From e4e0dc31499ac77285b1b7acf929d02f53180299 Mon Sep 17 00:00:00 2001 From: Pigbibi <20649888+Pigbibi@users.noreply.github.com> Date: Sun, 25 Oct 2026 10:14:24 +0800 Subject: [PATCH] Admit reviewed SG and HK stock inventory source for staging Co-Authored-By: Codex --- .github/workflows/sync-cloud-run-env.yml | 22 +- ...erify_deployed_runtime_target_admission.py | 13 +- .../test_deployed_runtime_target_admission.py | 231 ++++++++++++++++++ tests/test_sync_cloud_run_env_workflow.sh | 93 ++++++- 4 files changed, 351 insertions(+), 8 deletions(-) diff --git a/.github/workflows/sync-cloud-run-env.yml b/.github/workflows/sync-cloud-run-env.yml index 6b92743..0a3ff74 100644 --- a/.github/workflows/sync-cloud-run-env.yml +++ b/.github/workflows/sync-cloud-run-env.yml @@ -208,6 +208,7 @@ jobs: approved_probe_financing_candidate=82788aa7c73690d2b87f63540a9102943e9372eb approved_sghk_snapshot_candidate=df3d29d13daeffc7b4af9fec5db0e9ec1f07b60f approved_hk_probe_diagnostics_candidate=779d8e1c39d161144bc34ae8503ce34d87971b16 + approved_sghk_stock_inventory_candidate=b9dbd2f697c84182a8959fcbbd360a5211f502c6 history_count=0 for history_value in \ "${ACCOUNT_HISTORY_RECORDING_ENABLED:-}" \ @@ -295,6 +296,10 @@ jobs: && [ -z "${snapshot_setting}" ] \ && [ "${SOURCE_COMMIT}" = "${approved_hk_probe_diagnostics_candidate}" ]; then image_mode=hk-probe-diagnostics + elif { [ "${WORKFLOW_TARGET}" = "HK" ] || [ "${WORKFLOW_TARGET}" = "SG" ]; } \ + && [ "${history_count}" -eq 0 ] && [ -z "${snapshot_setting}" ] \ + && [ "${SOURCE_COMMIT}" = "${approved_sghk_stock_inventory_candidate}" ]; then + image_mode=stock-inventory else echo "Image source is not approved." >&2 exit 1 @@ -352,6 +357,7 @@ jobs: approved_probe_financing_candidate=82788aa7c73690d2b87f63540a9102943e9372eb approved_sghk_snapshot_candidate=df3d29d13daeffc7b4af9fec5db0e9ec1f07b60f approved_hk_probe_diagnostics_candidate=779d8e1c39d161144bc34ae8503ce34d87971b16 + approved_sghk_stock_inventory_candidate=b9dbd2f697c84182a8959fcbbd360a5211f502c6 case "${WORKFLOW_TARGET}" in HK) expected_sghk_target=hk ;; SG) expected_sghk_target=sg ;; @@ -401,6 +407,10 @@ jobs: && [ -z "${snapshot_setting}" ] \ && [ "${SOURCE_COMMIT}" = "${approved_hk_probe_diagnostics_candidate}" ]; then image_mode=hk-probe-diagnostics + elif { [ "${WORKFLOW_TARGET}" = "HK" ] || [ "${WORKFLOW_TARGET}" = "SG" ]; } \ + && [ "${history_count}" -eq 0 ] && [ -z "${snapshot_setting}" ] \ + && [ "${SOURCE_COMMIT}" = "${approved_sghk_stock_inventory_candidate}" ]; then + image_mode=stock-inventory else echo "Image source is not approved." >&2 exit 1 @@ -423,6 +433,9 @@ jobs: elif [ "${image_mode}" = "hk-probe-diagnostics" ]; then archive_ref="${approved_hk_probe_diagnostics_candidate}" image_tag="${approved_hk_probe_diagnostics_candidate}" + elif [ "${image_mode}" = "stock-inventory" ]; then + archive_ref="${approved_sghk_stock_inventory_candidate}" + image_tag="${approved_sghk_stock_inventory_candidate}" else archive_ref="${approved_candidate}" image_tag="${approved_candidate}" @@ -447,7 +460,8 @@ jobs: fi if [ "${WORKFLOW_TARGET}" = "PAPER" ] || [ "${image_mode}" = "account-history" ] \ || [ "${image_mode}" = "hk-account-snapshot" ] \ - || [ "${image_mode}" = "hk-probe-diagnostics" ]; then + || [ "${image_mode}" = "hk-probe-diagnostics" ] \ + || [ "${image_mode}" = "stock-inventory" ]; then plan="$(mktemp)" uv run --no-sync python "${GITHUB_WORKSPACE}/scripts/verify_deployed_runtime_target_admission.py" \ --project="${GCP_PROJECT_ID}" \ @@ -488,7 +502,8 @@ jobs: fi if [ "${WORKFLOW_TARGET}" = "PAPER" ] || [ "${image_mode}" = "account-history" ] \ || [ "${image_mode}" = "hk-account-snapshot" ] \ - || [ "${image_mode}" = "hk-probe-diagnostics" ]; then + || [ "${image_mode}" = "hk-probe-diagnostics" ] \ + || [ "${image_mode}" = "stock-inventory" ]; then revision_suffix="r${GITHUB_RUN_ID}" revision_name="${CLOUD_RUN_SERVICE}-${revision_suffix}" if [[ ! "${GITHUB_RUN_ID}" =~ ^[0-9]+$ ]] \ @@ -501,7 +516,8 @@ jobs: "${update_command[@]}" if [ "${WORKFLOW_TARGET}" = "PAPER" ] || [ "${image_mode}" = "account-history" ] \ || [ "${image_mode}" = "hk-account-snapshot" ] \ - || [ "${image_mode}" = "hk-probe-diagnostics" ]; then + || [ "${image_mode}" = "hk-probe-diagnostics" ] \ + || [ "${image_mode}" = "stock-inventory" ]; then uv run --no-sync python "${GITHUB_WORKSPACE}/scripts/verify_deployed_runtime_target_admission.py" \ --project="${GCP_PROJECT_ID}" \ --region="${CLOUD_RUN_REGION}" \ diff --git a/scripts/verify_deployed_runtime_target_admission.py b/scripts/verify_deployed_runtime_target_admission.py index 403a4c2..f2b14ca 100644 --- a/scripts/verify_deployed_runtime_target_admission.py +++ b/scripts/verify_deployed_runtime_target_admission.py @@ -43,6 +43,8 @@ class AdmissionError(ValueError): APPROVED_PAPER_PROBE_FINANCING_CANDIDATE = "82788aa7c73690d2b87f63540a9102943e9372eb" # Reviewed read-only SG/HK account-snapshot producer. It is not a PAPER candidate. APPROVED_SGHK_ACCOUNT_SNAPSHOT_CANDIDATE = "df3d29d13daeffc7b4af9fec5db0e9ec1f07b60f" +# Reviewed read-only SG/HK stock-inventory image. It carries no history or snapshot update. +APPROVED_SGHK_STOCK_INVENTORY_CANDIDATE = "b9dbd2f697c84182a8959fcbbd360a5211f502c6" # Fixed 922-based HK candidate carrying only bounded /probe failure diagnostics. APPROVED_HK_PROBE_DIAGNOSTICS_CANDIDATE = "779d8e1c39d161144bc34ae8503ce34d87971b16" # One already-staged PAPER revision that may hold history env while serving still runs an older image. @@ -725,7 +727,7 @@ def prepare_image_only_staging( image_commit: str, run: Callable[[Sequence[str]], str], ) -> dict[str, Any]: - """Admit a fixed PAPER candidate or the signed main image for image-only staging.""" + """Admit a fixed PAPER candidate, a fixed SG/HK candidate, or the signed main image.""" history, snapshot_value = _validate_image_only_source( image_commit=image_commit, env=env, project=project @@ -734,6 +736,7 @@ def prepare_image_only_staging( if image_commit in { APPROVED_SGHK_ACCOUNT_SNAPSHOT_CANDIDATE, APPROVED_HK_PROBE_DIAGNOSTICS_CANDIDATE, + APPROVED_SGHK_STOCK_INVENTORY_CANDIDATE, }: _require_sghk_candidate_identity( target_label=str(env.get("WORKFLOW_TARGET") or ""), @@ -878,6 +881,14 @@ def _validate_image_only_source( or snapshot_value is not None ): raise AdmissionError("image source is not approved") + elif image_commit == APPROVED_SGHK_STOCK_INVENTORY_CANDIDATE: + # Read-only SG/HK inventory image: no PAPER target and no environment update. + if ( + str(env.get("WORKFLOW_TARGET") or "") not in {"HK", "SG"} + or history is not None + or snapshot_value is not None + ): + raise AdmissionError("image source is not approved") elif _is_exact_main_image(image_commit, env): if history is not None: raise AdmissionError("image source is not approved") diff --git a/tests/test_deployed_runtime_target_admission.py b/tests/test_deployed_runtime_target_admission.py index 4024446..eaa4192 100644 --- a/tests/test_deployed_runtime_target_admission.py +++ b/tests/test_deployed_runtime_target_admission.py @@ -88,6 +88,7 @@ def test_verify_service_rejects_target_drift(target, profile, message): PROBE_CANDIDATES = (PROBE_SNAPSHOT_CANDIDATE, PROBE_FINANCING_CANDIDATE) SGHK_SNAPSHOT_CANDIDATE = admission.APPROVED_SGHK_ACCOUNT_SNAPSHOT_CANDIDATE HK_PROBE_DIAGNOSTICS_CANDIDATE = admission.APPROVED_HK_PROBE_DIAGNOSTICS_CANDIDATE +STOCK_INVENTORY_CANDIDATE = admission.APPROVED_SGHK_STOCK_INVENTORY_CANDIDATE SGHK_PREFIX = "gs://qsl-runtime-logs-shared/longbridge/account_snapshots" STAGED_SOURCE_REVISION = "longbridge-quant-paper-service-r36423178119" STAGED_SOURCE_IMAGE = ( @@ -1206,3 +1207,233 @@ def run(command): run=run, ) assert not any(command[:3] == ["gcloud", "run", "services"] and "update" in command for command in calls) + + +def _stock_inventory_service(target_label: str, *, target_overrides=None, extra_env=None): + target = _sghk_target(target_label) + target.update(target_overrides or {}) + env = [ + {"name": "RUNTIME_TARGET_JSON", "value": json.dumps(target)}, + {"name": "STRATEGY_PROFILE", "value": target["strategy_profile"]}, + {"name": "LONGBRIDGE_DRY_RUN_ONLY", "value": "false"}, + {"name": "RUNTIME_TARGET_ENABLED", "value": "true"}, + ] + list(extra_env or []) + service = { + "metadata": {"annotations": {"run.googleapis.com/ingress": "internal"}}, + "spec": { + "template": { + "spec": { + "serviceAccountName": "runtime@example.invalid", + "containers": [{"env": env}], + } + } + }, + "status": {"traffic": [{"revisionName": "serving-rev", "percent": 100}]}, + } + return service, env + + +def _prepare_stock_inventory( + target_label: str = "HK", + *, + target_overrides=None, + env_overrides=None, + project: str = "longbridgequant", + region: str | None = None, + serving_extra_env=None, + serving_pin: str = UES, + calls: list | None = None, +): + service, env = _stock_inventory_service(target_label, target_overrides=target_overrides) + target = json.loads(env[0]["value"]) + if region is None: + region = {"HK": "asia-east2", "SG": "asia-southeast1"}[target_label] + candidate_env = { + "WORKFLOW_TARGET": target_label, + "SOURCE_COMMIT": STOCK_INVENTORY_CANDIDATE, + } + candidate_env.update(env_overrides or {}) + + def run(command): + if calls is not None: + calls.append(list(command)) + if command[:3] == ["gcloud", "run", "revisions"]: + return json.dumps({ + "metadata": {"name": "serving-rev", "labels": {"commit-sha": SERVING}}, + "spec": { + "serviceAccountName": "runtime@example.invalid", + "containers": [ + {"env": env + list(serving_extra_env or []), "image": "serving-image"} + ], + }, + "status": {"conditions": [{"type": "Ready", "status": "True"}]}, + }) + pin = serving_pin if command[2].startswith(SERVING + ":") else UES + return _declaration(command[2].split(":", 1)[1], pin) + + return admission.prepare_image_only_staging( + service=target["service_name"], + project=project, + region=region, + service_json=service, + env=candidate_env, + image_commit=STOCK_INVENTORY_CANDIDATE, + run=run, + ) + + +@pytest.mark.parametrize("target_label", ["HK", "SG"]) +def test_stock_inventory_candidate_admits_exact_sghk_identity_without_updates(target_label): + calls = [] + plan = _prepare_stock_inventory(target_label, calls=calls) + + assert plan["image_commit"] == STOCK_INVENTORY_CANDIDATE + assert plan["history_arg"] == "" + assert plan["snapshot_arg"] == "" + assert plan["history_values"] == {} + assert plan["retained_history_values"] == {} + assert plan["snapshot_value"] is None + assert plan["serving_traffic"] == [{"revisionName": "serving-rev", "percent": 100}] + assert admission._validate_image_only_source( + image_commit=STOCK_INVENTORY_CANDIDATE, + env={"WORKFLOW_TARGET": target_label}, + project="longbridgequant", + ) == (None, None) + assert not any( + command[:3] == ["gcloud", "run", "services"] and "update" in command for command in calls + ) + + +@pytest.mark.parametrize( + "env", + [ + {"WORKFLOW_TARGET": "PAPER"}, + {"WORKFLOW_TARGET": "configured"}, + _sghk_history("HK"), + _sghk_history("SG"), + {"WORKFLOW_TARGET": "HK", "ACCOUNT_SNAPSHOT_ENABLED_INPUT": "true"}, + {"WORKFLOW_TARGET": "HK", "ACCOUNT_SNAPSHOT_ENABLED_INPUT": "false"}, + {"WORKFLOW_TARGET": "SG", "ACCOUNT_SNAPSHOT_ENABLED_INPUT": "true"}, + ], +) +def test_stock_inventory_source_rejects_paper_history_or_snapshot(env): + with pytest.raises(admission.AdmissionError): + admission._validate_image_only_source( + image_commit=STOCK_INVENTORY_CANDIDATE, + env=env, + project="longbridgequant", + ) + + +def test_stock_inventory_candidate_does_not_admit_arbitrary_sha(): + with pytest.raises(admission.AdmissionError, match="not approved"): + admission._validate_image_only_source( + image_commit="b" * 40, + env={"WORKFLOW_TARGET": "HK"}, + project="longbridgequant", + ) + + +@pytest.mark.parametrize( + ("target_label", "env_overrides", "commit"), + [ + ("PAPER", {}, STOCK_INVENTORY_CANDIDATE), + ("HK", _sghk_history("HK"), STOCK_INVENTORY_CANDIDATE), + ("HK", {"ACCOUNT_SNAPSHOT_ENABLED_INPUT": "true"}, STOCK_INVENTORY_CANDIDATE), + ("HK", {}, "b" * 40), + ], +) +def test_stock_inventory_rejects_unapproved_dispatch_before_cloud_reads( + target_label, env_overrides, commit +): + calls = [] + env = {"WORKFLOW_TARGET": target_label, "SOURCE_COMMIT": commit, **env_overrides} + with pytest.raises(admission.AdmissionError): + admission.prepare_image_only_staging( + service="longbridge-quant-hk-service", + project="longbridgequant", + region="asia-east2", + service_json={}, + env=env, + image_commit=commit, + run=lambda command: calls.append(command) or "", + ) + assert calls == [] + + +@pytest.mark.parametrize( + ("target_label", "target_overrides", "project", "region"), + [ + ("HK", {"account_scope": "SG"}, "longbridgequant", "asia-east2"), + ("HK", {"account_selector": "hk"}, "longbridgequant", "asia-east2"), + ("SG", {"deployment_selector": "sg"}, "longbridgequant", "asia-southeast1"), + ("SG", None, "other-project", "asia-southeast1"), + ("HK", None, "longbridgequant", "asia-east1"), + ], +) +def test_stock_inventory_candidate_rejects_identity_mismatch( + target_label, target_overrides, project, region +): + with pytest.raises(admission.AdmissionError, match="approved account"): + _prepare_stock_inventory( + target_label, + target_overrides=target_overrides, + project=project, + region=region, + ) + + +def test_stock_inventory_candidate_rejects_template_drift(): + with pytest.raises(admission.AdmissionError, match="template does not match"): + _prepare_stock_inventory( + "HK", serving_extra_env=[{"name": "UNEXPECTED", "value": "1"}] + ) + + +def test_stock_inventory_candidate_rejects_serving_ues_mismatch(): + calls = [] + with pytest.raises(admission.AdmissionError, match="differs from serving"): + _prepare_stock_inventory("SG", serving_pin=OTHER_UES, calls=calls) + assert not any( + command[:3] == ["gcloud", "run", "services"] and "update" in command for command in calls + ) + + +def test_stock_inventory_readback_requires_unchanged_configuration(): + service, env = _stock_inventory_service("HK") + plan = _prepare_stock_inventory("HK") + image = "repo@sha256:" + "b" * 64 + revision = { + "metadata": { + "name": "longbridge-quant-hk-service-r123", + "labels": {"commit-sha": STOCK_INVENTORY_CANDIDATE}, + }, + "spec": { + "serviceAccountName": "runtime@example.invalid", + "containers": [{"env": env, "image": image}], + }, + "status": {"conditions": [{"type": "Ready", "status": "True"}]}, + } + + def confirm(service_payload, revision_payload): + def run(command): + if command[:3] == ["gcloud", "run", "services"]: + return json.dumps(service_payload) + return json.dumps(revision_payload) + + admission.confirm_image_only_readback( + service="longbridge-quant-hk-service", + project="longbridgequant", + region="asia-east2", + plan=plan, + expected_image=image, + expected_commit=STOCK_INVENTORY_CANDIDATE, + expected_revision="longbridge-quant-hk-service-r123", + run=run, + ) + + confirm(service, revision) + drifted = json.loads(json.dumps(revision)) + drifted["spec"]["containers"][0]["env"].append({"name": "UNEXPECTED", "value": "1"}) + with pytest.raises(admission.AdmissionError, match="configuration"): + confirm(service, drifted) diff --git a/tests/test_sync_cloud_run_env_workflow.sh b/tests/test_sync_cloud_run_env_workflow.sh index f2fda24..5364aa9 100644 --- a/tests/test_sync_cloud_run_env_workflow.sh +++ b/tests/test_sync_cloud_run_env_workflow.sh @@ -451,6 +451,7 @@ assert "318bf0419ec91002fd0f0dfd1bc80a0664a85e79" in job assert "82788aa7c73690d2b87f63540a9102943e9372eb" in job assert "df3d29d13daeffc7b4af9fec5db0e9ec1f07b60f" in job assert "779d8e1c39d161144bc34ae8503ce34d87971b16" in job +assert "b9dbd2f697c84182a8959fcbbd360a5211f502c6" in job assert "approved_probe_financing_candidate=82788aa7c73690d2b87f63540a9102943e9372eb" in job assert 'image_mode=probe-financing' in job assert '[ "${GITHUB_REPOSITORY:-}" != "QuantStrategyLab/LongBridgePlatform" ]' in job @@ -488,6 +489,7 @@ probe_financing_candidate = "82788aa7c73690d2b87f63540a9102943e9372eb" probe_candidates = (probe_snapshot_candidate, probe_financing_candidate) sghk_snapshot_candidate = "df3d29d13daeffc7b4af9fec5db0e9ec1f07b60f" hk_probe_diagnostics_candidate = "779d8e1c39d161144bc34ae8503ce34d87971b16" +sghk_stock_inventory_candidate = "b9dbd2f697c84182a8959fcbbd360a5211f502c6" staged_source_revision = "longbridge-quant-paper-service-r36423178119" staged_source_image = ( "asia-east1-docker.pkg.dev/synthetic-project/images/longbridgeplatform/synthetic-paper" @@ -649,11 +651,11 @@ def staged_revision(): if command == "git" and args == ["rev-parse", "HEAD"]: print(os.environ["CHECKOUT_SHA"]) -elif command == "git" and args[:4] == ["fetch", "--depth", "1", "origin"] and args[4] in (approved, http_snapshot_candidate, probe_snapshot_candidate, probe_financing_candidate, sghk_snapshot_candidate, hk_probe_diagnostics_candidate): +elif command == "git" and args[:4] == ["fetch", "--depth", "1", "origin"] and args[4] in (approved, http_snapshot_candidate, probe_snapshot_candidate, probe_financing_candidate, sghk_snapshot_candidate, hk_probe_diagnostics_candidate, sghk_stock_inventory_candidate): pass -elif command == "git" and args[:2] == ["cat-file", "-t"] and args[2] in (approved, http_snapshot_candidate, probe_snapshot_candidate, probe_financing_candidate, sghk_snapshot_candidate, hk_probe_diagnostics_candidate): +elif command == "git" and args[:2] == ["cat-file", "-t"] and args[2] in (approved, http_snapshot_candidate, probe_snapshot_candidate, probe_financing_candidate, sghk_snapshot_candidate, hk_probe_diagnostics_candidate, sghk_stock_inventory_candidate): print("commit") -elif command == "git" and args[:1] == ["rev-parse"] and len(args) == 2 and args[1] in (approved + "^{commit}", http_snapshot_candidate + "^{commit}", probe_snapshot_candidate + "^{commit}", probe_financing_candidate + "^{commit}", sghk_snapshot_candidate + "^{commit}", hk_probe_diagnostics_candidate + "^{commit}"): +elif command == "git" and args[:1] == ["rev-parse"] and len(args) == 2 and args[1] in (approved + "^{commit}", http_snapshot_candidate + "^{commit}", probe_snapshot_candidate + "^{commit}", probe_financing_candidate + "^{commit}", sghk_snapshot_candidate + "^{commit}", hk_probe_diagnostics_candidate + "^{commit}", sghk_stock_inventory_candidate + "^{commit}"): print(args[1].split("^", 1)[0]) elif command == "git" and args == ["archive", "HEAD"]: print("synthetic tracked source archive") @@ -669,11 +671,13 @@ elif command == "git" and args == ["archive", sghk_snapshot_candidate]: print("synthetic SG/HK account snapshot candidate archive") elif command == "git" and args == ["archive", hk_probe_diagnostics_candidate]: print("synthetic HK probe diagnostics candidate archive") +elif command == "git" and args == ["archive", sghk_stock_inventory_candidate]: + print("synthetic SG/HK stock inventory candidate archive") elif command == "git" and args[:1] == ["show"] and len(args) == 2 and ":" in args[1]: sha, name = args[1].split(":", 1) if name not in ("uv.lock", "pyproject.toml", "qsl.toml"): raise SystemExit("unexpected git show") - if sha not in ("a" * 40, serving_sha, approved, http_snapshot_candidate, probe_snapshot_candidate, probe_financing_candidate, sghk_snapshot_candidate, hk_probe_diagnostics_candidate): + if sha not in ("a" * 40, serving_sha, approved, http_snapshot_candidate, probe_snapshot_candidate, probe_financing_candidate, sghk_snapshot_candidate, hk_probe_diagnostics_candidate, sghk_stock_inventory_candidate): raise SystemExit("admission read an unapproved source lock") pin = ("f" * 40) if sha == serving_sha and os.environ.get("BAD_SERVING_LOCK") == "1" else ues print(declaration(name, pin), end="") @@ -770,6 +774,7 @@ else: probe_candidates = (probe_snapshot_candidate, probe_financing_candidate) sghk_snapshot_candidate = "df3d29d13daeffc7b4af9fec5db0e9ec1f07b60f" hk_probe_diagnostics_candidate = "779d8e1c39d161144bc34ae8503ce34d87971b16" + sghk_stock_inventory_candidate = "b9dbd2f697c84182a8959fcbbd360a5211f502c6" staged_source_revision = "longbridge-quant-paper-service-r36423178119" staged_source_image = ( "asia-east1-docker.pkg.dev/synthetic-project/images/longbridgeplatform/" @@ -1144,6 +1149,86 @@ else: assert code != 0, overrides assert sum(call[:4] == ["gcloud", "run", "services", "update"] for call in calls) == 1 cases += 1 + for label, region in (("HK", "asia-east2"), ("SG", "asia-southeast1")): + service = f"longbridge-quant-{label.lower()}-service" + code, calls = execute( + SOURCE_COMMIT=sghk_stock_inventory_candidate, + CHECKOUT_SHA="a" * 40, + WORKFLOW_TARGET=label, + CLOUD_RUN_SERVICE=service, + CLOUD_RUN_REGION=region, + GCP_PROJECT_ID="longbridgequant", + ) + assert code == 0, (label, code, calls) + updates = [call for call in calls if call[:4] == ["gcloud", "run", "services", "update"]] + image_repo = f"registry.invalid/longbridgequant/synthetic-images/longbridgeplatform/{service}" + assert len(updates) == 1 + assert "--no-traffic" in updates[0] + assert "--update-env-vars=" not in " ".join(updates[0]) + assert updates[0][-1] == "--revision-suffix=r123" + assert f"--update-labels=commit-sha={sghk_stock_inventory_candidate},github-run-id=123" in updates[0] + assert f"--image={image_repo}@{base['IMAGE_DIGEST']}" in updates[0] + assert ["git", "fetch", "--depth", "1", "origin", sghk_stock_inventory_candidate] in calls + assert ["git", "archive", sghk_stock_inventory_candidate] in calls + assert ["git", "archive", "HEAD"] not in calls + assert any( + call[:2] == ["git", "show"] and call[2].startswith(sghk_stock_inventory_candidate + ":") + for call in calls + ) + assert any(call[:3] == ["uv", "run", "--no-sync"] for call in calls) + assert any( + call[:4] == ["gcloud", "run", "revisions", "describe"] and call[4] == f"{service}-r123" + for call in calls + ) + assert not any(call[:4] == ["gcloud", "run", "services", "update-traffic"] for call in calls) + assert not any("scheduler" in " ".join(call) for call in calls) + cases += 1 + for overrides in ( + {"SOURCE_COMMIT": sghk_stock_inventory_candidate, "WORKFLOW_TARGET": "PAPER"}, + { + "SOURCE_COMMIT": sghk_stock_inventory_candidate, + "WORKFLOW_TARGET": "HK", + "CLOUD_RUN_SERVICE": "longbridge-quant-hk-service", + "CLOUD_RUN_REGION": "asia-east2", + "GCP_PROJECT_ID": "longbridgequant", + **{**sghk_history, "ACCOUNT_HISTORY_TARGET_ID": "hk", "ACCOUNT_HISTORY_EXPECTED_SCOPE": "HK"}, + }, + { + "SOURCE_COMMIT": sghk_stock_inventory_candidate, + "WORKFLOW_TARGET": "HK", + "CLOUD_RUN_SERVICE": "longbridge-quant-hk-service", + "CLOUD_RUN_REGION": "asia-east2", + "GCP_PROJECT_ID": "longbridgequant", + "ACCOUNT_SNAPSHOT_ENABLED_INPUT": "true", + }, + {"SOURCE_COMMIT": "c" * 40, "WORKFLOW_TARGET": "HK"}, + ): + code, calls = execute(**overrides) + assert code != 0 and calls == [], overrides + cases += 1 + for overrides in ( + { + "SOURCE_COMMIT": sghk_stock_inventory_candidate, + "WORKFLOW_TARGET": "HK", + "CLOUD_RUN_SERVICE": "longbridge-quant-hk-service", + "CLOUD_RUN_REGION": "asia-east2", + "GCP_PROJECT_ID": "longbridgequant", + "TARGET_ACCOUNT_SCOPE": "SG", + }, + { + "SOURCE_COMMIT": sghk_stock_inventory_candidate, + "WORKFLOW_TARGET": "HK", + "CLOUD_RUN_SERVICE": "longbridge-quant-hk-service", + "CLOUD_RUN_REGION": "asia-east2", + "GCP_PROJECT_ID": "longbridgequant", + "BAD_SERVING_LOCK": "1", + }, + ): + code, calls = execute(**overrides) + assert code != 0, overrides + assert not any(call[:2] == ["docker", "build"] for call in calls) + assert not any(call[:4] == ["gcloud", "run", "services", "update"] for call in calls) + cases += 1 print(f"image-only no-traffic shell cases: {cases} passed") PY