From cb6cbd2bfc6295bfdf8c97f21deb5195b9201b7f Mon Sep 17 00:00:00 2001 From: TPTBusiness Date: Sat, 18 Apr 2026 08:35:19 +0200 Subject: [PATCH] ci: add dependabot, conventional commits check, and scheduled weekly tests - dependabot.yml: weekly auto-PRs for pip and github-actions deps (major version bumps ignored, reviewed manually) - conventional-commits.yml: blocks PRs with non-conforming titles; warns on individual commits (required for release-please changelogs) - scheduled-tests.yml: weekly pytest run on py3.10+3.11, plus dependency vulnerability audit via safety Co-Authored-By: Claude Sonnet 4.6 --- .github/dependabot.yml | 26 ++++++++ .github/workflows/conventional-commits.yml | 78 ++++++++++++++++++++++ .github/workflows/scheduled-tests.yml | 68 +++++++++++++++++++ 3 files changed, 172 insertions(+) create mode 100644 .github/dependabot.yml create mode 100644 .github/workflows/conventional-commits.yml create mode 100644 .github/workflows/scheduled-tests.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..6009ace9 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,26 @@ +version: 2 +updates: + - package-ecosystem: "pip" + directory: "/" + schedule: + interval: "weekly" + day: "monday" + time: "06:00" + open-pull-requests-limit: 5 + labels: + - "dependencies" + ignore: + # Ignore major version bumps — review manually + - dependency-name: "*" + update-types: ["version-update:semver-major"] + + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + day: "monday" + time: "06:00" + open-pull-requests-limit: 5 + labels: + - "dependencies" + - "github-actions" diff --git a/.github/workflows/conventional-commits.yml b/.github/workflows/conventional-commits.yml new file mode 100644 index 00000000..db43ea8b --- /dev/null +++ b/.github/workflows/conventional-commits.yml @@ -0,0 +1,78 @@ +name: Conventional Commits + +on: + pull_request: + branches: [master, main] + types: [opened, edited, synchronize, reopened] + +permissions: + contents: read + pull-requests: read + +jobs: + check-title: + name: Validate PR Title + runs-on: ubuntu-latest + steps: + - name: Check PR title follows Conventional Commits + env: + PR_TITLE: ${{ github.event.pull_request.title }} + run: | + echo "PR title: $PR_TITLE" + + # Conventional Commits pattern: type(scope)!: description + # Types: feat, fix, docs, style, refactor, perf, test, build, ci, chore, revert + PATTERN='^(feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert)(\([^)]+\))?(!)?: .{1,100}$' + + if echo "$PR_TITLE" | grep -qE "$PATTERN"; then + echo "✓ PR title follows Conventional Commits format" + else + echo "::error::PR title does not follow Conventional Commits format." + echo "" + echo "Expected format: type(scope): description" + echo "Examples:" + echo " feat: add volatility factor" + echo " fix(optuna): fix inverted range in stage 2" + echo " ci: add dependabot config" + echo " chore(deps): pin aiohttp>=3.13.4" + echo "" + echo "Valid types: feat, fix, docs, style, refactor, perf, test, build, ci, chore, revert" + echo "" + echo "This is required for release-please to generate correct changelogs." + exit 1 + fi + + check-commits: + name: Validate Commit Messages + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - name: Check commits in PR follow Conventional Commits + env: + BASE_SHA: ${{ github.event.pull_request.base.sha }} + HEAD_SHA: ${{ github.event.pull_request.head.sha }} + run: | + PATTERN='^(feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert)(\([^)]+\))?(!)?: .+' + + FAILED=0 + while IFS= read -r msg; do + # Skip merge commits + if echo "$msg" | grep -qE "^Merge (pull request|branch|remote)"; then + continue + fi + if ! echo "$msg" | grep -qE "$PATTERN"; then + echo "::warning::Non-conventional commit: $msg" + FAILED=1 + fi + done < <(git log "$BASE_SHA..$HEAD_SHA" --format="%s") + + if [ $FAILED -eq 1 ]; then + echo "" + echo "::warning::Some commits don't follow Conventional Commits." + echo "This won't block the PR but may affect changelog generation." + else + echo "✓ All commits follow Conventional Commits format" + fi diff --git a/.github/workflows/scheduled-tests.yml b/.github/workflows/scheduled-tests.yml new file mode 100644 index 00000000..10483d82 --- /dev/null +++ b/.github/workflows/scheduled-tests.yml @@ -0,0 +1,68 @@ +name: Scheduled Tests + +on: + schedule: + # Every Monday at 07:00 UTC + - cron: "0 7 * * 1" + workflow_dispatch: # Allow manual trigger + +permissions: + contents: read + +jobs: + test: + name: Weekly Test Run (Python ${{ matrix.python-version }}) + runs-on: ubuntu-latest + strategy: + fail-fast: false + matrix: + python-version: ["3.10", "3.11"] + + steps: + - uses: actions/checkout@v4 + + - uses: actions/setup-python@v5 + with: + python-version: ${{ matrix.python-version }} + cache: "pip" + + - name: Install dependencies + run: | + python -m pip install --upgrade pip + pip install -e ".[test]" || pip install -r requirements.txt + pip install pytest pytest-cov + + - name: Run tests + run: | + pytest test/backtesting/ -v --tb=short --durations=10 + + - name: Upload results on failure + if: failure() + uses: actions/upload-artifact@v4 + with: + name: test-results-py${{ matrix.python-version }} + path: | + .pytest_cache/ + retention-days: 7 + + dependency-audit: + name: Dependency Audit + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - uses: actions/setup-python@v5 + with: + python-version: "3.10" + cache: "pip" + + - name: Install safety + run: pip install safety + + - name: Check for known vulnerabilities + run: | + echo "=== Weekly dependency vulnerability scan ===" + safety check -r requirements.txt --json || { + echo "::warning::Vulnerabilities found — review and update dependencies" + exit 0 + }