fix: use PR-based auto-update for QPK_PIN (bypass GH013)

Author: Pigbibi

.github/workflows/update-qpk-pin.yml

@@ -5,11 +5,13 @@ on:
     branches: [ main ]
     paths-ignore:
       - "QPK_PIN"
+      - "constraints.txt"
       - "docs/**"
       - "**.md"
 
 permissions:
   contents: write
+  pull-requests: write
 
 jobs:
   update-pin:
@@ -19,26 +21,31 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
-      - name: Update QPK_PIN
+      - name: Update QPK_PIN and constraints
+        id: update
         run: |
           SHA=$(git rev-parse HEAD)
           echo "$SHA" > QPK_PIN
-          # Update constraints.txt with latest QPK SHA
-          sed -i "s|quant-platform-kit @ git+https://github.com/QuantStrategyLab/QuantPlatformKit.git@[a-f0-9]*|quant-platform-kit @ git+https://github.com/QuantStrategyLab/QuantPlatformKit.git@$SHA|" constraints.txt
-          # Fetch latest SHAs from all strategy repos and update constraints
-          for repo in UsEquityStrategies HkEquityStrategies CnEquityStrategies CryptoStrategies QuantUsComboStrategies; do
-            REMOTE_SHA=$(git ls-remote "https://github.com/QuantStrategyLab/$repo.git" HEAD | cut -f1)
-            [ -n "$REMOTE_SHA" ] && sed -i "s|${repo,,} @ git+https://github.com/QuantStrategyLab/$repo.git@[a-f0-9]*|${repo,,} @ git+https://github.com/QuantStrategyLab/$repo.git@$REMOTE_SHA|" constraints.txt || true
+
+          # Update SHAs from remote repos
+          for repo in UsEquityStrategies HkEquityStrategies CnEquityStrategies CryptoStrategies; do
+            RSHA=$(git ls-remote "https://github.com/QuantStrategyLab/$repo.git" HEAD | cut -f1)
+            [ -n "$RSHA" ] && sed -i "s|${repo,,} @ git+https://github.com/QuantStrategyLab/$repo.git@[a-f0-9]*|${repo,,} @ git+https://github.com/QuantStrategyLab/$repo.git@$RSHA|" constraints.txt || true
           done
+          sed -i "s|quant-platform-kit @ git+https://github.com/QuantStrategyLab/QuantPlatformKit.git@[a-f0-9]*|quant-platform-kit @ git+https://github.com/QuantStrategyLab/QuantPlatformKit.git@$SHA|" constraints.txt
 
-      - name: Commit and push updated pin
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add QPK_PIN
-          if git diff --cached --quiet; then
-            echo "QPK_PIN already up to date"
+          if git diff --quiet; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
           else
-            git commit -m "chore: update QPK_PIN to $SHA"
-            git push
+            echo "changed=true" >> "$GITHUB_OUTPUT"
           fi
+
+      - name: Create PR for pin update
+        if: steps.update.outputs.changed == 'true'
+        uses: peter-evans/create-pull-request@v7
+        with:
+          commit-message: "chore: auto-update QPK_PIN and constraints.txt"
+          title: "chore: auto-update QPK_PIN and constraints.txt"
+          body: "Automated update of QPK_PIN and dependency constraint SHAs."
+          branch: auto/qpk-pin-update
+          delete-branch: true

constraints.txt

@@ -1,15 +1,12 @@
 # QSL Dependency Constraints — SINGLE SOURCE OF TRUTH
-# All repos MUST reference this file for git-based dependency SHAs.
-# Generated: 2026-07-01
 # Auto-updated by update-qpk-pin.yml on every push to QPK main.
 
-quant-platform-kit @ git+https://github.com/QuantStrategyLab/QuantPlatformKit.git@a9085d6d46147f62b80bbd441d19d85acaa3dda6
-us-equity-strategies @ git+https://github.com/QuantStrategyLab/UsEquityStrategies.git@635f64207a9db8dc7af51e7ad496557a57be5579
-hk-equity-strategies @ git+https://github.com/QuantStrategyLab/HkEquityStrategies.git@5fb48ea102c28deb6dd1c9674553f3c77aba4f2c
-cn-equity-strategies @ git+https://github.com/QuantStrategyLab/CnEquityStrategies.git@e09fd557c2bd9ae5f4d44228915c4e52c4b0dd21
-crypto-strategies @ git+https://github.com/QuantStrategyLab/CryptoStrategies.git@565be005e4186fd6d750884e7b0bc59f779f9549
+quant-platform-kit @ git+https://github.com/QuantStrategyLab/QuantPlatformKit.git@cfcbbcd51be902877eb760bc55b2612351a31e90
+us-equity-strategies @ git+https://github.com/QuantStrategyLab/UsEquityStrategies.git@1e8b6ee28cdba8a9637276cf8619cd8890fa6861
+hk-equity-strategies @ git+https://github.com/QuantStrategyLab/HkEquityStrategies.git@1a5c8bf5f05eb708a0893f0062c6824aa9ef1882
+cn-equity-strategies @ git+https://github.com/QuantStrategyLab/CnEquityStrategies.git@2e5a8da3af5fa25c1a5e7de6fa00bda488f50440
+crypto-strategies @ git+https://github.com/QuantStrategyLab/CryptoStrategies.git@6e0037b625c98ccdb97f225b9772e3c6fff4afd2
 quantuscombostrategies @ git+https://github.com/QuantStrategyLab/QuantUsComboStrategies.git@d35f4f86b09a7f4e99a1f83c973b21f2420398ef
 quanthkcombostrategies @ git+https://github.com/QuantStrategyLab/QuantHkComboStrategies.git@dfc21e923c0f9ba54678a75d0edc96a56e2188e2
 quantcncombostrategies @ git+https://github.com/QuantStrategyLab/QuantCnComboStrategies.git@1172e77e8046088c2bab2880343786ec135539da
 quantcryptocombostrategies @ git+https://github.com/QuantStrategyLab/QuantCryptoComboStrategies.git@475c5259d3ba7e2dcd4de30aaa96437142669a1c
-# Updated 2026-06-30