360df4083a
chore(deps): Bump actions/checkout from 4 to 6 ( #25 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 4 to 6.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/v4...v6 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-20 18:52:45 +02:00
e2c2fefe9a
chore(deps): Bump actions/upload-pages-artifact from 3 to 5 ( #26 )
...
Bumps [actions/upload-pages-artifact](https://github.com/actions/upload-pages-artifact ) from 3 to 5.
- [Release notes](https://github.com/actions/upload-pages-artifact/releases )
- [Commits](https://github.com/actions/upload-pages-artifact/compare/v3...v5 )
---
updated-dependencies:
- dependency-name: actions/upload-pages-artifact
dependency-version: '5'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-20 18:52:36 +02:00
bdb1d03357
chore(deps): Bump actions/deploy-pages from 4 to 5 ( #11 )
...
Bumps [actions/deploy-pages](https://github.com/actions/deploy-pages ) from 4 to 5.
- [Release notes](https://github.com/actions/deploy-pages/releases )
- [Commits](https://github.com/actions/deploy-pages/compare/v4...v5 )
---
updated-dependencies:
- dependency-name: actions/deploy-pages
dependency-version: '5'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-18 09:09:29 +02:00
8433795a4a
chore(deps): Bump actions/cache from 4 to 5 ( #10 )
...
Bumps [actions/cache](https://github.com/actions/cache ) from 4 to 5.
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/v4...v5 )
---
updated-dependencies:
- dependency-name: actions/cache
dependency-version: '5'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-18 09:09:26 +02:00
ec2b8ec7af
fix(security): replace relative_to() with realpath+startswith for CodeQL sanitization
...
Path injection (#22 , #28 , #29 , #30 ):
- Switch from Path.relative_to() to os.path.realpath() + str.startswith()
in all four path-validation sites across finetune and rl UI data_loader.py
and finetune app.py. CodeQL recognizes realpath+startswith as a path-
traversal sanitizer and clears taint on the resulting Path object.
- Also simplify finetune/app.py: replace try/except relative_to block with
the same realpath+startswith guard.
Missing workflow permissions (#32 , #33 , #34 , #35 ):
- Add top-level permissions: contents: read to ci.yml, docs.yml, lint.yml,
and security.yml. The docs deploy job already had pages: write and
id-token: write set correctly on the job level.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-04-17 21:59:03 +02:00
9e85f08f11
feat: Add GitHub infrastructure, CI/CD pipelines, and examples
...
- Add GitHub issue templates (bug, feature, docs)
- Add pull request template with closed-source checklist
- Add CODEOWNERS for code review assignment
- Add CI/CD workflows (ci, lint, security, docs, release)
- pytest + coverage with Python 3.10/3.11 matrix
- Ruff + MyPy code quality checks
- Bandit + safety security scanning
- Sphinx docs + GitHub Pages deployment
- Automated PyPI releases on tag push
- Add 6 comprehensive examples + Jupyter quickstart
- 01_factor_discovery.py (LLM factor generation)
- 02_factor_evolution.py (factor optimization)
- 03_strategy_generation.py (IC-weighted combination)
- 04_backtest_simple.py (strategy backtesting)
- 05_model_training.py (XGBoost/LSTM training)
- 06_rl_trading_agent.py (PPO/DQN/A2C agents)
- notebooks/quickstart.ipynb (interactive tutorial)
- Restructure .gitignore with explicit closed-source sections
- Add CI/coverage/license badges to README
- Complete CLI docstrings for all 9 commands
- Add data_config.yaml for quant loop configuration
2026-04-11 21:40:18 +02:00
dependabot[bot]