Skip to content

Allow the reviewed PAPER inventory repair in the existing release path #614

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Pigbibi merged 1 commit into from
Oct 25, 2026
Merged

Allow the reviewed PAPER inventory repair in the existing release path #614

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 10 additions & 3 deletions .github/workflows/sync-cloud-run-env.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -206,6 +206,7 @@ jobs:
approved_http_snapshot_candidate=d8314a61df697cae1dd03a78ddc5c2fc4179ec67
approved_probe_snapshot_candidate=318bf0419ec91002fd0f0dfd1bc80a0664a85e79
approved_probe_financing_candidate=82788aa7c73690d2b87f63540a9102943e9372eb
approved_paper_stock_inventory_candidate=a5d8e9a13b60be58de3c3afd8c4c78245a67d898
approved_sghk_snapshot_candidate=df3d29d13daeffc7b4af9fec5db0e9ec1f07b60f
approved_hk_probe_diagnostics_candidate=779d8e1c39d161144bc34ae8503ce34d87971b16
approved_sghk_stock_inventory_candidate=b9dbd2f697c84182a8959fcbbd360a5211f502c6
Expand Down Expand Up @@ -282,7 +283,8 @@ jobs:
image_mode=probe
elif [ "${WORKFLOW_TARGET}" = "PAPER" ] && [ "${history_count}" -eq 0 ] \
&& [ -z "${snapshot_setting}" ] \
&& [ "${SOURCE_COMMIT}" = "${approved_probe_financing_candidate}" ]; then
&& { [ "${SOURCE_COMMIT}" = "${approved_probe_financing_candidate}" ] \
|| [ "${SOURCE_COMMIT}" = "${approved_paper_stock_inventory_candidate}" ]; }; then
image_mode=probe-financing
elif { [ "${WORKFLOW_TARGET}" = "HK" ] || [ "${WORKFLOW_TARGET}" = "SG" ]; } \
&& [ "${history_count}" -eq 4 ] && [ -z "${snapshot_setting}" ] \
Expand Down Expand Up @@ -355,6 +357,7 @@ jobs:
approved_http_snapshot_candidate=d8314a61df697cae1dd03a78ddc5c2fc4179ec67
approved_probe_snapshot_candidate=318bf0419ec91002fd0f0dfd1bc80a0664a85e79
approved_probe_financing_candidate=82788aa7c73690d2b87f63540a9102943e9372eb
approved_paper_stock_inventory_candidate=a5d8e9a13b60be58de3c3afd8c4c78245a67d898
approved_sghk_snapshot_candidate=df3d29d13daeffc7b4af9fec5db0e9ec1f07b60f
approved_hk_probe_diagnostics_candidate=779d8e1c39d161144bc34ae8503ce34d87971b16
approved_sghk_stock_inventory_candidate=b9dbd2f697c84182a8959fcbbd360a5211f502c6
Expand Down Expand Up @@ -389,7 +392,8 @@ jobs:
image_mode=probe
elif [ "${WORKFLOW_TARGET}" = "PAPER" ] && [ "${history_count}" -eq 0 ] \
&& [ -z "${snapshot_setting}" ] \
&& [ "${SOURCE_COMMIT}" = "${approved_probe_financing_candidate}" ]; then
&& { [ "${SOURCE_COMMIT}" = "${approved_probe_financing_candidate}" ] \
|| [ "${SOURCE_COMMIT}" = "${approved_paper_stock_inventory_candidate}" ]; }; then
image_mode=probe-financing
elif { [ "${WORKFLOW_TARGET}" = "HK" ] || [ "${WORKFLOW_TARGET}" = "SG" ]; } \
&& [ "${history_count}" -eq 4 ] && [ -z "${snapshot_setting}" ] \
Expand Down Expand Up @@ -426,7 +430,10 @@ jobs:
image_tag="${approved_probe_snapshot_candidate}"
elif [ "${image_mode}" = "probe-financing" ]; then
archive_ref="${approved_probe_financing_candidate}"
image_tag="${approved_probe_financing_candidate}"
if [ "${SOURCE_COMMIT}" = "${approved_paper_stock_inventory_candidate}" ]; then
archive_ref="${approved_paper_stock_inventory_candidate}"
fi
image_tag="${archive_ref}"
elif [ "${image_mode}" = "account-history" ] || [ "${image_mode}" = "hk-account-snapshot" ]; then
archive_ref="${approved_sghk_snapshot_candidate}"
image_tag="${approved_sghk_snapshot_candidate}"
Expand Down
3 changes: 3 additions & 0 deletions scripts/verify_deployed_runtime_target_admission.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,8 @@ class AdmissionError(ValueError):
APPROVED_PAPER_PROBE_SNAPSHOT_CANDIDATE = "318bf0419ec91002fd0f0dfd1bc80a0664a85e79"
# Reviewed PAPER internal-probe financing producer. Same empty-settings gate as the probe snapshot.
APPROVED_PAPER_PROBE_FINANCING_CANDIDATE = "82788aa7c73690d2b87f63540a9102943e9372eb"
# Reviewed PAPER stock-inventory/financing repair baseline. Same empty-settings gate as the probe producers.
APPROVED_PAPER_STOCK_INVENTORY_CANDIDATE = "a5d8e9a13b60be58de3c3afd8c4c78245a67d898"
# Reviewed read-only SG/HK account-snapshot producer. It is not a PAPER candidate.
APPROVED_SGHK_ACCOUNT_SNAPSHOT_CANDIDATE = "df3d29d13daeffc7b4af9fec5db0e9ec1f07b60f"
# Reviewed read-only SG/HK stock-inventory image. It carries no history or snapshot update.
Expand Down Expand Up @@ -855,6 +857,7 @@ def _validate_image_only_source(
elif image_commit in {
APPROVED_PAPER_PROBE_SNAPSHOT_CANDIDATE,
APPROVED_PAPER_PROBE_FINANCING_CANDIDATE,
APPROVED_PAPER_STOCK_INVENTORY_CANDIDATE,
}:
if (
str(env.get("WORKFLOW_TARGET") or "") != "PAPER"
Expand Down
82 changes: 81 additions & 1 deletion tests/test_deployed_runtime_target_admission.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,7 +85,12 @@ def test_verify_service_rejects_target_drift(target, profile, message):
HTTP_SNAPSHOT_CANDIDATE = admission.APPROVED_PAPER_HTTP_SNAPSHOT_CANDIDATE
PROBE_SNAPSHOT_CANDIDATE = admission.APPROVED_PAPER_PROBE_SNAPSHOT_CANDIDATE
PROBE_FINANCING_CANDIDATE = admission.APPROVED_PAPER_PROBE_FINANCING_CANDIDATE
PROBE_CANDIDATES = (PROBE_SNAPSHOT_CANDIDATE, PROBE_FINANCING_CANDIDATE)
PAPER_STOCK_INVENTORY_CANDIDATE = admission.APPROVED_PAPER_STOCK_INVENTORY_CANDIDATE
PROBE_CANDIDATES = (
PROBE_SNAPSHOT_CANDIDATE,
PROBE_FINANCING_CANDIDATE,
PAPER_STOCK_INVENTORY_CANDIDATE,
)
SGHK_SNAPSHOT_CANDIDATE = admission.APPROVED_SGHK_ACCOUNT_SNAPSHOT_CANDIDATE
HK_PROBE_DIAGNOSTICS_CANDIDATE = admission.APPROVED_HK_PROBE_DIAGNOSTICS_CANDIDATE
STOCK_INVENTORY_CANDIDATE = admission.APPROVED_SGHK_STOCK_INVENTORY_CANDIDATE
Expand Down Expand Up @@ -1209,6 +1214,81 @@ def run(command):
assert not any(command[:3] == ["gcloud", "run", "services"] and "update" in command for command in calls)


def test_paper_stock_inventory_candidate_is_fixed_and_distinct():
assert PAPER_STOCK_INVENTORY_CANDIDATE == "a5d8e9a13b60be58de3c3afd8c4c78245a67d898"
assert PAPER_STOCK_INVENTORY_CANDIDATE not in {
CANDIDATE,
HTTP_SNAPSHOT_CANDIDATE,
PROBE_SNAPSHOT_CANDIDATE,
PROBE_FINANCING_CANDIDATE,
SGHK_SNAPSHOT_CANDIDATE,
HK_PROBE_DIAGNOSTICS_CANDIDATE,
STOCK_INVENTORY_CANDIDATE,
}


def test_paper_stock_inventory_source_admits_only_paper_with_empty_settings():
assert admission._validate_image_only_source(
image_commit=PAPER_STOCK_INVENTORY_CANDIDATE,
env={"WORKFLOW_TARGET": "PAPER"},
project="synthetic-project",
) == (None, None)
for env in (
{"WORKFLOW_TARGET": "HK"},
{"WORKFLOW_TARGET": "SG"},
{"WORKFLOW_TARGET": "PAPER", "ACCOUNT_SNAPSHOT_ENABLED_INPUT": "true"},
{"WORKFLOW_TARGET": "PAPER", "ACCOUNT_SNAPSHOT_ENABLED_INPUT": "false"},
{**HISTORY, "WORKFLOW_TARGET": "PAPER"},
):
with pytest.raises(admission.AdmissionError, match="not approved"):
admission._validate_image_only_source(
image_commit=PAPER_STOCK_INVENTORY_CANDIDATE,
env=env,
project="synthetic-project",
)


def test_paper_stock_inventory_candidate_does_not_admit_arbitrary_sha():
for commit in (
"c" * 40,
PAPER_STOCK_INVENTORY_CANDIDATE[:-1],
PAPER_STOCK_INVENTORY_CANDIDATE + "0",
):
with pytest.raises(admission.AdmissionError, match="not approved"):
admission._validate_image_only_source(
image_commit=commit,
env={"WORKFLOW_TARGET": "PAPER"},
project="synthetic-project",
)


@pytest.mark.parametrize(
"target_overrides",
[
{"account_scope": "HK"},
{"account_selector": ["HK"]},
{"service_name": "other-service"},
{"deployment_selector": "HK"},
],
)
def test_paper_stock_inventory_candidate_rejects_paper_identity_drift(target_overrides):
service, _ = _service_with({**_paper_target(), **target_overrides})

def run(command):
raise AssertionError(command)

with pytest.raises(admission.AdmissionError, match="does not match"):
admission.prepare_image_only_staging(
service="paper-service",
project="synthetic-project",
region="synthetic-region",
service_json=service,
env={**_main_env(), "SOURCE_COMMIT": PAPER_STOCK_INVENTORY_CANDIDATE},
image_commit=PAPER_STOCK_INVENTORY_CANDIDATE,
run=run,
)


def _stock_inventory_service(target_label: str, *, target_overrides=None, extra_env=None):
target = _sghk_target(target_label)
target.update(target_overrides or {})
Expand Down
30 changes: 24 additions & 6 deletions tests/test_sync_cloud_run_env_workflow.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -453,6 +453,7 @@ assert "df3d29d13daeffc7b4af9fec5db0e9ec1f07b60f" in job
assert "779d8e1c39d161144bc34ae8503ce34d87971b16" in job
assert "b9dbd2f697c84182a8959fcbbd360a5211f502c6" in job
assert "approved_probe_financing_candidate=82788aa7c73690d2b87f63540a9102943e9372eb" in job
assert "approved_paper_stock_inventory_candidate=a5d8e9a13b60be58de3c3afd8c4c78245a67d898" in job
assert 'image_mode=probe-financing' in job
assert '[ "${GITHUB_REPOSITORY:-}" != "QuantStrategyLab/LongBridgePlatform" ]' in job
assert '[ "${SOURCE_COMMIT}" = "${GITHUB_SHA}" ] || [ "${SOURCE_COMMIT}" = "${approved_candidate}" ]' not in job
Expand All @@ -472,6 +473,19 @@ blocks = [run_block(name) for name in (
"Validate image-only dispatch", "Verify exact image-only source", "Build and stage image without traffic",
)]

# Both shell gates admit the reviewed PAPER stock-inventory candidate only in
# the existing probe-financing path, and the archive stays a fixed candidate.
for gate_block in (blocks[0], blocks[2]):
assert "approved_paper_stock_inventory_candidate=a5d8e9a13b60be58de3c3afd8c4c78245a67d898" in gate_block
assert '"${SOURCE_COMMIT}" = "${approved_probe_financing_candidate}"' in gate_block
assert '"${SOURCE_COMMIT}" = "${approved_paper_stock_inventory_candidate}"' in gate_block
assert "image_mode=probe-financing" in gate_block
assert 'archive_ref="${approved_probe_financing_candidate}"' in blocks[2]
assert 'archive_ref="${approved_paper_stock_inventory_candidate}"' in blocks[2]
assert 'image_tag="${archive_ref}"' in blocks[2]
assert 'image_tag="${approved_probe_financing_candidate}"' not in blocks[2]
assert "probe-financing" not in blocks[1]

with tempfile.TemporaryDirectory(prefix="lb-no-traffic-test-") as directory:
root = Path(directory)
log = root / "calls.jsonl"
Expand All @@ -486,7 +500,8 @@ approved = "0b939723c1db3ef59175535998b470cbcd4b8824"
http_snapshot_candidate = "d8314a61df697cae1dd03a78ddc5c2fc4179ec67"
probe_snapshot_candidate = "318bf0419ec91002fd0f0dfd1bc80a0664a85e79"
probe_financing_candidate = "82788aa7c73690d2b87f63540a9102943e9372eb"
probe_candidates = (probe_snapshot_candidate, probe_financing_candidate)
paper_stock_inventory_candidate = "a5d8e9a13b60be58de3c3afd8c4c78245a67d898"
probe_candidates = (probe_snapshot_candidate, probe_financing_candidate, paper_stock_inventory_candidate)
sghk_snapshot_candidate = "df3d29d13daeffc7b4af9fec5db0e9ec1f07b60f"
hk_probe_diagnostics_candidate = "779d8e1c39d161144bc34ae8503ce34d87971b16"
sghk_stock_inventory_candidate = "b9dbd2f697c84182a8959fcbbd360a5211f502c6"
Expand Down Expand Up @@ -651,11 +666,11 @@ def staged_revision():

if command == "git" and args == ["rev-parse", "HEAD"]:
print(os.environ["CHECKOUT_SHA"])
elif command == "git" and args[:4] == ["fetch", "--depth", "1", "origin"] and args[4] in (approved, http_snapshot_candidate, probe_snapshot_candidate, probe_financing_candidate, sghk_snapshot_candidate, hk_probe_diagnostics_candidate, sghk_stock_inventory_candidate):
elif command == "git" and args[:4] == ["fetch", "--depth", "1", "origin"] and args[4] in (approved, http_snapshot_candidate, probe_snapshot_candidate, probe_financing_candidate, paper_stock_inventory_candidate, sghk_snapshot_candidate, hk_probe_diagnostics_candidate, sghk_stock_inventory_candidate):
pass
elif command == "git" and args[:2] == ["cat-file", "-t"] and args[2] in (approved, http_snapshot_candidate, probe_snapshot_candidate, probe_financing_candidate, sghk_snapshot_candidate, hk_probe_diagnostics_candidate, sghk_stock_inventory_candidate):
elif command == "git" and args[:2] == ["cat-file", "-t"] and args[2] in (approved, http_snapshot_candidate, probe_snapshot_candidate, probe_financing_candidate, paper_stock_inventory_candidate, sghk_snapshot_candidate, hk_probe_diagnostics_candidate, sghk_stock_inventory_candidate):
print("commit")
elif command == "git" and args[:1] == ["rev-parse"] and len(args) == 2 and args[1] in (approved + "^{commit}", http_snapshot_candidate + "^{commit}", probe_snapshot_candidate + "^{commit}", probe_financing_candidate + "^{commit}", sghk_snapshot_candidate + "^{commit}", hk_probe_diagnostics_candidate + "^{commit}", sghk_stock_inventory_candidate + "^{commit}"):
elif command == "git" and args[:1] == ["rev-parse"] and len(args) == 2 and args[1] in (approved + "^{commit}", http_snapshot_candidate + "^{commit}", probe_snapshot_candidate + "^{commit}", probe_financing_candidate + "^{commit}", paper_stock_inventory_candidate + "^{commit}", sghk_snapshot_candidate + "^{commit}", hk_probe_diagnostics_candidate + "^{commit}", sghk_stock_inventory_candidate + "^{commit}"):
print(args[1].split("^", 1)[0])
elif command == "git" and args == ["archive", "HEAD"]:
print("synthetic tracked source archive")
Expand All @@ -667,6 +682,8 @@ elif command == "git" and args == ["archive", probe_snapshot_candidate]:
print("synthetic internal probe snapshot candidate archive")
elif command == "git" and args == ["archive", probe_financing_candidate]:
print("synthetic internal probe financing candidate archive")
elif command == "git" and args == ["archive", paper_stock_inventory_candidate]:
print("synthetic PAPER stock inventory candidate archive")
elif command == "git" and args == ["archive", sghk_snapshot_candidate]:
print("synthetic SG/HK account snapshot candidate archive")
elif command == "git" and args == ["archive", hk_probe_diagnostics_candidate]:
Expand All @@ -677,7 +694,7 @@ elif command == "git" and args[:1] == ["show"] and len(args) == 2 and ":" in arg
sha, name = args[1].split(":", 1)
if name not in ("uv.lock", "pyproject.toml", "qsl.toml"):
raise SystemExit("unexpected git show")
if sha not in ("a" * 40, serving_sha, approved, http_snapshot_candidate, probe_snapshot_candidate, probe_financing_candidate, sghk_snapshot_candidate, hk_probe_diagnostics_candidate, sghk_stock_inventory_candidate):
if sha not in ("a" * 40, serving_sha, approved, http_snapshot_candidate, probe_snapshot_candidate, probe_financing_candidate, paper_stock_inventory_candidate, sghk_snapshot_candidate, hk_probe_diagnostics_candidate, sghk_stock_inventory_candidate):
raise SystemExit("admission read an unapproved source lock")
pin = ("f" * 40) if sha == serving_sha and os.environ.get("BAD_SERVING_LOCK") == "1" else ues
print(declaration(name, pin), end="")
Expand Down Expand Up @@ -771,7 +788,8 @@ else:
http_snapshot_candidate = "d8314a61df697cae1dd03a78ddc5c2fc4179ec67"
probe_snapshot_candidate = "318bf0419ec91002fd0f0dfd1bc80a0664a85e79"
probe_financing_candidate = "82788aa7c73690d2b87f63540a9102943e9372eb"
probe_candidates = (probe_snapshot_candidate, probe_financing_candidate)
paper_stock_inventory_candidate = "a5d8e9a13b60be58de3c3afd8c4c78245a67d898"
probe_candidates = (probe_snapshot_candidate, probe_financing_candidate, paper_stock_inventory_candidate)
sghk_snapshot_candidate = "df3d29d13daeffc7b4af9fec5db0e9ec1f07b60f"
hk_probe_diagnostics_candidate = "779d8e1c39d161144bc34ae8503ce34d87971b16"
sghk_stock_inventory_candidate = "b9dbd2f697c84182a8959fcbbd360a5211f502c6"
Expand Down
Loading