ci.yml

name: CI

on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read

jobs:
  test:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Reject public runtime configuration bindings
        run: |
          set -euo pipefail
          if rg -n '\$\{\{[[:space:]]*vars\.(GLOBAL_TELEGRAM_CHAT_ID|CLOUD_RUN_SERVICES|CLOUD_RUN_SERVICE|RUNTIME_HEARTBEAT_REQUIRED_SERVICES|RUNTIME_GUARD_SCHEDULER_JOB_PATTERN)([[:space:]]|\}\}|\|\|)' .github/workflows; then
            echo "Sensitive operational runtime configuration must use GitHub Secrets, not GitHub Variables." >&2
            exit 1
          fi

      - name: Read locked shared dependency refs
        id: locked-shared-refs
        run: |
          set -euo pipefail
          python - <<'PY' >> "$GITHUB_OUTPUT"
          import re
          import tomllib
          from pathlib import Path

          required = {"quant-platform-kit", "us-equity-strategies"}
          lock = tomllib.loads(Path("uv.lock").read_text(encoding="utf-8"))
          refs = {}
          for package in lock.get("package", []):
              name = package.get("name")
              if name not in required:
                  continue
              source = package.get("source") or {}
              match = re.search(r"#([0-9a-f]{40})$", str(source.get("git") or ""))
              if match:
                  refs[name] = match.group(1)
          if set(refs) != required:
              raise SystemExit("uv.lock lacks a full SHA for a shared dependency")
          for name in sorted(refs):
              print(f"{name.replace('-', '_')}={refs[name]}")
          PY

      - name: Checkout QuantPlatformKit
        uses: actions/checkout@v6
        with:
          repository: QuantStrategyLab/QuantPlatformKit
          ref: ${{ steps.locked-shared-refs.outputs.quant_platform_kit }}
          path: external/QuantPlatformKit

      - name: Checkout UsEquityStrategies
        uses: actions/checkout@v6
        with:
          repository: QuantStrategyLab/UsEquityStrategies
          ref: ${{ steps.locked-shared-refs.outputs.us_equity_strategies }}
          path: external/UsEquityStrategies

      - name: Setup Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Install dependencies
        run: |
          set -euo pipefail
          python -m pip install --upgrade pip uv
          uv sync --frozen --extra test
      - name: Verify shared repository refs
        run: |
          set -euo pipefail
          test "$(git -C external/QuantPlatformKit rev-parse HEAD)" = "${{ steps.locked-shared-refs.outputs.quant_platform_kit }}"
          test "$(git -C external/UsEquityStrategies rev-parse HEAD)" = "${{ steps.locked-shared-refs.outputs.us_equity_strategies }}"

      - name: Smoke import pinned shared packages
        run: |
          set -euo pipefail
          uv run --no-sync python - <<'PY'
          import importlib.metadata
          import json
          import tomllib
          from pathlib import Path

          lock = tomllib.loads(Path("uv.lock").read_text(encoding="utf-8"))
          for package in lock["package"]:
              if package["name"] not in {"quant-platform-kit", "us-equity-strategies"}:
                  continue
              expected = package["source"]["git"].rsplit("#", 1)[1]
              installed = json.loads(importlib.metadata.distribution(package["name"]).read_text("direct_url.json") or "{}")
              assert installed.get("vcs_info", {}).get("commit_id") == expected, package["name"]
          PY
          uv run --no-sync python - <<'PY'
          from quant_platform_kit.common.port_adapters import CallableNotificationPort, CallablePortfolioPort
          from us_equity_strategies import resolve_canonical_profile

          assert CallableNotificationPort
          assert CallablePortfolioPort
          assert resolve_canonical_profile("russell_top50_leader_rotation") == "russell_top50_leader_rotation"
          PY

      - name: Verify Python dependencies
        run: uv pip check

      - name: Run ruff
        run: |
          set -euo pipefail
          uv run --no-sync ruff check --exclude external .

      - name: Check QPK pin consistency
        run: |
          set -euo pipefail
          printf '%s\n' "${{ steps.locked-shared-refs.outputs.quant_platform_kit }}" > "$RUNNER_TEMP/firstrade-qpk-pin"
          uv run --no-sync python external/QuantPlatformKit/scripts/check_qpk_pin_consistency.py \
            --root . \
            --pin-file "$RUNNER_TEMP/firstrade-qpk-pin"

      - name: Ensure uv.lock matches pyproject.toml
        run: uv lock --check

      - name: Run tests
        run: uv run --no-sync python -m pytest -q

      - name: Build package
        run: uv run --no-sync python -m build