From d37d8a6a8b14e83bd78264b90e7f384b5207e3ce Mon Sep 17 00:00:00 2001 From: Pigbibi <20649888+Pigbibi@users.noreply.github.com> Date: Sun, 25 Oct 2026 12:09:15 +0800 Subject: [PATCH] Admit the reviewed PAPER inventory image through the existing release path Co-Authored-By: Codex --- .github/workflows/sync-cloud-run-env.yml | 13 ++- ...erify_deployed_runtime_target_admission.py | 3 + .../test_deployed_runtime_target_admission.py | 82 ++++++++++++++++++- tests/test_sync_cloud_run_env_workflow.sh | 30 +++++-- 4 files changed, 118 insertions(+), 10 deletions(-) diff --git a/.github/workflows/sync-cloud-run-env.yml b/.github/workflows/sync-cloud-run-env.yml index 0a3ff74..b74caa9 100644 --- a/.github/workflows/sync-cloud-run-env.yml +++ b/.github/workflows/sync-cloud-run-env.yml @@ -206,6 +206,7 @@ jobs: approved_http_snapshot_candidate=d8314a61df697cae1dd03a78ddc5c2fc4179ec67 approved_probe_snapshot_candidate=318bf0419ec91002fd0f0dfd1bc80a0664a85e79 approved_probe_financing_candidate=82788aa7c73690d2b87f63540a9102943e9372eb + approved_paper_stock_inventory_candidate=a5d8e9a13b60be58de3c3afd8c4c78245a67d898 approved_sghk_snapshot_candidate=df3d29d13daeffc7b4af9fec5db0e9ec1f07b60f approved_hk_probe_diagnostics_candidate=779d8e1c39d161144bc34ae8503ce34d87971b16 approved_sghk_stock_inventory_candidate=b9dbd2f697c84182a8959fcbbd360a5211f502c6 @@ -282,7 +283,8 @@ jobs: image_mode=probe elif [ "${WORKFLOW_TARGET}" = "PAPER" ] && [ "${history_count}" -eq 0 ] \ && [ -z "${snapshot_setting}" ] \ - && [ "${SOURCE_COMMIT}" = "${approved_probe_financing_candidate}" ]; then + && { [ "${SOURCE_COMMIT}" = "${approved_probe_financing_candidate}" ] \ + || [ "${SOURCE_COMMIT}" = "${approved_paper_stock_inventory_candidate}" ]; }; then image_mode=probe-financing elif { [ "${WORKFLOW_TARGET}" = "HK" ] || [ "${WORKFLOW_TARGET}" = "SG" ]; } \ && [ "${history_count}" -eq 4 ] && [ -z "${snapshot_setting}" ] \ @@ -355,6 +357,7 @@ jobs: approved_http_snapshot_candidate=d8314a61df697cae1dd03a78ddc5c2fc4179ec67 approved_probe_snapshot_candidate=318bf0419ec91002fd0f0dfd1bc80a0664a85e79 approved_probe_financing_candidate=82788aa7c73690d2b87f63540a9102943e9372eb + approved_paper_stock_inventory_candidate=a5d8e9a13b60be58de3c3afd8c4c78245a67d898 approved_sghk_snapshot_candidate=df3d29d13daeffc7b4af9fec5db0e9ec1f07b60f approved_hk_probe_diagnostics_candidate=779d8e1c39d161144bc34ae8503ce34d87971b16 approved_sghk_stock_inventory_candidate=b9dbd2f697c84182a8959fcbbd360a5211f502c6 @@ -389,7 +392,8 @@ jobs: image_mode=probe elif [ "${WORKFLOW_TARGET}" = "PAPER" ] && [ "${history_count}" -eq 0 ] \ && [ -z "${snapshot_setting}" ] \ - && [ "${SOURCE_COMMIT}" = "${approved_probe_financing_candidate}" ]; then + && { [ "${SOURCE_COMMIT}" = "${approved_probe_financing_candidate}" ] \ + || [ "${SOURCE_COMMIT}" = "${approved_paper_stock_inventory_candidate}" ]; }; then image_mode=probe-financing elif { [ "${WORKFLOW_TARGET}" = "HK" ] || [ "${WORKFLOW_TARGET}" = "SG" ]; } \ && [ "${history_count}" -eq 4 ] && [ -z "${snapshot_setting}" ] \ @@ -426,7 +430,10 @@ jobs: image_tag="${approved_probe_snapshot_candidate}" elif [ "${image_mode}" = "probe-financing" ]; then archive_ref="${approved_probe_financing_candidate}" - image_tag="${approved_probe_financing_candidate}" + if [ "${SOURCE_COMMIT}" = "${approved_paper_stock_inventory_candidate}" ]; then + archive_ref="${approved_paper_stock_inventory_candidate}" + fi + image_tag="${archive_ref}" elif [ "${image_mode}" = "account-history" ] || [ "${image_mode}" = "hk-account-snapshot" ]; then archive_ref="${approved_sghk_snapshot_candidate}" image_tag="${approved_sghk_snapshot_candidate}" diff --git a/scripts/verify_deployed_runtime_target_admission.py b/scripts/verify_deployed_runtime_target_admission.py index f2b14ca..648495c 100644 --- a/scripts/verify_deployed_runtime_target_admission.py +++ b/scripts/verify_deployed_runtime_target_admission.py @@ -41,6 +41,8 @@ class AdmissionError(ValueError): APPROVED_PAPER_PROBE_SNAPSHOT_CANDIDATE = "318bf0419ec91002fd0f0dfd1bc80a0664a85e79" # Reviewed PAPER internal-probe financing producer. Same empty-settings gate as the probe snapshot. APPROVED_PAPER_PROBE_FINANCING_CANDIDATE = "82788aa7c73690d2b87f63540a9102943e9372eb" +# Reviewed PAPER stock-inventory/financing repair baseline. Same empty-settings gate as the probe producers. +APPROVED_PAPER_STOCK_INVENTORY_CANDIDATE = "a5d8e9a13b60be58de3c3afd8c4c78245a67d898" # Reviewed read-only SG/HK account-snapshot producer. It is not a PAPER candidate. APPROVED_SGHK_ACCOUNT_SNAPSHOT_CANDIDATE = "df3d29d13daeffc7b4af9fec5db0e9ec1f07b60f" # Reviewed read-only SG/HK stock-inventory image. It carries no history or snapshot update. @@ -855,6 +857,7 @@ def _validate_image_only_source( elif image_commit in { APPROVED_PAPER_PROBE_SNAPSHOT_CANDIDATE, APPROVED_PAPER_PROBE_FINANCING_CANDIDATE, + APPROVED_PAPER_STOCK_INVENTORY_CANDIDATE, }: if ( str(env.get("WORKFLOW_TARGET") or "") != "PAPER" diff --git a/tests/test_deployed_runtime_target_admission.py b/tests/test_deployed_runtime_target_admission.py index eaa4192..c3a8334 100644 --- a/tests/test_deployed_runtime_target_admission.py +++ b/tests/test_deployed_runtime_target_admission.py @@ -85,7 +85,12 @@ def test_verify_service_rejects_target_drift(target, profile, message): HTTP_SNAPSHOT_CANDIDATE = admission.APPROVED_PAPER_HTTP_SNAPSHOT_CANDIDATE PROBE_SNAPSHOT_CANDIDATE = admission.APPROVED_PAPER_PROBE_SNAPSHOT_CANDIDATE PROBE_FINANCING_CANDIDATE = admission.APPROVED_PAPER_PROBE_FINANCING_CANDIDATE -PROBE_CANDIDATES = (PROBE_SNAPSHOT_CANDIDATE, PROBE_FINANCING_CANDIDATE) +PAPER_STOCK_INVENTORY_CANDIDATE = admission.APPROVED_PAPER_STOCK_INVENTORY_CANDIDATE +PROBE_CANDIDATES = ( + PROBE_SNAPSHOT_CANDIDATE, + PROBE_FINANCING_CANDIDATE, + PAPER_STOCK_INVENTORY_CANDIDATE, +) SGHK_SNAPSHOT_CANDIDATE = admission.APPROVED_SGHK_ACCOUNT_SNAPSHOT_CANDIDATE HK_PROBE_DIAGNOSTICS_CANDIDATE = admission.APPROVED_HK_PROBE_DIAGNOSTICS_CANDIDATE STOCK_INVENTORY_CANDIDATE = admission.APPROVED_SGHK_STOCK_INVENTORY_CANDIDATE @@ -1209,6 +1214,81 @@ def run(command): assert not any(command[:3] == ["gcloud", "run", "services"] and "update" in command for command in calls) +def test_paper_stock_inventory_candidate_is_fixed_and_distinct(): + assert PAPER_STOCK_INVENTORY_CANDIDATE == "a5d8e9a13b60be58de3c3afd8c4c78245a67d898" + assert PAPER_STOCK_INVENTORY_CANDIDATE not in { + CANDIDATE, + HTTP_SNAPSHOT_CANDIDATE, + PROBE_SNAPSHOT_CANDIDATE, + PROBE_FINANCING_CANDIDATE, + SGHK_SNAPSHOT_CANDIDATE, + HK_PROBE_DIAGNOSTICS_CANDIDATE, + STOCK_INVENTORY_CANDIDATE, + } + + +def test_paper_stock_inventory_source_admits_only_paper_with_empty_settings(): + assert admission._validate_image_only_source( + image_commit=PAPER_STOCK_INVENTORY_CANDIDATE, + env={"WORKFLOW_TARGET": "PAPER"}, + project="synthetic-project", + ) == (None, None) + for env in ( + {"WORKFLOW_TARGET": "HK"}, + {"WORKFLOW_TARGET": "SG"}, + {"WORKFLOW_TARGET": "PAPER", "ACCOUNT_SNAPSHOT_ENABLED_INPUT": "true"}, + {"WORKFLOW_TARGET": "PAPER", "ACCOUNT_SNAPSHOT_ENABLED_INPUT": "false"}, + {**HISTORY, "WORKFLOW_TARGET": "PAPER"}, + ): + with pytest.raises(admission.AdmissionError, match="not approved"): + admission._validate_image_only_source( + image_commit=PAPER_STOCK_INVENTORY_CANDIDATE, + env=env, + project="synthetic-project", + ) + + +def test_paper_stock_inventory_candidate_does_not_admit_arbitrary_sha(): + for commit in ( + "c" * 40, + PAPER_STOCK_INVENTORY_CANDIDATE[:-1], + PAPER_STOCK_INVENTORY_CANDIDATE + "0", + ): + with pytest.raises(admission.AdmissionError, match="not approved"): + admission._validate_image_only_source( + image_commit=commit, + env={"WORKFLOW_TARGET": "PAPER"}, + project="synthetic-project", + ) + + +@pytest.mark.parametrize( + "target_overrides", + [ + {"account_scope": "HK"}, + {"account_selector": ["HK"]}, + {"service_name": "other-service"}, + {"deployment_selector": "HK"}, + ], +) +def test_paper_stock_inventory_candidate_rejects_paper_identity_drift(target_overrides): + service, _ = _service_with({**_paper_target(), **target_overrides}) + + def run(command): + raise AssertionError(command) + + with pytest.raises(admission.AdmissionError, match="does not match"): + admission.prepare_image_only_staging( + service="paper-service", + project="synthetic-project", + region="synthetic-region", + service_json=service, + env={**_main_env(), "SOURCE_COMMIT": PAPER_STOCK_INVENTORY_CANDIDATE}, + image_commit=PAPER_STOCK_INVENTORY_CANDIDATE, + run=run, + ) + + def _stock_inventory_service(target_label: str, *, target_overrides=None, extra_env=None): target = _sghk_target(target_label) target.update(target_overrides or {}) diff --git a/tests/test_sync_cloud_run_env_workflow.sh b/tests/test_sync_cloud_run_env_workflow.sh index 5364aa9..4ca2e2c 100644 --- a/tests/test_sync_cloud_run_env_workflow.sh +++ b/tests/test_sync_cloud_run_env_workflow.sh @@ -453,6 +453,7 @@ assert "df3d29d13daeffc7b4af9fec5db0e9ec1f07b60f" in job assert "779d8e1c39d161144bc34ae8503ce34d87971b16" in job assert "b9dbd2f697c84182a8959fcbbd360a5211f502c6" in job assert "approved_probe_financing_candidate=82788aa7c73690d2b87f63540a9102943e9372eb" in job +assert "approved_paper_stock_inventory_candidate=a5d8e9a13b60be58de3c3afd8c4c78245a67d898" in job assert 'image_mode=probe-financing' in job assert '[ "${GITHUB_REPOSITORY:-}" != "QuantStrategyLab/LongBridgePlatform" ]' in job assert '[ "${SOURCE_COMMIT}" = "${GITHUB_SHA}" ] || [ "${SOURCE_COMMIT}" = "${approved_candidate}" ]' not in job @@ -472,6 +473,19 @@ blocks = [run_block(name) for name in ( "Validate image-only dispatch", "Verify exact image-only source", "Build and stage image without traffic", )] +# Both shell gates admit the reviewed PAPER stock-inventory candidate only in +# the existing probe-financing path, and the archive stays a fixed candidate. +for gate_block in (blocks[0], blocks[2]): + assert "approved_paper_stock_inventory_candidate=a5d8e9a13b60be58de3c3afd8c4c78245a67d898" in gate_block + assert '"${SOURCE_COMMIT}" = "${approved_probe_financing_candidate}"' in gate_block + assert '"${SOURCE_COMMIT}" = "${approved_paper_stock_inventory_candidate}"' in gate_block + assert "image_mode=probe-financing" in gate_block +assert 'archive_ref="${approved_probe_financing_candidate}"' in blocks[2] +assert 'archive_ref="${approved_paper_stock_inventory_candidate}"' in blocks[2] +assert 'image_tag="${archive_ref}"' in blocks[2] +assert 'image_tag="${approved_probe_financing_candidate}"' not in blocks[2] +assert "probe-financing" not in blocks[1] + with tempfile.TemporaryDirectory(prefix="lb-no-traffic-test-") as directory: root = Path(directory) log = root / "calls.jsonl" @@ -486,7 +500,8 @@ approved = "0b939723c1db3ef59175535998b470cbcd4b8824" http_snapshot_candidate = "d8314a61df697cae1dd03a78ddc5c2fc4179ec67" probe_snapshot_candidate = "318bf0419ec91002fd0f0dfd1bc80a0664a85e79" probe_financing_candidate = "82788aa7c73690d2b87f63540a9102943e9372eb" -probe_candidates = (probe_snapshot_candidate, probe_financing_candidate) +paper_stock_inventory_candidate = "a5d8e9a13b60be58de3c3afd8c4c78245a67d898" +probe_candidates = (probe_snapshot_candidate, probe_financing_candidate, paper_stock_inventory_candidate) sghk_snapshot_candidate = "df3d29d13daeffc7b4af9fec5db0e9ec1f07b60f" hk_probe_diagnostics_candidate = "779d8e1c39d161144bc34ae8503ce34d87971b16" sghk_stock_inventory_candidate = "b9dbd2f697c84182a8959fcbbd360a5211f502c6" @@ -651,11 +666,11 @@ def staged_revision(): if command == "git" and args == ["rev-parse", "HEAD"]: print(os.environ["CHECKOUT_SHA"]) -elif command == "git" and args[:4] == ["fetch", "--depth", "1", "origin"] and args[4] in (approved, http_snapshot_candidate, probe_snapshot_candidate, probe_financing_candidate, sghk_snapshot_candidate, hk_probe_diagnostics_candidate, sghk_stock_inventory_candidate): +elif command == "git" and args[:4] == ["fetch", "--depth", "1", "origin"] and args[4] in (approved, http_snapshot_candidate, probe_snapshot_candidate, probe_financing_candidate, paper_stock_inventory_candidate, sghk_snapshot_candidate, hk_probe_diagnostics_candidate, sghk_stock_inventory_candidate): pass -elif command == "git" and args[:2] == ["cat-file", "-t"] and args[2] in (approved, http_snapshot_candidate, probe_snapshot_candidate, probe_financing_candidate, sghk_snapshot_candidate, hk_probe_diagnostics_candidate, sghk_stock_inventory_candidate): +elif command == "git" and args[:2] == ["cat-file", "-t"] and args[2] in (approved, http_snapshot_candidate, probe_snapshot_candidate, probe_financing_candidate, paper_stock_inventory_candidate, sghk_snapshot_candidate, hk_probe_diagnostics_candidate, sghk_stock_inventory_candidate): print("commit") -elif command == "git" and args[:1] == ["rev-parse"] and len(args) == 2 and args[1] in (approved + "^{commit}", http_snapshot_candidate + "^{commit}", probe_snapshot_candidate + "^{commit}", probe_financing_candidate + "^{commit}", sghk_snapshot_candidate + "^{commit}", hk_probe_diagnostics_candidate + "^{commit}", sghk_stock_inventory_candidate + "^{commit}"): +elif command == "git" and args[:1] == ["rev-parse"] and len(args) == 2 and args[1] in (approved + "^{commit}", http_snapshot_candidate + "^{commit}", probe_snapshot_candidate + "^{commit}", probe_financing_candidate + "^{commit}", paper_stock_inventory_candidate + "^{commit}", sghk_snapshot_candidate + "^{commit}", hk_probe_diagnostics_candidate + "^{commit}", sghk_stock_inventory_candidate + "^{commit}"): print(args[1].split("^", 1)[0]) elif command == "git" and args == ["archive", "HEAD"]: print("synthetic tracked source archive") @@ -667,6 +682,8 @@ elif command == "git" and args == ["archive", probe_snapshot_candidate]: print("synthetic internal probe snapshot candidate archive") elif command == "git" and args == ["archive", probe_financing_candidate]: print("synthetic internal probe financing candidate archive") +elif command == "git" and args == ["archive", paper_stock_inventory_candidate]: + print("synthetic PAPER stock inventory candidate archive") elif command == "git" and args == ["archive", sghk_snapshot_candidate]: print("synthetic SG/HK account snapshot candidate archive") elif command == "git" and args == ["archive", hk_probe_diagnostics_candidate]: @@ -677,7 +694,7 @@ elif command == "git" and args[:1] == ["show"] and len(args) == 2 and ":" in arg sha, name = args[1].split(":", 1) if name not in ("uv.lock", "pyproject.toml", "qsl.toml"): raise SystemExit("unexpected git show") - if sha not in ("a" * 40, serving_sha, approved, http_snapshot_candidate, probe_snapshot_candidate, probe_financing_candidate, sghk_snapshot_candidate, hk_probe_diagnostics_candidate, sghk_stock_inventory_candidate): + if sha not in ("a" * 40, serving_sha, approved, http_snapshot_candidate, probe_snapshot_candidate, probe_financing_candidate, paper_stock_inventory_candidate, sghk_snapshot_candidate, hk_probe_diagnostics_candidate, sghk_stock_inventory_candidate): raise SystemExit("admission read an unapproved source lock") pin = ("f" * 40) if sha == serving_sha and os.environ.get("BAD_SERVING_LOCK") == "1" else ues print(declaration(name, pin), end="") @@ -771,7 +788,8 @@ else: http_snapshot_candidate = "d8314a61df697cae1dd03a78ddc5c2fc4179ec67" probe_snapshot_candidate = "318bf0419ec91002fd0f0dfd1bc80a0664a85e79" probe_financing_candidate = "82788aa7c73690d2b87f63540a9102943e9372eb" - probe_candidates = (probe_snapshot_candidate, probe_financing_candidate) + paper_stock_inventory_candidate = "a5d8e9a13b60be58de3c3afd8c4c78245a67d898" + probe_candidates = (probe_snapshot_candidate, probe_financing_candidate, paper_stock_inventory_candidate) sghk_snapshot_candidate = "df3d29d13daeffc7b4af9fec5db0e9ec1f07b60f" hk_probe_diagnostics_candidate = "779d8e1c39d161144bc34ae8503ce34d87971b16" sghk_stock_inventory_candidate = "b9dbd2f697c84182a8959fcbbd360a5211f502c6"