2 Commits

Author	SHA1	Message	Date
TPTBusiness	d8ab86d6cf	fix(security): replace relative_to() with realpath+startswith for CodeQL sanitization ... Path injection (#22, #28, #29, #30): - Switch from Path.relative_to() to os.path.realpath() + str.startswith() in all four path-validation sites across finetune and rl UI data_loader.py and finetune app.py. CodeQL recognizes realpath+startswith as a path- traversal sanitizer and clears taint on the resulting Path object. - Also simplify finetune/app.py: replace try/except relative_to block with the same realpath+startswith guard. Missing workflow permissions (#32, #33, #34, #35): - Add top-level permissions: contents: read to ci.yml, docs.yml, lint.yml, and security.yml. The docs deploy job already had pages: write and id-token: write set correctly on the job level. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-17 21:59:03 +02:00
TPTBusiness	b98c9cd572	feat: Add GitHub infrastructure, CI/CD pipelines, and examples ... - Add GitHub issue templates (bug, feature, docs) - Add pull request template with closed-source checklist - Add CODEOWNERS for code review assignment - Add CI/CD workflows (ci, lint, security, docs, release) - pytest + coverage with Python 3.10/3.11 matrix - Ruff + MyPy code quality checks - Bandit + safety security scanning - Sphinx docs + GitHub Pages deployment - Automated PyPI releases on tag push - Add 6 comprehensive examples + Jupyter quickstart - 01_factor_discovery.py (LLM factor generation) - 02_factor_evolution.py (factor optimization) - 03_strategy_generation.py (IC-weighted combination) - 04_backtest_simple.py (strategy backtesting) - 05_model_training.py (XGBoost/LSTM training) - 06_rl_trading_agent.py (PPO/DQN/A2C agents) - notebooks/quickstart.ipynb (interactive tutorial) - Restructure .gitignore with explicit closed-source sections - Add CI/coverage/license badges to README - Complete CLI docstrings for all 9 commands - Add data_config.yaml for quant loop configuration	2026-04-11 21:40:18 +02:00