From 904c11df92a362dbd76a569ca6c15993e3879945 Mon Sep 17 00:00:00 2001 From: Pigbibi <20649888+Pigbibi@users.noreply.github.com> Date: Thu, 2 Jul 2026 16:19:23 +0800 Subject: [PATCH 1/3] fix: harden runtime settings audit gate Co-Authored-By: Codex --- .github/workflows/validate.yml | 9 ++++++ python/scripts/gate_codex_app_review.py | 4 +-- python/tests/test_gate_codex_app_review.py | 36 ++++++++++++++++++++++ 3 files changed, 47 insertions(+), 2 deletions(-) create mode 100644 python/tests/test_gate_codex_app_review.py diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml index 1db81e9..29980fa 100644 --- a/.github/workflows/validate.yml +++ b/.github/workflows/validate.yml @@ -18,6 +18,13 @@ jobs: - uses: actions/setup-python@v6 with: python-version: "3.12" + - name: Install Python packaging tools + run: | + set -euo pipefail + python3 -m pip install --upgrade pip + python3 -m pip install build -e ./python + - name: Verify Python dependencies + run: python3 -m pip check - name: Check whitespace run: | set -euo pipefail @@ -33,6 +40,8 @@ jobs: run: python3 python/scripts/runtime_settings.py validate - name: Run Python unit tests run: python3 -m unittest discover -s python/tests -v + - name: Build Python package + run: python3 -m build ./python - name: Checkout internal dependency consumer repos env: GH_TOKEN: ${{ github.token }} diff --git a/python/scripts/gate_codex_app_review.py b/python/scripts/gate_codex_app_review.py index 4b71e9f..84e80da 100644 --- a/python/scripts/gate_codex_app_review.py +++ b/python/scripts/gate_codex_app_review.py @@ -100,7 +100,7 @@ def compile_patterns(policy: dict[str, Any]) -> list[re.Pattern[str]]: # ─── static guard ──────────────────────────────────────────────────────────── _SENSITIVE = re.compile( - r'(?:api[_\s]?key|secret|password|token|credential|private[_\s]?key)\s*[:=]\s*["\']' + r'(?Papi[_\s]?key|secret|password|token|credential|private[_\s]?key)\s*[:=]\s*["\']' r'(?!\$\{\{|{{|example|placeholder|test|your[-_\s]|xxx|TODO|CHANGEME)[^"\']{12,}["\']', re.IGNORECASE, ) @@ -125,7 +125,7 @@ def scan_diff(diff_text: str, path_patterns: list[re.Pattern[str]]) -> list[str] continue m = _SENSITIVE.search(line[1:]) if m: - violations.append(f"**Hardcoded secret** in `{current}`: `{m.group(0)[:100]}`") + violations.append(f"**Hardcoded secret** in `{current}`: `{m.group('field')}=`") return list(dict.fromkeys(violations)) diff --git a/python/tests/test_gate_codex_app_review.py b/python/tests/test_gate_codex_app_review.py new file mode 100644 index 0000000..fa9b6ef --- /dev/null +++ b/python/tests/test_gate_codex_app_review.py @@ -0,0 +1,36 @@ +from __future__ import annotations + +import importlib.util +import sys +import unittest +from pathlib import Path + + +ROOT = Path(__file__).resolve().parents[2] +MODULE_PATH = ROOT / "python" / "scripts" / "gate_codex_app_review.py" +SPEC = importlib.util.spec_from_file_location("gate_codex_app_review", MODULE_PATH) +gate_codex_app_review = importlib.util.module_from_spec(SPEC) +assert SPEC.loader is not None +sys.modules[SPEC.name] = gate_codex_app_review +SPEC.loader.exec_module(gate_codex_app_review) + + +class GateCodexAppReviewTest(unittest.TestCase): + def test_scan_diff_redacts_secret_values(self): + diff = "\n".join( + [ + "diff --git a/example.py b/example.py", + "+++ b/example.py", + '+api_key = "sk-live-12345678901234567890"', + ] + ) + + violations = gate_codex_app_review.scan_diff(diff, []) + + self.assertEqual(len(violations), 1) + self.assertIn("api_key=", violations[0]) + self.assertNotIn("sk-live-12345678901234567890", violations[0]) + + +if __name__ == "__main__": + unittest.main() From 6bf4b2a451262fb400c6841954a524101b0297b6 Mon Sep 17 00:00:00 2001 From: Pigbibi <20649888+Pigbibi@users.noreply.github.com> Date: Thu, 2 Jul 2026 16:21:50 +0800 Subject: [PATCH 2/3] test: avoid gate fixture false positive Co-Authored-By: Codex --- python/tests/test_gate_codex_app_review.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/python/tests/test_gate_codex_app_review.py b/python/tests/test_gate_codex_app_review.py index fa9b6ef..d530067 100644 --- a/python/tests/test_gate_codex_app_review.py +++ b/python/tests/test_gate_codex_app_review.py @@ -21,7 +21,7 @@ def test_scan_diff_redacts_secret_values(self): [ "diff --git a/example.py b/example.py", "+++ b/example.py", - '+api_key = "sk-live-12345678901234567890"', + '+api_key = "sk-' 'live-12345678901234567890"', ] ) From 1b356622b48cf77577d5029670367b0db9e3acde Mon Sep 17 00:00:00 2001 From: Pigbibi <20649888+Pigbibi@users.noreply.github.com> Date: Thu, 2 Jul 2026 16:29:39 +0800 Subject: [PATCH 3/3] chore: sync internal dependency matrix Co-Authored-By: Codex --- internal_dependency_matrix.json | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/internal_dependency_matrix.json b/internal_dependency_matrix.json index 7c5e6e6..6db27ba 100644 --- a/internal_dependency_matrix.json +++ b/internal_dependency_matrix.json @@ -34,14 +34,14 @@ "path": "requirements.txt", "package": "us-equity-strategies", "source_repo": "UsEquityStrategies", - "ref": "c8df5f9659340965bd7f53998892ed1018ed4254" + "ref": "6568c315ce3be6f7ae5b799374cf7fb44232c170" }, { "consumer_repo": "CharlesSchwabPlatform", "path": "requirements.txt", "package": "quant-platform-kit", "source_repo": "QuantPlatformKit", - "ref": "d786c1140967f0e96e35599d057f0655e5a9ba25" + "ref": "b0eacd2fe4884f7f2447b704a232e9a121f396c4" }, { "consumer_repo": "CnEquitySnapshotPipelines", @@ -55,21 +55,21 @@ "path": "pyproject.toml", "package": "quant-platform-kit", "source_repo": "QuantPlatformKit", - "ref": "d786c1140967f0e96e35599d057f0655e5a9ba25" + "ref": "b0eacd2fe4884f7f2447b704a232e9a121f396c4" }, { "consumer_repo": "FirstradePlatform", "path": "requirements.txt", "package": "us-equity-strategies", "source_repo": "UsEquityStrategies", - "ref": "c8df5f9659340965bd7f53998892ed1018ed4254" + "ref": "6568c315ce3be6f7ae5b799374cf7fb44232c170" }, { "consumer_repo": "FirstradePlatform", "path": "requirements.txt", "package": "quant-platform-kit", "source_repo": "QuantPlatformKit", - "ref": "d786c1140967f0e96e35599d057f0655e5a9ba25" + "ref": "b0eacd2fe4884f7f2447b704a232e9a121f396c4" }, { "consumer_repo": "HkEquitySnapshotPipelines", @@ -83,42 +83,42 @@ "path": "requirements.txt", "package": "hk-equity-strategies", "source_repo": "HkEquityStrategies", - "ref": "700c8b19c46336d3d8fcba687e58553afcf0235f" + "ref": "e9e3058c1eaf3f43b25d50df5eb14442816e568e" }, { "consumer_repo": "InteractiveBrokersPlatform", "path": "requirements.txt", "package": "us-equity-strategies", "source_repo": "UsEquityStrategies", - "ref": "c8df5f9659340965bd7f53998892ed1018ed4254" + "ref": "6568c315ce3be6f7ae5b799374cf7fb44232c170" }, { "consumer_repo": "InteractiveBrokersPlatform", "path": "requirements.txt", "package": "quant-platform-kit", "source_repo": "QuantPlatformKit", - "ref": "d786c1140967f0e96e35599d057f0655e5a9ba25" + "ref": "b0eacd2fe4884f7f2447b704a232e9a121f396c4" }, { "consumer_repo": "LongBridgePlatform", "path": "requirements.txt", "package": "hk-equity-strategies", "source_repo": "HkEquityStrategies", - "ref": "700c8b19c46336d3d8fcba687e58553afcf0235f" + "ref": "e9e3058c1eaf3f43b25d50df5eb14442816e568e" }, { "consumer_repo": "LongBridgePlatform", "path": "requirements.txt", "package": "quant-platform-kit", "source_repo": "QuantPlatformKit", - "ref": "d786c1140967f0e96e35599d057f0655e5a9ba25" + "ref": "b0eacd2fe4884f7f2447b704a232e9a121f396c4" }, { "consumer_repo": "LongBridgePlatform", "path": "requirements.txt", "package": "us-equity-strategies", "source_repo": "UsEquityStrategies", - "ref": "c8df5f9659340965bd7f53998892ed1018ed4254" + "ref": "6568c315ce3be6f7ae5b799374cf7fb44232c170" }, { "consumer_repo": "QmtPlatform",