pineforge-data 0.3.0__tar.gz → 0.3.1__tar.gz

pineforge_data-0.3.1/.github/workflows/ci.yml

@@ -0,0 +1,206 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+  actions: read
+
+jobs:
+  test:
+    name: Python ${{ matrix.python-version }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v6
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+      - run: python -m pip install --upgrade pip
+      - run: python -m pip install -e '.[dev,ccxt,release]'
+      - run: ruff check .
+      - run: mypy src
+      - run: pytest
+      - if: matrix.python-version == '3.13'
+        run: python -m build
+      - if: matrix.python-version == '3.13'
+        name: The sdist does not ship the native feed
+        run: |
+          if tar -tzf dist/*.tar.gz | grep -E '^[^/]+/native/'; then
+            echo "native/ must stay out of the Python sdist" >&2
+            exit 1
+          fi
+      - if: matrix.python-version == '3.13'
+        run: python -m twine check --strict dist/*
+
+  docker:
+    name: Docker runtime
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.13"
+          cache: pip
+      - run: python -m pip install -e '.[dev]'
+      - run: PINEFORGE_DOCKER_TEST=1 pytest tests/test_docker_integration.py --junitxml=docker.xml
+      - name: Require every real runtime test with zero skips
+        env:
+          PYTHONPATH: scripts
+        run: python -m release_chain.evidence junit --suite docker --path docker.xml
+
+  database-e2e:
+    name: Database E2E
+    runs-on: ubuntu-latest
+    services:
+      mysql:
+        image: mysql:8.4
+        env:
+          MYSQL_DATABASE: pineforge
+          MYSQL_USER: pineforge
+          MYSQL_PASSWORD: pineforge
+          MYSQL_ROOT_PASSWORD: pineforge-root
+        ports:
+          - 3306:3306
+        options: >-
+          --health-cmd="mysqladmin ping --host=127.0.0.1 --user=pineforge --password=pineforge --silent"
+          --health-interval=2s
+          --health-timeout=5s
+          --health-retries=30
+          --health-start-period=15s
+      postgres:
+        image: postgres:17
+        env:
+          POSTGRES_DB: pineforge
+          POSTGRES_USER: pineforge
+          POSTGRES_PASSWORD: pineforge
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd="pg_isready --username=pineforge --dbname=pineforge"
+          --health-interval=2s
+          --health-timeout=5s
+          --health-retries=30
+          --health-start-period=10s
+    env:
+      PINEFORGE_DATABASE_E2E: "1"
+      PINEFORGE_CORPUS_OHLCV: tests/fixtures/corpus_ohlcv_ETH-USDT-USDT_1m_sample.csv
+      PINEFORGE_MYSQL_URL: mysql+pymysql://pineforge:pineforge@127.0.0.1:3306/pineforge
+      PINEFORGE_POSTGRES_URL: postgresql+psycopg://pineforge:pineforge@127.0.0.1:5432/pineforge
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.13"
+          cache: pip
+      - run: python -m pip install --upgrade pip
+      - run: python -m pip install -e '.[dev,database-e2e]'
+      - run: pytest tests/test_database_e2e.py --junitxml=database.xml
+      - name: Require the disposable database E2E inventory with zero skips
+        env:
+          PYTHONPATH: scripts
+        run: python -m release_chain.evidence junit --suite database --path database.xml
+
+  contract:
+    name: Release contract
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v6
+        with:
+          python-version: '3.13'
+      - name: Verify synchronized defaults, immutable manifest, source, facts and both OCI children
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: python scripts/release_adapter.py local
+
+  distribution:
+    name: Distribution
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v6
+        with:
+          python-version: '3.13'
+          cache: pip
+      - run: python -m pip install -e '.[release]'
+      - name: Set reproducible archive timestamps
+        run: echo "SOURCE_DATE_EPOCH=$(git show -s --format=%ct HEAD)" >> "$GITHUB_ENV"
+      - run: python -m build
+      - run: python -m twine check --strict dist/*
+      - name: The canonical sdist does not ship the native feed
+        run: |
+          if tar -tzf dist/*.tar.gz | grep -E '^[^/]+/native/'; then
+            echo "native/ must stay out of the Python sdist" >&2
+            exit 1
+          fi
+      - name: Install and backtest both built distributions without importing checkout source
+        env:
+          PYTHONPATH: scripts
+        run: |
+          set -euo pipefail
+          version="$(python scripts/bump_version.py current)"
+          image="$(python -c 'from pathlib import Path; from release_chain.contract import runtime_pin; print(runtime_pin(Path.cwd()))')"
+          for artifact in "$GITHUB_WORKSPACE"/dist/*; do
+            case "$artifact" in
+              *.whl) kind=wheel ;;
+              *.tar.gz) kind=sdist ;;
+              *) exit 1 ;;
+            esac
+            environment="$RUNNER_TEMP/distribution-$kind"
+            python -m venv "$environment"
+            "$environment/bin/python" -m pip install "$artifact"
+            "$environment/bin/python" -I scripts/exercise_distribution.py \
+              --version "$version" --image "$image" --source "$GITHUB_WORKSPACE/src" \
+              --fixtures "$GITHUB_WORKSPACE/tests/fixtures" \
+              --output "$RUNNER_TEMP/exercise-$kind.json"
+          done
+      - uses: actions/upload-artifact@v5
+        with:
+          name: distribution-runtime-evidence-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/exercise-*.json
+          if-no-files-found: error
+      - uses: actions/upload-artifact@v5
+        with:
+          name: python-package-distributions-${{ github.run_attempt }}
+          path: dist/
+          if-no-files-found: error
+
+  ready:
+    name: release/ready
+    if: always()
+    needs: [test, contract, docker, database-e2e, distribution]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v6
+        with:
+          python-version: '3.13'
+      - uses: actions/download-artifact@v6
+        with:
+          name: python-package-distributions-${{ github.run_attempt }}
+          path: dist/
+      - name: Require the complete job inventory and bind evidence to this head/base/tree
+        env:
+          PYTHONPATH: scripts
+          NEEDS_JSON: ${{ toJSON(needs) }}
+          GH_TOKEN: ${{ github.token }}
+        run: python -m release_chain.evidence aggregate --path dist
+      - uses: actions/upload-artifact@v5
+        with:
+          name: release-evidence-${{ github.run_attempt }}
+          path: evidence.json
+          if-no-files-found: error

pineforge_data-0.3.1/.github/workflows/native-feed.yml

@@ -0,0 +1,80 @@
+# SPDX-License-Identifier: Apache-2.0
+name: Native feed
+on:
+  push:
+    paths: ['native/feed/**', '.github/workflows/native-feed.yml']
+  pull_request:
+    paths: ['native/feed/**', '.github/workflows/native-feed.yml']
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  release:
+    name: Release (${{ matrix.os }})
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-24.04, ubuntu-24.04-arm, macos-14]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v7
+      - name: Linux prerequisites
+        if: runner.os == 'Linux'
+        run: sudo apt-get update && sudo apt-get install -y cmake ninja-build libssl-dev
+      - name: macOS prerequisites
+        if: runner.os == 'macOS'
+        run: |
+          brew install ninja openssl@3
+          echo "OPENSSL_ROOT_DIR=$(brew --prefix openssl@3)" >> "$GITHUB_ENV"
+      - name: Pinned WebSocket curl
+        run: bash native/feed/tests/build_ci_curl.sh "$RUNNER_TEMP/curl"
+      - name: Configure, build and test
+        run: |
+          export LD_LIBRARY_PATH="$RUNNER_TEMP/curl/lib:${LD_LIBRARY_PATH:-}"
+          export DYLD_LIBRARY_PATH="$RUNNER_TEMP/curl/lib:${DYLD_LIBRARY_PATH:-}"
+          cmake -S native/feed -B build-feed -G Ninja -DCMAKE_BUILD_TYPE=Release \
+            -DCURL_DIR="$RUNNER_TEMP/curl/lib/cmake/CURL"
+          cmake --build build-feed -j4
+          ctest --test-dir build-feed --output-on-failure
+
+  asan-ubsan:
+    name: ASan + UBSan
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v7
+      - run: sudo apt-get update && sudo apt-get install -y ninja-build libssl-dev clang-18
+      - run: bash native/feed/tests/build_ci_curl.sh "$RUNNER_TEMP/curl"
+      - name: Instrumented core and mock venue
+        env:
+          ASAN_OPTIONS: detect_leaks=1:abort_on_error=1
+          UBSAN_OPTIONS: halt_on_error=1:print_stacktrace=1
+        run: |
+          export LD_LIBRARY_PATH="$RUNNER_TEMP/curl/lib:${LD_LIBRARY_PATH:-}"
+          cmake -S native/feed -B build-feed -G Ninja -DCMAKE_BUILD_TYPE=RelWithDebInfo \
+            -DCMAKE_CXX_COMPILER=clang++-18 -DCMAKE_C_COMPILER=clang-18 -DCURL_DIR="$RUNNER_TEMP/curl/lib/cmake/CURL" \
+            -DPINEFORGE_FEED_SANITIZER=address,undefined
+          cmake --build build-feed -j4
+          ctest --test-dir build-feed --output-on-failure
+
+  tsan:
+    name: TSan
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v7
+      - run: sudo apt-get update && sudo apt-get install -y ninja-build libssl-dev clang-18
+      - run: bash native/feed/tests/build_ci_curl.sh "$RUNNER_TEMP/curl"
+      - name: Threaded receive, healing, termination and serve fan-out
+        env:
+          TSAN_OPTIONS: halt_on_error=1
+        run: |
+          export LD_LIBRARY_PATH="$RUNNER_TEMP/curl/lib:${LD_LIBRARY_PATH:-}"
+          cmake -S native/feed -B build-feed -G Ninja -DCMAKE_BUILD_TYPE=RelWithDebInfo \
+            -DCMAKE_CXX_COMPILER=clang++-18 -DCMAKE_C_COMPILER=clang-18 -DCURL_DIR="$RUNNER_TEMP/curl/lib/cmake/CURL" \
+            -DPINEFORGE_FEED_SANITIZER=thread
+          cmake --build build-feed -j4
+          ctest --test-dir build-feed --output-on-failure

pineforge_data-0.3.1/.github/workflows/pineforge-release.yml

@@ -0,0 +1,86 @@
+name: PineForge release adapter
+
+on:
+  repository_dispatch:
+    types: [pineforge-release]
+  workflow_run:
+    workflows: [CI, Release]
+    types: [completed]
+  # schedule (9,24,39,54 * * * *) removed 2026-10-18: every run failed and Actions cost is capped (owner); dispatch and the triggers above remain.
+  workflow_dispatch:
+    inputs:
+      publication_run:
+        description: Completed Release run to verify (automated repair uses the immutable package tag)
+        required: false
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: data-release-adapter
+  cancel-in-progress: false
+
+jobs:
+  reconcile:
+    # Automatic triggers (schedule, workflow_run) run only once the chain is
+    # configured (RELEASE_APP_ID set); a hub dispatch or a manual run without it
+    # still fails loudly.
+    if: >-
+      (vars.RELEASE_APP_ID != '' || (github.event_name != 'schedule' && github.event_name != 'workflow_run')) &&
+      (github.event_name != 'workflow_run' ||
+      (github.event.workflow_run.name == 'CI' && github.event.workflow_run.event == 'pull_request') ||
+      github.event.workflow_run.name == 'Release')
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/create-github-app-token@v2
+        id: app
+        with:
+          app-id: ${{ vars.RELEASE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: ${{ github.event.repository.name }}
+          permission-contents: write
+          permission-pull-requests: write
+          permission-actions: write
+      - uses: actions/checkout@v7
+        with:
+          ref: main
+          fetch-depth: 0
+          token: ${{ steps.app.outputs.token }}
+      - uses: actions/setup-python@v6
+        with:
+          python-version: '3.13'
+      - name: Verify ready event, reconcile update PR and respect release gates
+        if: github.event.workflow_run.name != 'Release' && inputs.publication_run == ''
+        env:
+          GH_TOKEN: ${{ steps.app.outputs.token }}
+          RELEASE_BOT_LOGIN: ${{ steps.app.outputs.app-slug }}[bot]
+        run: python scripts/release_adapter.py reconcile --receipt "$RUNNER_TEMP/release-receipt.json"
+      - name: Verify the completed publication from trusted coordinator code
+        if: github.event.workflow_run.name == 'Release' || inputs.publication_run != ''
+        env:
+          PYTHONPATH: scripts
+          GH_TOKEN: ${{ steps.app.outputs.token }}
+          PUBLICATION_RUN: ${{ inputs.publication_run || github.event.workflow_run.id }}
+        run: python -m release_chain.reporting publication --run "$PUBLICATION_RUN" --receipt "$RUNNER_TEMP/release-receipt.json"
+      - uses: actions/upload-artifact@v5
+        if: always()
+        with:
+          name: release-stage-${{ github.run_attempt }}-10-adapter
+          path: ${{ runner.temp }}/release-receipt.json
+          if-no-files-found: warn
+
+  report:
+    if: always() && needs.reconcile.result != 'skipped'
+    needs: reconcile
+    uses: ./.github/workflows/release-report.yml
+    permissions:
+      contents: read
+      actions: read
+      issues: write
+    with:
+      hub: true
+      failed: ${{ needs.reconcile.result != 'success' }}
+      stage: reconcile
+    secrets: inherit

pineforge_data-0.3.1/.github/workflows/release-report.yml

@@ -0,0 +1,96 @@
+name: Release receipt and incident
+
+on:
+  workflow_call:
+    inputs:
+      failed:
+        type: boolean
+        required: true
+      stage:
+        type: string
+        required: true
+      hub:
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+  actions: read
+  issues: write
+
+jobs:
+  report:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: main
+          persist-credentials: false
+      - uses: actions/setup-python@v6
+        with:
+          python-version: '3.13'
+      - uses: actions/download-artifact@v6
+        with:
+          pattern: release-stage-${{ github.run_attempt }}-*
+          path: receipts
+      - name: Preserve contract evidence and alert the configured owner
+        id: receipt
+        env:
+          PYTHONPATH: scripts
+          GH_TOKEN: ${{ github.token }}
+          FAILED: ${{ inputs.failed }}
+          STAGE: ${{ inputs.stage }}
+          RELEASE_ALERT_OWNER: ${{ vars.RELEASE_ALERT_OWNER }}
+        run: python -m release_chain.reporting collect
+      - name: Upload the single hub receipt snapshot
+        id: upload
+        if: inputs.hub && steps.receipt.outputs.has_event == 'true'
+        uses: actions/upload-artifact@v5
+        with:
+          name: release-receipt-data
+          path: release-receipt.json
+          if-no-files-found: error
+          overwrite: true
+          retention-days: 90
+      - name: Mint a consumer-only token for the immutable completion asset
+        if: inputs.hub && steps.upload.outcome == 'success'
+        uses: actions/create-github-app-token@v2
+        id: consumer
+        with:
+          app-id: ${{ vars.RELEASE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: ${{ github.event.repository.name }}
+          permission-contents: write
+          permission-pull-requests: read
+      - name: Retain this same verified contract as an immutable distribution asset
+        if: inputs.hub && steps.upload.outcome == 'success'
+        env:
+          PYTHONPATH: scripts
+          GH_TOKEN: ${{ steps.consumer.outputs.token }}
+        run: python -m release_chain.reporting retain
+      - name: Mint a separate token scoped only to the hub
+        if: inputs.hub && steps.upload.outcome == 'success'
+        uses: actions/create-github-app-token@v2
+        id: hub
+        with:
+          app-id: ${{ vars.RELEASE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+          owner: pineforge-4pass
+          repositories: pineforge-release
+          permission-contents: write
+      - name: Wake the hub collector with the exact consumer-signal/v1 callback
+        if: inputs.hub && steps.upload.outcome == 'success'
+        env:
+          PYTHONPATH: scripts
+          GH_TOKEN: ${{ steps.hub.outputs.token }}
+        run: python -m release_chain.reporting callback
+      - name: Alert locally if receipt delivery or reporting failed
+        if: failure()
+        env:
+          PYTHONPATH: scripts
+          GH_TOKEN: ${{ github.token }}
+          FAILED: 'true'
+          STAGE: receipt-transport
+          RELEASE_ALERT_OWNER: ${{ vars.RELEASE_ALERT_OWNER }}
+        run: python -m release_chain.reporting collect --receipt incident-release-receipt.json