From 66600c9b791405e85ea6ba51af73f8ee7f58d5cd Mon Sep 17 00:00:00 2001 From: Pigbibi <20649888+Pigbibi@users.noreply.github.com> Date: Tue, 11 Aug 2026 13:17:34 +0800 Subject: [PATCH 1/3] fix: harden Dependabot automation Co-Authored-By: Codex --- .github/CODEOWNERS | 7 ++- .github/workflows/dependabot_auto_merge.yml | 12 +++-- .../dependabot_review_request_cleanup.yml | 51 ------------------- 3 files changed, 15 insertions(+), 55 deletions(-) delete mode 100644 .github/workflows/dependabot_review_request_cleanup.yml diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 943acd4d..f5ad75e0 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -1 +1,6 @@ -* @Pigbibi +# Limit automatic review requests to order and risk-sensitive source changes. +/src/quant_platform_kit/risk/ @Pigbibi +/src/quant_platform_kit/binance/ @Pigbibi +/src/quant_platform_kit/ibkr/ @Pigbibi +/src/quant_platform_kit/longbridge/ @Pigbibi +/src/quant_platform_kit/schwab/ @Pigbibi diff --git a/.github/workflows/dependabot_auto_merge.yml b/.github/workflows/dependabot_auto_merge.yml index 476c38da..7530d8b0 100644 --- a/.github/workflows/dependabot_auto_merge.yml +++ b/.github/workflows/dependabot_auto_merge.yml @@ -43,7 +43,7 @@ jobs: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | set -euo pipefail - gh pr view "${{ steps.pr.outputs.pr_number }}" --repo "${GITHUB_REPOSITORY}" --json number,isDraft,author,url,body,labels > pr.json + gh pr view "${{ steps.pr.outputs.pr_number }}" --repo "${GITHUB_REPOSITORY}" --json number,isDraft,author,url,title,body,labels > pr.json python3 - <<'PY' import json import os @@ -52,15 +52,20 @@ jobs: pr = json.loads(Path("pr.json").read_text(encoding="utf-8")) author = (pr.get("author") or {}).get("login") labels = {item.get("name", "") for item in pr.get("labels", [])} + title = pr.get("title") or "" body = pr.get("body") or "" is_major = "update-type: version-update:semver-major" in body + sensitive_labels = {"docker", "github_actions"} + is_sensitive = bool(labels & sensitive_labels) or "QuantStrategyLab/" in title or "QuantStrategyLab/" in body dependabot_authors = {"dependabot[bot]", "app/dependabot"} is_dependabot = author in dependabot_authors and "dependencies" in labels - should_merge = is_dependabot and not pr.get("isDraft") and not is_major + should_merge = is_dependabot and not pr.get("isDraft") and not is_major and not is_sensitive if should_merge: reason = "ready" elif is_major: reason = "major_update" + elif is_sensitive: + reason = "sensitive_dependency_update" else: reason = "not_eligible_dependabot_pr" @@ -71,6 +76,7 @@ jobs: f"- Draft: `{'yes' if pr.get('isDraft') else 'no'}`", f"- Dependabot label: `{'yes' if 'dependencies' in labels else 'no'}`", f"- Major update: `{'yes' if is_major else 'no'}`", + f"- Sensitive dependency class: `{'yes' if is_sensitive else 'no'}`", f"- Final merge decision: `{'merge' if should_merge else 'skip'}`", f"- Reason: `{reason}`", ] @@ -88,4 +94,4 @@ jobs: if: steps.merge_guard.outputs.should_merge == 'true' env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: gh pr merge "${{ steps.pr.outputs.pr_number }}" --repo "${GITHUB_REPOSITORY}" --rebase --delete-branch --match-head-commit "${{ steps.pr.outputs.head_sha }}" + run: gh pr merge "${{ steps.pr.outputs.pr_number }}" --repo "${GITHUB_REPOSITORY}" --auto --rebase --delete-branch --match-head-commit "${{ steps.pr.outputs.head_sha }}" diff --git a/.github/workflows/dependabot_review_request_cleanup.yml b/.github/workflows/dependabot_review_request_cleanup.yml deleted file mode 100644 index 9f816111..00000000 --- a/.github/workflows/dependabot_review_request_cleanup.yml +++ /dev/null @@ -1,51 +0,0 @@ -name: Dismiss Dependabot Review Request - -"on": - pull_request_target: - types: [review_requested] - -permissions: - contents: read - pull-requests: write - -jobs: - dismiss-review-request: - if: >- - (github.event.pull_request.user.login == 'dependabot[bot]' || - github.event.pull_request.user.login == 'app/dependabot') && - github.event.requested_reviewer.login == 'Pigbibi' - runs-on: ubuntu-latest - timeout-minutes: 5 - steps: - - name: Dismiss Pigbibi review request - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - PR_NUMBER: ${{ github.event.pull_request.number }} - REVIEWER: Pigbibi - run: | - set -euo pipefail - current_review_requests() { - gh pr view "${PR_NUMBER}" \ - --repo "${GITHUB_REPOSITORY}" \ - --json reviewRequests \ - --jq '.reviewRequests[].login' - } - - review_requests="$(current_review_requests)" - if ! grep -Fqx "${REVIEWER}" <<<"${review_requests}"; then - echo "No review request for ${REVIEWER}; nothing to dismiss." >> "${GITHUB_STEP_SUMMARY}" - exit 0 - fi - - if ! gh api --method DELETE \ - "repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}/requested_reviewers" \ - -f "reviewers[]=${REVIEWER}"; then - review_requests="$(current_review_requests)" - if ! grep -Fqx "${REVIEWER}" <<<"${review_requests}"; then - echo "Review request was removed concurrently; nothing to dismiss." >> "${GITHUB_STEP_SUMMARY}" - exit 0 - fi - exit 1 - fi - - echo "Dismissed Dependabot review request for ${REVIEWER}." >> "${GITHUB_STEP_SUMMARY}" From 5f7299dc52aec3c03401b7c9f29e20c79c97627e Mon Sep 17 00:00:00 2001 From: Pigbibi <20649888+Pigbibi@users.noreply.github.com> Date: Tue, 11 Aug 2026 13:32:46 +0800 Subject: [PATCH 2/3] fix: retain disabled workflow tombstone Co-Authored-By: Codex --- .../dependabot_review_request_cleanup.yml | 51 +++++++++++++++++++ 1 file changed, 51 insertions(+) create mode 100644 .github/workflows/dependabot_review_request_cleanup.yml diff --git a/.github/workflows/dependabot_review_request_cleanup.yml b/.github/workflows/dependabot_review_request_cleanup.yml new file mode 100644 index 00000000..6e6475e9 --- /dev/null +++ b/.github/workflows/dependabot_review_request_cleanup.yml @@ -0,0 +1,51 @@ +name: Dismiss Dependabot Review Request + +# Disabled tombstone: automatic cleanup cannot retract an already-sent review notification. +"on": + workflow_dispatch: + +permissions: + contents: read + pull-requests: write + +jobs: + dismiss-review-request: + if: >- + (github.event.pull_request.user.login == 'dependabot[bot]' || + github.event.pull_request.user.login == 'app/dependabot') && + github.event.requested_reviewer.login == 'Pigbibi' + runs-on: ubuntu-latest + timeout-minutes: 5 + steps: + - name: Dismiss Pigbibi review request + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + PR_NUMBER: ${{ github.event.pull_request.number }} + REVIEWER: Pigbibi + run: | + set -euo pipefail + current_review_requests() { + gh pr view "${PR_NUMBER}" \ + --repo "${GITHUB_REPOSITORY}" \ + --json reviewRequests \ + --jq '.reviewRequests[].login' + } + + review_requests="$(current_review_requests)" + if ! grep -Fqx "${REVIEWER}" <<<"${review_requests}"; then + echo "No review request for ${REVIEWER}; nothing to dismiss." >> "${GITHUB_STEP_SUMMARY}" + exit 0 + fi + + if ! gh api --method DELETE \ + "repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}/requested_reviewers" \ + -f "reviewers[]=${REVIEWER}"; then + review_requests="$(current_review_requests)" + if ! grep -Fqx "${REVIEWER}" <<<"${review_requests}"; then + echo "Review request was removed concurrently; nothing to dismiss." >> "${GITHUB_STEP_SUMMARY}" + exit 0 + fi + exit 1 + fi + + echo "Dismissed Dependabot review request for ${REVIEWER}." >> "${GITHUB_STEP_SUMMARY}" From ca729add3748a9bb068fe7c4fdbd991041203407 Mon Sep 17 00:00:00 2001 From: Pigbibi <20649888+Pigbibi@users.noreply.github.com> Date: Tue, 11 Aug 2026 13:38:53 +0800 Subject: [PATCH 3/3] fix: preserve sensitive path ownership Co-Authored-By: Codex --- .github/CODEOWNERS | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index f5ad75e0..3236453f 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -1,6 +1,11 @@ -# Limit automatic review requests to order and risk-sensitive source changes. +# Limit automatic review requests to order and risk-sensitive changes. +/.github/CODEOWNERS @Pigbibi /src/quant_platform_kit/risk/ @Pigbibi /src/quant_platform_kit/binance/ @Pigbibi /src/quant_platform_kit/ibkr/ @Pigbibi /src/quant_platform_kit/longbridge/ @Pigbibi /src/quant_platform_kit/schwab/ @Pigbibi +/src/quant_platform_kit/common/models.py @Pigbibi +/src/quant_platform_kit/common/port_adapters.py @Pigbibi +/src/quant_platform_kit/common/execution_translation.py @Pigbibi +/src/quant_platform_kit/position_sizing.py @Pigbibi