
      - "QPK_PIN"
      - "qsl-pins.txt"
      - "constraints.txt"
      - "docs/**"
      - "**.md"

permissions:
  contents: write
  pull-requests: write

jobs:
  update-pin:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-python@v6
        with:
          python-version: "3.11"

      - name: Update QPK_PIN and pin manifests
        id: update
        run: |
          SHA=$(git rev-parse HEAD)
          echo "$SHA" > QPK_PIN

          # Update SHAs from remote repos. Package names use hyphenated form.
          for pair in "us-equity-strategies:UsEquityStrategies" \
                      "hk-equity-strategies:HkEquityStrategies" \
                      "cn-equity-strategies:CnEquityStrategies" \
                      "crypto-strategies:CryptoStrategies"; do
            pkg="${pair%%:*}"
            repo="${pair##*:}"
            RSHA=$(git ls-remote "https://github.com/QuantStrategyLab/$repo.git" HEAD | cut -f1)
            if [ -n "$RSHA" ]; then
              sed -i "s|$pkg @ git+https://github.com/QuantStrategyLab/$repo.git@[a-f0-9]*|$pkg @ git+https://github.com/QuantStrategyLab/$repo.git@$RSHA|" qsl-pins.txt
              sed -i "s|$pkg @ git+https://github.com/QuantStrategyLab/$repo.git@[a-f0-9]*|$pkg @ git+https://github.com/QuantStrategyLab/$repo.git@$RSHA|" constraints.txt
            fi
          done
          sed -i "s|quant-platform-kit @ git+https://github.com/QuantStrategyLab/QuantPlatformKit.git@[a-f0-9]*|quant-platform-kit @ git+https://github.com/QuantStrategyLab/QuantPlatformKit.git@$SHA|" qsl-pins.txt
          sed -i "s|quant-platform-kit @ git+https://github.com/QuantStrategyLab/QuantPlatformKit.git@[a-f0-9]*|quant-platform-kit @ git+https://github.com/QuantStrategyLab/QuantPlatformKit.git@$SHA|" constraints.txt

          if git diff --quiet; then
            echo "changed=false" >> "$GITHUB_OUTPUT"
          else
            echo "changed=true" >> "$GITHUB_OUTPUT"
          fi

      - name: Verify downstream compatibility
        if: steps.update.outputs.changed == 'true'
        run: |
          set -euo pipefail
          echo "::group::Verifying packages installable with new constraints"
          python -m pip install --upgrade pip
          # Pre-install runtime deps QPK needs but doesn't declare as dependencies
          python -m pip install requests numpy pandas
          # Install QPK WITHOUT constraints (avoids self-referencing SHA conflict)
          python -m pip install -e .
          python -c "import quant_platform_kit; print('QPK import OK')"
          python -c "from quant_platform_kit.common.strategies import compute_portfolio_drift; print('strategies OK')"
          python -c "from quant_platform_kit.common.platform_runner.loader import load_strategy_definition; print('platform_runner OK')"
          python -c "from quant_platform_kit.notifications.telegram import send_telegram_message; print('telegram OK')"
          python -c "from quant_platform_kit.common.contracts import SnapshotProfileContract; print('contracts OK')"

          # Verify strategy repo refs are fetchable and package metadata is buildable.
          #
          # Strategy packages currently carry their own direct QPK pin. A full
          # dependency solve with the newly generated top-level QPK constraint
          # would conflict until downstream repos update those pins, so keep this
          # check focused on the package refs generated above.
          failed=0
          pin_file="qsl-pins.txt"
          for dep in us-equity-strategies hk-equity-strategies cn-equity-strategies crypto-strategies; do
            echo "Checking $dep..."
            log_file="$(mktemp)"
            if python -m pip install --dry-run --no-deps -c "$pin_file" "$dep" >"${log_file}" 2>&1; then
              echo "  $dep OK"
            else
              echo "  $dep FAILED"
              sed -n '1,160p' "${log_file}"
              failed=1
            fi
            rm -f "${log_file}"
          done
          if [ "${failed}" -ne 0 ]; then
            echo "One or more downstream dependency checks failed." >&2
            exit 1
          fi
          echo "::endgroup::"
          echo "All compatibility checks passed."

      - name: Create PR for pin update
        id: create_pin_pr
        if: steps.update.outputs.changed == 'true'
        continue-on-error: true
        uses: peter-evans/create-pull-request@v7
        with:
          token: ${{ secrets.QSL_REPO_SYNC_TOKEN || github.token }}
          commit-message: "chore: auto-update QPK_PIN and pin manifests"
          title: "chore: auto-update QPK_PIN and pin manifests"
          body: |
            Automated update of QPK_PIN and QSL Git SHA pin manifests.

            Compatibility checks passed ✅ — all downstream-critical QPK modules verified importable.

            Updated SHAs:
            - QPK: `${{ github.sha }}`
            - Strategy repos: latest HEAD from each

            🤖 Generated with [Claude Code](https://claude.com/claude-code)
          branch: auto/qpk-pin-update
          delete-branch: true
          base: main

      - name: Report blocked pin PR creation
        if: steps.update.outputs.changed == 'true' && steps.create_pin_pr.outcome == 'failure'
        run: |
          cat >> "$GITHUB_STEP_SUMMARY" <<'MD'
          ## QPK pin update PR not created

          The generated `QPK_PIN` / `qsl-pins.txt` / `constraints.txt` update was verified, but PR creation failed.

          Ensure `QSL_REPO_SYNC_TOKEN` is configured as a **QuantPlatformKit repository secret**
          (see `docs/qpk_repo_sync_auth.zh-CN.md`). Org policy blocks `GITHUB_TOKEN` PR creation.
          MD
          echo "::warning::QPK pin update PR was not created because repository policy blocks GitHub Actions PR creation."