wickra

Author	SHA1	Message	Date
dependabot[bot]	baffebd3da	deps(actions): bump actions/checkout from 6.0.2 to 6.0.3 (#269 ) Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p> <blockquote> <h2>v6.0.3</h2> <h2>What's Changed</h2> <ul> <li>Update changelog by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2357">actions/checkout#2357</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>Update changelog for v6.0.3 by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2446">actions/checkout#2446</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/yaananth"><code>@yaananth</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6...v6.0.3">https://github.com/actions/checkout/compare/v6...v6.0.3</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v6.0.3</h2> <ul> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <h2>v6.0.2</h2> <ul> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <h2>v6.0.1</h2> <ul> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> </ul> <h2>v6.0.0</h2> <ul> <li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li> <li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li> </ul> <h2>v5.0.1</h2> <ul> <li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li> </ul> <h2>v5.0.0</h2> <ul> <li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li> </ul> <h2>v4.3.1</h2> <ul> <li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li> </ul> <h2>v4.3.0</h2> <ul> <li>docs: update README.md by <a href="https://github.com/motss"><code>@motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li> <li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li> <li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li> <li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li> <li>Update README.md by <a href="https://github.com/nebuk89"><code>@nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li> <li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li> <li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li> </ul> <h2>v4.2.2</h2> <ul> <li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li> <li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li> </ul> <h2>v4.2.1</h2> <ul> <li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li> </ul> <h2>v4.2.0</h2> <ul> <li>Add Ref and Commit outputs by <a href="https://github.com/lucacome"><code>@lucacome</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1180">actions/checkout#1180</a></li> <li>Dependency updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>- <a href="https://redirect.github.com/actions/checkout/pull/1777">actions/checkout#1777</a>, <a href="https://redirect.github.com/actions/checkout/pull/1872">actions/checkout#1872</a></li> </ul> <h2>v4.1.7</h2> <ul> <li>Bump the minor-npm-dependencies group across 1 directory with 4 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1739">actions/checkout#1739</a></li> <li>Bump actions/checkout from 3 to 4 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1697">actions/checkout#1697</a></li> <li>Check out other refs/* by commit by <a href="https://github.com/orhantoy"><code>@orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1774">actions/checkout#1774</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/checkout/commit/df4cb1c069e1874edd31b4311f1884172cec0e10"><code>df4cb1c</code></a> Update changelog for v6.0.3 (<a href="https://redirect.github.com/actions/checkout/issues/2446">#2446</a>)</li> <li><a href="https://github.com/actions/checkout/commit/1cce3390c2bfda521930d01229c073c7ff920824"><code>1cce339</code></a> Fix checkout init for SHA-256 repositories (<a href="https://redirect.github.com/actions/checkout/issues/2439">#2439</a>)</li> <li><a href="https://github.com/actions/checkout/commit/900f2210b1d28bbbd0bd22d17926b9e224e8f231"><code>900f221</code></a> fix: expand merge commit SHA regex and add SHA-256 test cases (<a href="https://redirect.github.com/actions/checkout/issues/2414">#2414</a>)</li> <li><a href="https://github.com/actions/checkout/commit/0c366fd6a839edf440554fa01a7085ccba70ac98"><code>0c366fd</code></a> Update changelog (<a href="https://redirect.github.com/actions/checkout/issues/2357">#2357</a>)</li> <li>See full diff in <a href="https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd...df4cb1c069e1874edd31b4311f1884172cec0e10">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/checkout&package-manager=github_actions&previous-version=6.0.2&new-version=6.0.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>	2026-06-12 22:36:18 +02:00
dependabot[bot]	e631e55195	deps(actions): bump actions/setup-java from 4.8.0 to 5.2.0 (#268 ) Bumps [actions/setup-java](https://github.com/actions/setup-java) from 4.8.0 to 5.2.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/setup-java/releases">actions/setup-java's releases</a>.</em></p> <blockquote> <h2>v5.2.0</h2> <h2>What's Changed</h2> <h3>Enhancement</h3> <ul> <li>Retry on HTTP 522 Connection timed out by <a href="https://github.com/findepi"><code>@findepi</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/964">actions/setup-java#964</a></li> </ul> <h3>Documentation Changes</h3> <ul> <li>Update gradle caching by <a href="https://github.com/priya-kinthali"><code>@priya-kinthali</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/972">actions/setup-java#972</a></li> <li>Update checkout to v6 by <a href="https://github.com/mahabaleshwars"><code>@mahabaleshwars</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/973">actions/setup-java#973</a></li> </ul> <h3>Dependency Updates</h3> <ul> <li>Upgrade <code>@actions/cache</code> to v5 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/968">actions/setup-java#968</a></li> <li>Upgrade actions/checkout from 5 to 6 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/961">actions/setup-java#961</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/findepi"><code>@findepi</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-java/pull/964">actions/setup-java#964</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-java/compare/v5...v5.2.0">https://github.com/actions/setup-java/compare/v5...v5.2.0</a></p> <h2>v5.1.0</h2> <h2>What's Changed</h2> <h3>New Features</h3> <ul> <li>Add support for <code>.sdkmanrc</code> file in <code>java-version-file</code> parameter by <a href="https://github.com/guicamest"><code>@guicamest</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/736">actions/setup-java#736</a></li> <li>Add support for Microsoft OpenJDK 25 builds by <a href="https://github.com/the-mod"><code>@the-mod</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/927">actions/setup-java#927</a></li> </ul> <h3>Bug Fixes & Improvements</h3> <ul> <li>Update Regex to Support All ASDF Versions for the supported distributions in tool-versions File by <a href="https://github.com/aparnajyothi-y"><code>@aparnajyothi-y</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/767">actions/setup-java#767</a></li> <li>Enhance error logging for network failures to include endpoint/IP details, add retry mechanism and update workflows to use macos-15-intel by <a href="https://github.com/priya-kinthali"><code>@priya-kinthali</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/946">actions/setup-java#946</a></li> <li>Update SapMachine URLs by <a href="https://github.com/RealCLanger"><code>@RealCLanger</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/955">actions/setup-java#955</a></li> <li>Add GitHub Token Support for GraalVM and Refactor Code by <a href="https://github.com/mahabaleshwars"><code>@mahabaleshwars</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/849">actions/setup-java#849</a></li> </ul> <h3>Documentation changes</h3> <ul> <li>Update documentation to use checkout and Java v5 by <a href="https://github.com/lmvysakh"><code>@lmvysakh</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/903">actions/setup-java#903</a></li> <li>Clarify JAVA_HOME and PATH setup in README by <a href="https://github.com/chiranjib-swain"><code>@chiranjib-swain</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/841">actions/setup-java#841</a></li> </ul> <h3>Dependency updates</h3> <ul> <li>Upgrade prettier from 2.8.8 to 3.6.2 and document breaking changes in v5 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/873">actions/setup-java#873</a></li> <li>Upgrade actions/publish-action from 0.3.0 to 0.4.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/912">actions/setup-java#912</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/lmvysakh"><code>@lmvysakh</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-java/pull/903">actions/setup-java#903</a></li> <li><a href="https://github.com/chiranjib-swain"><code>@chiranjib-swain</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-java/pull/841">actions/setup-java#841</a></li> <li><a href="https://github.com/the-mod"><code>@the-mod</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-java/pull/927">actions/setup-java#927</a></li> <li><a href="https://github.com/priya-kinthali"><code>@priya-kinthali</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-java/pull/946">actions/setup-java#946</a></li> <li><a href="https://github.com/guicamest"><code>@guicamest</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-java/pull/736">actions/setup-java#736</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-java/compare/v5...v5.1.0">https://github.com/actions/setup-java/compare/v5...v5.1.0</a></p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/setup-java/commit/be666c2fcd27ec809703dec50e508c2fdc7f6654"><code>be666c2</code></a> Chore: Version Update and Checkout Update to v6 (<a href="https://redirect.github.com/actions/setup-java/issues/973">#973</a>)</li> <li><a href="https://github.com/actions/setup-java/commit/f7a6fefba97e80156950e16f2a9dafc8579b7d05"><code>f7a6fef</code></a> Bump actions/checkout from 5 to 6 (<a href="https://redirect.github.com/actions/setup-java/issues/961">#961</a>)</li> <li><a href="https://github.com/actions/setup-java/commit/d81c4e45f3ac973cc936d79104023e20054ba578"><code>d81c4e4</code></a> Upgrade <code>@actions/cache</code> to v5 (<a href="https://redirect.github.com/actions/setup-java/issues/968">#968</a>)</li> <li><a href="https://github.com/actions/setup-java/commit/1b1bbe1085cb6ab21b5b19b7bebc091a9430026a"><code>1b1bbe1</code></a> readme update (<a href="https://redirect.github.com/actions/setup-java/issues/972">#972</a>)</li> <li><a href="https://github.com/actions/setup-java/commit/5d7b2146334bacf88728daaa70414a99f5164e0f"><code>5d7b214</code></a> Retry on HTTP 522 Connection timed out (<a href="https://redirect.github.com/actions/setup-java/issues/964">#964</a>)</li> <li><a href="https://github.com/actions/setup-java/commit/f2beeb24e141e01a676f977032f5a29d81c9e27e"><code>f2beeb2</code></a> Bump actions/publish-action from 0.3.0 to 0.4.0 (<a href="https://redirect.github.com/actions/setup-java/issues/912">#912</a>)</li> <li><a href="https://github.com/actions/setup-java/commit/4e7e684fbb6e33f88ecb2cf1e6b3797739cf499b"><code>4e7e684</code></a> feat: Add support for <code>.sdkmanrc</code> file in <code>java-version-file</code> parameter (<a href="https://redirect.github.com/actions/setup-java/issues/736">#736</a>)</li> <li><a href="https://github.com/actions/setup-java/commit/46c56d6f92c88cf540acf95a12a4a41197499222"><code>46c56d6</code></a> Add GitHub Token Support for GraalVM and Refactor Code (<a href="https://redirect.github.com/actions/setup-java/issues/849">#849</a>)</li> <li><a href="https://github.com/actions/setup-java/commit/66b945764b75604b3cfd644c3ada5232cf6c90c6"><code>66b9457</code></a> Update SapMachine URLs (<a href="https://redirect.github.com/actions/setup-java/issues/955">#955</a>)</li> <li><a href="https://github.com/actions/setup-java/commit/6ba5449b7dcda52941806a19f0cf626b6420191e"><code>6ba5449</code></a> Enhance error logging for network failures to include endpoint/IP details, ad...</li> <li>Additional commits viewable in <a href="https://github.com/actions/setup-java/compare/c1e323688fd81a25caa38c78aa6df2d33d3e20d9...be666c2fcd27ec809703dec50e508c2fdc7f6654">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/setup-java&package-manager=github_actions&previous-version=4.8.0&new-version=5.2.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>	2026-06-12 22:21:13 +02:00
dependabot[bot]	63949f6fc8	deps(actions): bump actions/setup-go from 5.6.0 to 6.4.0 (#267 ) Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5.6.0 to 6.4.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/setup-go/releases">actions/setup-go's releases</a>.</em></p> <blockquote> <h2>v6.4.0</h2> <h2>What's Changed</h2> <h3>Enhancement</h3> <ul> <li>Add go-download-base-url input for custom Go distributions by <a href="https://github.com/gdams"><code>@gdams</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/721">actions/setup-go#721</a></li> </ul> <h3>Dependency update</h3> <ul> <li>Upgrade minimatch from 3.1.2 to 3.1.5 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/727">actions/setup-go#727</a></li> </ul> <h3>Documentation update</h3> <ul> <li>Rearrange README.md, add advanced-usage.md by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/724">actions/setup-go#724</a></li> <li>Fix Microsoft build of Go link by <a href="https://github.com/gdams"><code>@gdams</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/734">actions/setup-go#734</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/gdams"><code>@gdams</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-go/pull/721">actions/setup-go#721</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-go/compare/v6...v6.4.0">https://github.com/actions/setup-go/compare/v6...v6.4.0</a></p> <h2>v6.3.0</h2> <h2>What's Changed</h2> <ul> <li>Update default Go module caching to use go.mod by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/705">actions/setup-go#705</a></li> <li>Fix golang download url to go.dev by <a href="https://github.com/178inaba"><code>@178inaba</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/469">actions/setup-go#469</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-go/compare/v6...v6.3.0">https://github.com/actions/setup-go/compare/v6...v6.3.0</a></p> <h2>v6.2.0</h2> <h2>What's Changed</h2> <h3>Enhancements</h3> <ul> <li>Example for restore-only cache in documentation by <a href="https://github.com/aparnajyothi-y"><code>@aparnajyothi-y</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/696">actions/setup-go#696</a></li> <li>Update Node.js version in action.yml by <a href="https://github.com/ccoVeille"><code>@ccoVeille</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/691">actions/setup-go#691</a></li> <li>Documentation update of actions/checkout by <a href="https://github.com/deining"><code>@deining</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/683">actions/setup-go#683</a></li> </ul> <h3>Dependency updates</h3> <ul> <li>Upgrade js-yaml from 3.14.1 to 3.14.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/682">actions/setup-go#682</a></li> <li>Upgrade <code>@actions/cache</code> to v5 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/695">actions/setup-go#695</a></li> <li>Upgrade actions/checkout from 5 to 6 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/686">actions/setup-go#686</a></li> <li>Upgrade qs from 6.14.0 to 6.14.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/703">actions/setup-go#703</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/ccoVeille"><code>@ccoVeille</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-go/pull/691">actions/setup-go#691</a></li> <li><a href="https://github.com/deining"><code>@deining</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-go/pull/683">actions/setup-go#683</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-go/compare/v6...v6.2.0">https://github.com/actions/setup-go/compare/v6...v6.2.0</a></p> <h2>v6.1.0</h2> <h2>What's Changed</h2> <h3>Enhancements</h3> <ul> <li>Fall back to downloading from go.dev/dl instead of storage.googleapis.com/golang by <a href="https://github.com/nicholasngai"><code>@nicholasngai</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/665">actions/setup-go#665</a></li> <li>Add support for .tool-versions file and update workflow by <a href="https://github.com/priya-kinthali"><code>@priya-kinthali</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/673">actions/setup-go#673</a></li> <li>Add comprehensive breaking changes documentation for v6 by <a href="https://github.com/mahabaleshwars"><code>@mahabaleshwars</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/674">actions/setup-go#674</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/setup-go/commit/4a3601121dd01d1626a1e23e37211e3254c1c06c"><code>4a36011</code></a> docs: fix Microsoft build of Go link (<a href="https://redirect.github.com/actions/setup-go/issues/734">#734</a>)</li> <li><a href="https://github.com/actions/setup-go/commit/8f19afcc704763637be6b1718da0af52ca05785d"><code>8f19afc</code></a> feat: add go-download-base-url input for custom Go distributions (<a href="https://redirect.github.com/actions/setup-go/issues/721">#721</a>)</li> <li><a href="https://github.com/actions/setup-go/commit/27fdb267c15a8835f1ead03dfa07f89be2bb741a"><code>27fdb26</code></a> Bump minimatch from 3.1.2 to 3.1.5 (<a href="https://redirect.github.com/actions/setup-go/issues/727">#727</a>)</li> <li><a href="https://github.com/actions/setup-go/commit/def8c394e3ad351a79bc93815e4a585520fe993b"><code>def8c39</code></a> Rearrange README.md, add advanced-usage.md (<a href="https://redirect.github.com/actions/setup-go/issues/724">#724</a>)</li> <li><a href="https://github.com/actions/setup-go/commit/4b73464bb391d4059bd26b0524d20df3927bd417"><code>4b73464</code></a> Fix golang download url to go.dev (<a href="https://redirect.github.com/actions/setup-go/issues/469">#469</a>)</li> <li><a href="https://github.com/actions/setup-go/commit/a5f9b05d2d216f63e13859e0d847461041025775"><code>a5f9b05</code></a> Update default Go module caching to use go.mod (<a href="https://redirect.github.com/actions/setup-go/issues/705">#705</a>)</li> <li><a href="https://github.com/actions/setup-go/commit/7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5"><code>7a3fe6c</code></a> Bump qs from 6.14.0 to 6.14.1 (<a href="https://redirect.github.com/actions/setup-go/issues/703">#703</a>)</li> <li><a href="https://github.com/actions/setup-go/commit/b9adafd441833a027479ddd0db37eaece68d35cb"><code>b9adafd</code></a> Bump actions/checkout from 5 to 6 (<a href="https://redirect.github.com/actions/setup-go/issues/686">#686</a>)</li> <li><a href="https://github.com/actions/setup-go/commit/d73f6bcfc2b419b74f47075f8a487b40cc4680f8"><code>d73f6bc</code></a> README.md: correct to actions/checkout@v6 (<a href="https://redirect.github.com/actions/setup-go/issues/683">#683</a>)</li> <li><a href="https://github.com/actions/setup-go/commit/ae252ee6fb24babc50e89fc67c4aa608e69fbf8f"><code>ae252ee</code></a> Bump <code>@actions/cache</code> to v5 (<a href="https://redirect.github.com/actions/setup-go/issues/695">#695</a>)</li> <li>Additional commits viewable in <a href="https://github.com/actions/setup-go/compare/40f1582b2485089dde7abd97c1529aa768e1baff...4a3601121dd01d1626a1e23e37211e3254c1c06c">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/setup-go&package-manager=github_actions&previous-version=5.6.0&new-version=6.4.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>	2026-06-12 22:08:01 +02:00
dependabot[bot]	92210eb7b8	deps(actions): bump taiki-e/install-action from 2.79.15 to 2.81.6 (#266 ) Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.79.15 to 2.81.6. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/taiki-e/install-action/releases">taiki-e/install-action's releases</a>.</em></p> <blockquote> <h2>2.81.6</h2> <ul> <li> <p>Update <code>prek@latest</code> to 0.4.4.</p> </li> <li> <p>Update <code>cargo-shear@latest</code> to 1.13.0.</p> </li> </ul> <h2>2.81.5</h2> <ul> <li> <p>Update <code>vacuum@latest</code> to 0.29.0.</p> </li> <li> <p>Update <code>uv@latest</code> to 0.11.19.</p> </li> <li> <p>Update <code>typos@latest</code> to 1.47.2.</p> </li> <li> <p>Update <code>mise@latest</code> to 2026.6.0.</p> </li> </ul> <h2>2.81.4</h2> <ul> <li> <p>Update <code>vacuum@latest</code> to 0.28.4.</p> </li> <li> <p>Update <code>typos@latest</code> to 1.47.1.</p> </li> <li> <p>Update <code>syft@latest</code> to 1.45.0.</p> </li> <li> <p>Update <code>cargo-neat@latest</code> to 0.4.0.</p> </li> <li> <p>Update <code>cargo-mutants@latest</code> to 27.1.0.</p> </li> </ul> <h2>2.81.3</h2> <ul> <li> <p>Update <code>vacuum@latest</code> to 0.28.3.</p> </li> <li> <p>Update <code>uv@latest</code> to 0.11.18.</p> </li> <li> <p>Update <code>trivy@latest</code> to 0.71.0.</p> </li> </ul> <h2>2.81.2</h2> <ul> <li> <p>Update <code>mise@latest</code> to 2026.5.18.</p> </li> <li> <p>Update <code>cargo-semver-checks@latest</code> to 0.48.0.</p> </li> </ul> <h2>2.81.1</h2> <ul> <li> <p>Update <code>cargo-no-dev-deps@latest</code> to 0.2.24.</p> </li> <li> <p>Update <code>cargo-hack@latest</code> to 0.6.45.</p> </li> </ul> <h2>2.81.0</h2> <ul> <li> <p>Support <code>convco</code>. (<a href="https://redirect.github.com/taiki-e/install-action/pull/1831">#1831</a>, thanks <a href="https://github.com/graelo"><code>@graelo</code></a>)</p> </li> <li> <p>Support <code>docgarden</code> (<a href="https://redirect.github.com/taiki-e/install-action/pull/1830">#1830</a>, thanks <a href="https://github.com/jesse-black"><code>@jesse-black</code></a>)</p> </li> <li> <p>Update <code>vacuum@latest</code> to 0.28.0.</p> </li> <li> <p>Update <code>cargo-binstall@latest</code> to 1.19.1.</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md">taiki-e/install-action's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <p>All notable changes to this project will be documented in this file.</p> <p>This project adheres to <a href="https://semver.org">Semantic Versioning</a>.</p> <!-- raw HTML omitted --> <h2>[Unreleased]</h2> <h2>[2.81.10] - 2026-06-11</h2> <ul> <li> <p>Update <code>tombi@latest</code> to 1.1.3.</p> </li> <li> <p>Update <code>release-plz@latest</code> to 0.3.159.</p> </li> <li> <p>Update <code>cosign@latest</code> to 3.1.1.</p> </li> </ul> <h2>[2.81.9] - 2026-06-10</h2> <ul> <li> <p>Update <code>wasm-bindgen@latest</code> to 0.2.123.</p> </li> <li> <p>Update <code>tombi@latest</code> to 1.1.2.</p> </li> <li> <p>Update <code>parse-changelog@latest</code> to 0.6.17.</p> </li> <li> <p>Update <code>just@latest</code> to 1.52.0.</p> </li> <li> <p>Update <code>gungraun-runner@latest</code> to 0.19.2.</p> </li> <li> <p>Update <code>cargo-binstall@latest</code> to 1.20.0.</p> </li> </ul> <h2>[2.81.8] - 2026-06-08</h2> <ul> <li> <p>Update <code>vacuum@latest</code> to 0.29.2.</p> </li> <li> <p>Update <code>parse-dockerfile@latest</code> to 0.1.7.</p> </li> <li> <p>Update <code>mise@latest</code> to 2026.6.1.</p> </li> <li> <p>Update <code>cargo-shear@latest</code> to 1.13.1.</p> </li> </ul> <h2>[2.81.7] - 2026-06-06</h2> <ul> <li> <p>Update <code>wasmtime@latest</code> to 45.0.1.</p> </li> <li> <p>Update <code>vacuum@latest</code> to 0.29.1.</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/taiki-e/install-action/commit/59012be0884e296ca2da49b530610e72c49039ad"><code>59012be</code></a> Release 2.81.6</li> <li><a href="https://github.com/taiki-e/install-action/commit/52d2b0721d1d96983ea68305ea47cf412c2cb542"><code>52d2b07</code></a> Update <code>prek@latest</code> to 0.4.4</li> <li><a href="https://github.com/taiki-e/install-action/commit/eeedd6ad125e98661ca2977b004703515f466511"><code>eeedd6a</code></a> Update <code>cargo-shear@latest</code> to 1.13.0</li> <li><a href="https://github.com/taiki-e/install-action/commit/f23697a9b80ca29d330c6f9063d9df132e8be880"><code>f23697a</code></a> Update cargo-audit manifest</li> <li><a href="https://github.com/taiki-e/install-action/commit/4bc351f7f2614e48088386e2a0ad917ca3a7e4ba"><code>4bc351f</code></a> Release 2.81.5</li> <li><a href="https://github.com/taiki-e/install-action/commit/ee19c896b554e8b0244999a8559d4eaecf29da0c"><code>ee19c89</code></a> Update <code>vacuum@latest</code> to 0.29.0</li> <li><a href="https://github.com/taiki-e/install-action/commit/026a7c19d8cde560882d2f6a1057690e982d4d70"><code>026a7c1</code></a> Update <code>uv@latest</code> to 0.11.19</li> <li><a href="https://github.com/taiki-e/install-action/commit/73ae273667d96854ff27b31a096a2eff0076704b"><code>73ae273</code></a> Update <code>typos@latest</code> to 1.47.2</li> <li><a href="https://github.com/taiki-e/install-action/commit/afcf03672edd439d42ab0d5d07c5254be5b35577"><code>afcf036</code></a> Update <code>mise@latest</code> to 2026.6.0</li> <li><a href="https://github.com/taiki-e/install-action/commit/cde8c9e634f4a17bc06b61413ac0ef75450eac46"><code>cde8c9e</code></a> Release 2.81.4</li> <li>Additional commits viewable in <a href="https://github.com/taiki-e/install-action/compare/0fd46367812ee04360509b4169d9f659d6892bb2...59012be0884e296ca2da49b530610e72c49039ad">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=taiki-e/install-action&package-manager=github_actions&previous-version=2.79.15&new-version=2.81.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>	2026-06-12 21:54:06 +02:00
kingchenc	32e18cb3a3	feat(r): getting-started vignette + sample_ohlcv dataset (#262 ) Fills the two empty r-universe tabs (Articles, Datasets) for the R package and gives R users a runnable onboarding path. ## What - `vignettes/getting-started.Rmd` — Articles tab. Walks through batch vs streaming (and that they're equivalent), multi-output MACD, candle ATR, and `reset()`, all over the bundled sample series. Built strictly from the already-proven README quick-start + golden-test API (`Sma`/`Ema`/`Rsi`/`Atr`/`MacdIndicator`, `batch`/`update`/`reset`) — no new indicator logic. - `data/sample_ohlcv.rda` (+ `data-raw/sample_ohlcv.R` generator) — Datasets tab. A deterministic, seeded synthetic daily OHLCV series (250 rows × `date/open/high/low/close/volume`); documented via `R/data.R` + `man/sample_ohlcv.Rd`. `LazyData: true` → available right after `library(wickra)`. - `DESCRIPTION` — `Suggests: knitr, rmarkdown`, `VignetteBuilder: knitr`, `LazyData: true`. - `ci.yml` — the R job now knits the vignette (executes its R chunks, no pandoc needed) so a broken example is caught in CI before r-universe / CRAN `R CMD check`. The main job otherwise only `R CMD INSTALL`s. ## Verified locally (R 4.6.0 + Rtools45) - Package installs with the dev C-ABI override; dataset moves to the lazyload DB. - Vignette knits cleanly — every chunk runs, `batch == streaming` holds, MACD/ATR/RSI produce sensible values. ## Notes - No version bump — metadata/docs only; rides the next release. Merging triggers an r-universe rebuild → Articles + Datasets populate and (now that `support@wickra.org` is verified) the maintainer avatar resolves. - `data-raw/` is `.Rbuildignore`d (generator, not shipped). The `.rda` is XZ-compressed (~3 KB). Not merging — for review.	2026-06-11 21:44:56 +02:00
kingchenc	20c0002f8e	ci: cap job runtimes and auto-retry the flaky Node test step (#252 ) ## Problem A Node test job wedged on a macOS runner: the Run Node tests step (`node --test`) hung for over an hour while the identical tests passed in ~1.5 min on every other runner (Node 20 macOS same run: 1m46s; Node 18 macOS on a sibling PR: 1m34s). It is a one-off stuck process — the macOS analogue of the documented `setup-node` Windows CDN flake — not a real Node 18 vs 20 difference. No job in `ci.yml` set any `timeout-minutes`, so a hung step runs toward GitHub's 6h default before the platform kills it. ## Changes - Job-level `timeout-minutes: 20` backstop on all 15 jobs. The slowest real job is ~5 min, so 20 min is generous headroom (survives cold-cache spikes) while turning a 6h hang into a 20-min fail. The clock counts execution time only — queued/waiting time does not count against it. - `Run Node tests` wrapped in `nick-fields/retry` (SHA-pinned, v4.0.0): a hung attempt is killed after 6 min and retried once (`timeout_minutes: 6`, `max_attempts: 2`), so a one-off wedge self-heals without a manual re-run. Normal run is well under a minute; worst case 2×6 min stays under the 20-min job backstop. ## Notes - New SHA-pinned third-party action (`nick-fields/retry@ad98453…` = v4.0.0) — satisfies the SHA-pin convention; `zizmor` runs on this PR. - `ci.yml` validated as well-formed YAML; all 15 jobs confirmed to carry a job-level timeout.	2026-06-11 03:27:05 +02:00
kingchenc	b06ce2678a	Restructure the Go binding for self-contained distribution (#236 ) ## Problem Plain `go get` + `go build` of the Go binding never worked as a dependency: - cgo `CFLAGS` pointed at `${SRCDIR}/../c/include` — the parent dir is outside the Go module, so a proxy-fetched module has no header. - the library under `./lib` was git-ignored and never shipped; the README told users to `cargo build` it from the workspace, which only works inside a clone, not from the read-only module cache. cgo has no build hook and Go has no registry, so the only way a consumer's `go get`+build can find the lib is for it to be committed inside the module the consumer pulls. Per the design decision, that module is a separate `wickra-go` repo (keeps this repo free of committed binaries), populated by the release pipeline — this PR is the in-repo restructure that makes that possible. ## Changes - Vendor the header at `bindings/go/include/wickra.h` (committed copy of `bindings/c/include/wickra.h`); `CFLAGS` → `-I${SRCDIR}/include`. A CI drift check fails if the copy goes stale. - Per-platform libraries: cgo `LDFLAGS` become per `GOOS`/`GOARCH`, linking `${SRCDIR}/lib/<goos>_<goarch>/`. - CI stages the host library into `lib/<goos>_<goarch>/` (`RUNNER_OS`/`RUNNER_ARCH` — note `macos-latest` is arm64) and exports `WICKRA_GO_LIBDIR` for the Windows PATH; libraries stay git-ignored here. - README: install via the `wickra-go` module + a contributor build section. ## Validation - Local windows/amd64: `gofmt` clean, `go vet`, `go build`, `go test` all green against the staged library + vendored header. - Linux/macOS arches → the 3-OS `Go on …` CI job. Follow-up (Stage 2, separate): create `wickra-lib/wickra-go` + a `release.yml` mirror job (source + 6 platform libs → `lib/<goos>_<goarch>/`, commit + tag), and point the docs at the new import path. Part of the self-contained gap (`todo-11`).	2026-06-09 23:06:16 +02:00
kingchenc	5b7523265c	Make the R binding self-contained (fetch the C ABI at install time) (#235 ) ## Problem The R package built only inside the dev/CI workspace. `src/Makevars` and `configure.win` hard-required `WICKRA_INCLUDE_DIR` / `WICKRA_LIB_DIR` pointing at a pre-built `libwickra` (`configure.win` literally `: "${WICKRA_LIB_DIR:?...}"`), and there was no Unix `configure`. So r-universe and any plain `install.packages` / `install_github` failed — R had no working end-user install path. ## Fix Fetch the prebuilt `wickra-c-<triple>.tar.gz` release asset matching the package version at install time and bundle the library into the package (same outcome as the C# / Java bindings, which bundle per-platform native libs): - New POSIX `configure` (the Unix hook R lacked): detect OS/arch → triple, download + `untar` via base R (no curl/wget system dep), stage `wickra.h` + `libwickra.{so,dylib}` into `src/`, generate `src/Makevars` from `Makevars.in` with an rpath (`$ORIGIN` Linux, `@loader_path` + `install_name_tool` macOS) so the bundled lib resolves post-install. - `configure.win`: drop the hard `WICKRA_LIB_DIR` requirement; download the Windows triple when unset, then keep the existing `wickra_abi.dll` rename + `objdump`/`dlltool` import-lib dance (sourcing the dll/header from the asset). - `install.libs.R` also bundles `libwickra.dylib` (macOS); the `.so`/`.dll` globs already covered Linux/Windows. - `WICKRA_INCLUDE_DIR`/`WICKRA_LIB_DIR` stay as an optional dev override. - CI (3 OS) keeps building against the locally built C ABI (version-independent — avoids the chicken-egg of downloading the in-flight version) but no longer exports `LD_LIBRARY_PATH`/`DYLD_LIBRARY_PATH`, so it now verifies the bundled rpath — the real self-contained path users and r-universe get. `Makevars` is now generated from `Makevars.in`; `SystemRequirements` + ignore/attributes files updated. ## Validation - The Windows `objdump`/`dlltool` import-lib dance was smoke-tested locally against the real v0.7.9 asset (2412 `wickra_` exports → import lib built). - Linux/macOS rpath bundling can't be tested on this Windows host → the 3-OS `r` CI job is the gate (now without the loader-path mask). - Follow-up (separate, after release): set up `wickra-lib/wickra-lib.r-universe.dev` (`packages.json` → `bindings/r`). Closes the R half of the self-contained-distribution gap (`todo-10`).	2026-06-09 22:11:50 +02:00
kingchenc	167f7b3ffe	Add the Java binding over the C ABI hub (Panama/FFM) (#233 ) Adds a Java binding (`bindings/java`) over the C ABI hub — the fourth language stecker after C#, Go and R, reaching the hub through the Java Foreign Function & Memory API (Panama, `java.lang.foreign`, final in Java 22) rather than JNI or jextract. ## What's here - `bindings/java` — a Maven module (`org.wickra:wickra`) exposing all 514 indicators as idiomatic `AutoCloseable` classes. The downcall handles (`internal/NativeMethods.java`), the per-indicator wrappers and the output records are generated from `bindings/c/include/wickra.h` (same eight-archetype taxonomy as the C#/Go/R generators: scalar/batch, multi-output, bars, profile, values-profile, array-input). The opaque handle is a `MemorySegment` freed by a registered `java.lang.ref.Cleaner` action; multi-output returns a `record` (`null` at warmup), bars a `record[]`, profiles a record with a trailing `double[]`. The hand-written `WickraNative` resolves the native library (a bundled per-platform copy, or a `target/release` fallback for local development) and validates it against a sentinel symbol. repr(C) struct offsets are computed in the generator so the FFM reads land on the exact bytes. - `examples/java` — the full example suite mirroring C/C#/Go/R: streaming, backtest, multi_timeframe, parallel_assets (parallel streams), three strategies, and `FetchBtcusdt`/`LiveBinance`. - CI — a `java` job builds the C ABI library, sets up JDK 22 (Temurin, with a CDN-flake retry), runs the archetype test suite and the seven offline examples on Linux, macOS and Windows. - Release — a gated `java-publish` job (skipped until the `JAVA_PUBLISH_ENABLED` repository variable is set) stages the native libraries from the `wickra-c-<triple>.tar.gz` assets into the binding's resources and deploys to Maven Central with GPG signing. Independent of the GitHub-release job, like the NuGet job. - Docs — Java added to the README languages table, project layout, building/testing and comparison table, CONTRIBUTING, ARCHITECTURE, the examples index, the issue/PR templates, the About-description template, and the other binding READMEs. ## Requirements Java 22+ (the FFM API is final since Java 22). The binding requires `--enable-native-access=ALL-UNNAMED` at runtime; the test and example runners pass it automatically. No Rust crate or `Cargo.toml` change — the Java binding is standalone and additive. The generated `*.java` are committed (like the node `index.js`/`index.d.ts`); the generator stays private.	2026-06-09 20:30:29 +02:00
kingchenc	b7ef63400d	Add the R binding over the C ABI hub (#230 ) Adds an R binding (`bindings/r`) over the C ABI hub — the third language stecker after C# and Go, reaching the hub through R's native `.Call` interface (not extendr). ## What's here - `bindings/r` — an R package exposing all 514 indicators as constructors that return a `wickra_indicator` object with generic `update`/`batch`/`reset` methods. The C glue (`src/wickra.c`) and R wrappers (`R/indicators.R`) are generated from `bindings/c/include/wickra.h` (same archetype taxonomy as the C#/Go generators: scalar/batch, multi-output, bars, profile, profile-values, array-input). The opaque handle is an R external pointer freed by a registered finalizer; multi-output returns a named vector (`NA` at warmup), bars a matrix, profiles a list. - `examples/r` — the full example suite mirroring C/C#/Go: streaming, backtest, multi_timeframe, parallel_assets (`mclapply`), three strategies, and `fetch_btcusdt`/`live_binance`. - CI — an `r` job builds the C ABI library, installs the package, runs the `testthat` suite and the offline examples on Linux, macOS and Windows (`R CMD check` is clean: 0 warnings, 0 notes). - Docs — R added to the README languages table, project layout, building/testing, CONTRIBUTING binding table + regenerate note, ARCHITECTURE, examples index, issue/PR templates, the About-description template, and the other binding READMEs. ## Linking / distribution The package compiles a thin `.Call` glue layer against the prebuilt C ABI library (header via `WICKRA_INCLUDE_DIR`, library via `WICKRA_LIB_DIR`). On Windows the package's own `wickra.dll` would collide with the C ABI's `wickra.dll`, so `configure.win` stages a renamed copy (`wickra_abi.dll`) and builds an import library referencing it; `install.libs.R` bundles the DLL and `.onLoad` puts it on the load path. On Linux/macOS the rpath locates the shared library. No `release.yml` change — R is distributed via r-universe / source install (gated). No Rust crate or `Cargo.toml` change — the R package is standalone and additive.	2026-06-09 19:18:40 +02:00
kingchenc	23d636fd97	Add the Go binding over the C ABI hub (#228 ) Adds a Go binding (`bindings/go`) over the C ABI hub — the second language stecker after C#. ## What's here - `bindings/go` — a cgo binding exposing all 514 indicators as idiomatic Go types with `New<Indicator>` constructors and `Update`/`Batch`/`Reset`/`Close` methods. The wrappers in `indicators_gen.go` are generated from `bindings/c/include/wickra.h` (same archetype taxonomy as the C# generator: scalar/batch, multi-output, bars, profile, profile-values, array-input). Opaque handles are freed by `Close()` with a `runtime.SetFinalizer` backstop; pointer arguments are caller-owned, panics never cross the boundary. - `examples/go` — the full example suite mirroring C/C#: streaming, backtest, multi_timeframe, parallel_assets (goroutine fan-out), three strategies, and `fetch_btcusdt`/`live_binance`. - CI — a `go` job builds the C ABI library, stages it, and runs `gofmt`/`go vet`/`go test` plus the offline examples on Linux, macOS and Windows. - Docs — Go added to the README languages table, project layout, building/testing, CONTRIBUTING binding table + regenerate note, ARCHITECTURE, examples index, issue/PR templates, the About-description template, and the other binding READMEs. ## Linking / distribution The binding links the prebuilt C ABI library via cgo (`libwickra.so`/`.dylib`/`wickra.dll` staged under `bindings/go/lib`, gitignored). The native libraries are already shipped per target triple by the existing `c-abi-build` release job; distribution is via the subdirectory module tag `bindings/go/vX.Y.Z` (gated), so `release.yml` needs no new publish job. No Rust crate or `Cargo.toml` change — the Go module is standalone and additive. Not for merge yet (gated, per request).	2026-06-09 17:33:37 +02:00
kingchenc	91f6f67257	Add C# (.NET) binding over the C ABI hub (#226 ) The first language stecker on the C ABI hub: a .NET binding exposing all 514 indicators as idiomatic `IDisposable` classes, generated from `wickra.h`. ## What's here - `bindings/csharp/` — the `Wickra` .NET 8 package. `[LibraryImport]` source-generated P/Invoke (`NativeMethods.g.cs`) plus idiomatic wrappers (`Indicators.g.cs`), both generated from the committed `bindings/c/include/wickra.h`. The binding owns no indicator maths — it only marshals types across the C ABI. - Marshalling, verified end-to-end against the native library. Opaque handles cross as `nint` kept alive per call via a `SafeHandle`; `bool` as `[MarshalAs(U1)]` (Rust `bool` is one byte); a self-correcting `DllImportResolver` validates the loaded library actually exports the Wickra ABI. Tests cover one representative per FFI archetype (scalar, candle, pairwise, multi-output, bars, profile, values-profile, order-book / array-input) plus exact Sma reference values. - NuGet packaging — `dotnet pack` produces `Wickra.<version>.nupkg`; the release pipeline stages prebuilt native libraries under `runtimes/<rid>/native/` for six target triples (win/linux/osx × x64/arm64). - `examples/csharp/` — nine examples mirroring `examples/c/`: streaming, backtest, multi_timeframe, parallel_assets, three strategies, and fetch_btcusdt + live_binance. - CI — a `csharp` job on the three OSes builds the C ABI, tests the binding, and runs the offline examples. Release — a gated `csharp-publish` job packs and pushes to NuGet (gated on `NUGET_API_KEY`, independent of the GitHub-release job so a C# hiccup never blocks the C/C++ asset release). - Docs consistency wave — README, CONTRIBUTING, CHANGELOG, examples/README, the issue / PR templates, `sync-about.yml`, and `.gitattributes`. The native Python / Node / WASM bindings and the C ABI are untouched; this is additive. Publishing to NuGet stays gated behind the release tag and the secret.	2026-06-09 14:32:05 +02:00
kingchenc	91e05e3c26	C ABI hub crate (bindings/c) foundation (#222 ) ## What Introduces `wickra-c` — a `cdylib` + `staticlib` that exposes the Rust core over a C ABI. This is the hub every C-capable language (C, C++, Go, C#, Java, R) links against, instead of re-wiring each indicator natively. The native Python/Node/WASM bindings are untouched; this is purely additive, for ecosystems without first-class Rust tooling. ## Scope (foundation slice) This PR deliberately validates the whole pipeline end to end with one indicator (SMA) before scaling to all 514, so the CI / cross-OS / header-drift mechanics are proven green first. - Opaque `mut T` handles; `wickra_<ind>_{new,update,batch,reset,free}`. - NaN sentinel for warmup / NULL handles; caller-owned batch buffers; every function NULL-safe. - cbindgen generates and commits `bindings/c/include/wickra.h` with opaque handle typedefs. - A C smoke example (`examples/c/`) links the header + compiled library and runs (CMake + ctest). - A `c-abi` CI job builds the library and runs the smoke test on Linux, macOS and Windows, plus a header drift check on Linux. ## Notes - The per-indicator FFI blocks are plain `#[no_mangle]` functions, not* a macro: cbindgen cannot see macro-generated functions on stable Rust (macro expansion needs nightly), so the blocks are written literally and will be generated mechanically by the ScriptHelpers `capi` wrapper in a follow-up (same model as the committed-but-generated Node `index.js`). - `bindings/c` cannot inherit the workspace `forbid(unsafe_code)` lint (the C boundary needs raw pointers), so it mirrors every workspace lint and only relaxes `unsafe_code`. The Rust core stays `unsafe`-forbidden. ## Follow-ups (separate PRs) - ScriptHelpers `capi` generator + wire the scalar family (~235). - Hand-written blocks for multi-output / custom-input / bars (~279). - Docs consistency wave (README / docs / webpage: Python·Node·WASM·Rust → +C). - Release wiring (native-lib matrix + header/lib GH-release assets) — gated.	2026-06-09 02:07:03 +02:00
kingchenc	d16df1e224	ci: warm the cargo registry with backoff so a DNS blip can't fail clippy (#210 ) ## Problem A macOS runner on #206 failed the Rust job's clippy step with: ``` Updating crates.io index error: failed to get `rayon` as a dependency ... download of config.json failed [6] Couldn't resolve host name (Could not resolve host: index.crates.io) ``` A pure transient DNS blip — unrelated to the change (a docs-only PR). `CARGO_NET_RETRY=10` only does fast in-process retries; a longer DNS outage outlasts them, so the very first cargo step's crates.io index fetch fails the whole job. ## Fix Add a Warm cargo registry step right after the cache restore in the `rust`, `clippy-bindings` and `msrv` jobs. It runs `cargo fetch` in a 5-attempt loop with real backoff (20/40/60/80s sleeps) so the dependency graph is pulled once, patiently, riding out a multi-second DNS outage that cargo's rapid retries can't. The later clippy/build/test steps then resolve from the warmed local cache. Mirrors the existing inline retry pattern already used for setup-node/setup-python CDN flakes. Can be extended to the coverage/python/wasm/node jobs if they ever hit the same blip.	2026-06-08 02:22:26 +02:00
kingchenc	73415cd2dc	ci: zizmor security hardening (#133 ) * ci: pass ref context through env in release tag step zizmor flagged the "Resolve target tag" step in release.yml for template-injection: github.event_name / github.ref / github.ref_name were interpolated directly into the shell script. On a tag push the tag name is attacker-influenceable, so a crafted tag could inject commands. Move all three context values into the step env and reference them as shell variables instead. Verified with zizmor 1.16.3: template-injection findings on release.yml drop from 2 to 0. * ci: accept release.yml build caches via zizmor config The release pipeline restores Swatinem/rust-cache and actions/setup-node caches as a deliberate optimisation. zizmor flags all eight under cache-poisoning because release.yml publishes to crates.io / PyPI / npm. The caches are maintainer-controlled and the restore speedup is kept on purpose, so accept the finding via a zizmor config ignore for release.yml rather than running cache-free release builds. (Six of the eight are actions/setup-node, reported at Low confidence.) Adds .github/zizmor.yml; release.yml now reports 0 high findings. * ci: drop persisted checkout credentials on read-only jobs zizmor's artipacked audit flags every actions/checkout that keeps the default persisted credential: the token is written to the runner's .git/config, where it can leak if a later step packs .git into an uploaded artifact, or be read by another step in the same job. Set persist-credentials: false on the 20 checkouts whose jobs never push or authenticate to git (build/test/clippy/msrv/coverage/supply-chain/ fuzz/python/wasm/node in ci.yml, plus bench.yml, codeql.yml, the seven release.yml build/publish jobs, and sync-metadata.yml). The publish and release jobs authenticate to crates.io / npm / PyPI / the GitHub API with their own tokens, not persisted git credentials, so this is safe. sync-about.yml genuinely pushes the indicator-count fix-up to the PR branch, so it keeps its credential and is accepted via .github/zizmor.yml. zizmor artipacked for the repo drops to 0 (0 high, 0 medium remaining).	2026-06-02 02:08:40 +02:00
kingchenc	5b23b36261	ci: pin CI dependency installs by hash (Scorecard PinnedDependencies) (#114 ) * ci: use npm ci instead of npm install for reproducible installs Pins the node binding dependency install to the committed package-lock.json integrity hashes (OpenSSF Scorecard PinnedDependencies). npm ci installs strictly from the lockfile; npm install could resolve newer patch versions. Covers ci.yml and both release.yml node steps. * ci: hash-pin Python dev tooling in ci.yml (Scorecard #19) Replaces the unpinned 'pip install maturin pytest numpy hypothesis' with a hash-locked '--require-hashes -r' install (OpenSSF Scorecard PinnedDependencies). Two lock files are needed because numpy publishes no single release with wheels for both cp39 and cp313 (<=2.0.2 has cp39 only, >=2.1 drops cp39): ci-dev-py39.txt numpy 2.0.2 (Python 3.9, + tomli/exceptiongroup) ci-dev-py3.txt numpy 2.4.6 (Python 3.10+) The step selects the file by matrix.python-version under shell: bash. Both are generated from ci-dev.in via uv (scripts/update-lockfiles.sh, added next). * ci: hash-pin Python deps in bench.yml (Scorecard #16) Replaces the unpinned 'pip install maturin numpy pandas talipp finta' with a hash-locked '--require-hashes -r .github/requirements/bench.txt' install. bench.yml runs on a single Python version (3.11), so one lock file (generated from bench.in via uv) is sufficient. * build: add scripts/update-lockfiles.sh to regenerate all lockfiles One command refreshes every committed lockfile across languages: Cargo.lock and fuzz/Cargo.lock (cargo update), the Node binding package-lock.json, and the hash-pinned Python requirements under .github/requirements/ (uv pip compile --generate-hashes). Uses uv for the Python locks so a target Python version's hashed transitive closure can be resolved without that interpreter installed (needed for the numpy cp39/cp313 split); bootstraps uv if absent. .gitattributes pins .sh to LF so the script stays runnable on Linux/macOS. ci: split ci-dev requirements per Python version + Dependabot rehash Splits the single ci-dev.in into ci-dev-py39.in (numpy <2.1, the last series with cp39 wheels) and ci-dev-py3.in (3.10+), giving a 1:1 .in->.txt layout. The cap keeps Python 3.9 permanently installable and stops Dependabot from proposing 3.9-breaking numpy bumps. Adds a Dependabot pip entry on /.github/requirements so the hash-locked tooling is kept current automatically; the canonical manual refresh stays scripts/update-lockfiles.sh. Only the '# via -r' provenance lines in the .txt change; no package versions or hashes move. * ci: cache pip and npm downloads in the PR-loop jobs Adds setup-python cache: pip (ci.yml python matrix + bench.yml, keyed on the hash-locked requirements) and setup-node cache: npm (ci.yml node job, keyed on bindings/node/package-lock.json), on both the primary and retry setup steps. Scoped to jobs that actually install dependencies; the examples-smoke and clippy-bindings jobs install nothing and are left uncached. release.yml is intentionally left out: it runs only on tag push (not the PR loop) and is the publish-critical path, so no caching is added there. * docs: document hash-pinned requirements and update-lockfiles.sh Updates the lockfile-policy table: the bindings/python row no longer claims CI installs tooling unpinned, and a new .github/requirements row documents the hash-locked CI/bench tooling and the per-Python-version ci-dev split. Adds a paragraph pointing contributors at scripts/update-lockfiles.sh (uv-based, self-bootstrapping) as the canonical lockfile refresh. * docs: changelog entry for hash-pinned CI dependency installs	2026-06-01 17:58:31 +02:00
kingchenc	99af5f8ee1	ci: retry transient registry/DNS flakes at the cargo/npm/pip tool level (#105 ) The v0.4.0-era CI failure was a runner network blip — `napi build` invokes cargo, whose fetch of index.crates.io hit "Could not resolve host: index.crates.io" and failed the Node-on-macOS job, forcing a manual re-run. The earlier flake-hardening (setup-node/setup-python + rust-cache retries) only covered toolchain download and cache restore, not the registry fetches inside the actual build/publish steps. Set tool-level network retries as workflow env so every cargo/napi/maturin/ wasm-pack/npm/pip invocation in every job inherits them — including the nested cargo calls inside napi/maturin/wasm-pack: - CARGO_NET_RETRY=10 (default 3): cargo classes DNS-resolve / connect / timeout errors as spurious and retries with backoff; 10 attempts ride out a transient blip instead of failing the job. - CARGO_NET_GIT_FETCH_WITH_CLI=true: more robust git-dep fetches. - npm_config_fetch_retries=5 / maxtimeout=120s: npm ci/install registry retries. - PIP_RETRIES=5 / PIP_DEFAULT_TIMEOUT=120: pip install resilience. Applied to ci.yml, release.yml and bench.yml (the workflows that build). No more manual re-runs for transient registry flakes.	2026-06-01 04:08:18 +02:00
kingchenc	ebddc5e376	ci: set least-privilege top-level token permissions (P21.1b) (#103 ) The auto-injected GITHUB_TOKEN defaulted to write-all in ci.yml, bench.yml and release.yml (no top-level permissions block), and codeql.yml declared its scopes only at job level. Add a top-level `permissions: contents: read` to all four so the token starts read-only and only the jobs that genuinely write through it raise the scope: - release.yml: github-release keeps contents: write; node-/wasm-publish and attestations keep their id-token / attestations: write blocks. The cargo/python/node publish jobs push to crates.io/PyPI/npm via their own registry secrets, not the GITHUB_TOKEN, so read-only is correct for them. - codeql.yml: analyze keeps security-events: write (job level). - ci.yml / bench.yml: no job writes back to the repo (coverage uploads via CODECOV_TOKEN; bench only uploads an artifact), so no job override is needed. sync-about.yml already had a top-level block but at contents: write; demote the top level to read and move contents: write down to the single `sync` job (the PR-head counter push is the only GITHUB_TOKEN write). The cross-repo About/docs/webpage/org writes are unaffected — they run through the fine-grained ABOUT_SYNC_TOKEN, which the permissions key does not govern. Raises OpenSSF Scorecard Token-Permissions from 0 toward 10.	2026-06-01 02:01:31 +02:00
kingchenc	01dd08714b	ci: harden workflows against network/CDN flakes (resilient cache + setup retries) (#101 )	2026-06-01 01:07:56 +02:00
kingchenc	21c86f348f	examples + bindings: Node/WASM strategy parity + test/benchmark parity (P2 + P3) (#81 ) * examples(node): add RSI mean-reversion strategy Node counterpart of strategy_rsi_mean_reversion.{py,rs}: RSI(14) < 30 long, > 70 exit, 0.1% fees, hourly BTCUSDT. Output verified byte-identical to the Rust reference (37 trades W24/L13, -17.84% return, 46.89% max drawdown). * examples(node): add MACD + ADX trend-filter strategy Node counterpart of strategy_macd_adx.{py,rs}: MACD(12,26,9) histogram crossover entries gated by ADX(14) > 20, hourly BTCUSDT, 0.1% fees. Output verified byte-identical to the Rust reference (246 trades W90/L156, -47.19% return, 53.75% max drawdown). * examples(node): add Bollinger-squeeze breakout strategy Node counterpart of strategy_bollinger_squeeze.{py,rs}: enter on a fresh 180-bar Bollinger-bandwidth low + close above the upper band, exit on a 2ATR(14) stop or upper-band collapse, daily BTCUSDT, 0.1% fees. Output verified byte-identical to the Rust reference (1 trade, -7.82% return, 13.01% max drawdown). examples(wasm): add RSI mean-reversion strategy demo Browser counterpart of strategy_rsi_mean_reversion.{py,js,rs}: RSI(14) < 30 long, > 70 exit, 0.1% fees, summary table. Same signal/fill/PnL/equity loop as the runtime-verified Node example; loads via the established wickra_wasm.js init + fetch-CSV pattern. (wasm32 build runs in CI.) * examples(wasm): add MACD + ADX trend-filter strategy demo Browser counterpart of strategy_macd_adx.{py,js,rs}: MACD(12,26,9) histogram crossover gated by ADX(14) > 20, hourly BTCUSDT, 0.1% fees. Logic identical to the runtime-verified Node example; standard wickra_wasm.js init + fetch-CSV loader. (wasm32 build runs in CI.) * examples(wasm): add Bollinger-squeeze breakout strategy demo Browser counterpart of strategy_bollinger_squeeze.{py,js,rs}: fresh 180-bar Bollinger-bandwidth low + upper-band breakout, 2ATR(14) stop, daily BTCUSDT, 0.1% fees. Logic identical to the runtime-verified Node example; standard wickra_wasm.js init + fetch-CSV loader. (wasm32 build runs in CI.) ci: add examples syntax-smoke job (P2.3) The Rust examples are built by 'cargo build -p wickra-examples --bins'; the Node, browser-WASM and Python examples had no build gate. New job parse-checks every examples/{node,wasm}/.js, extracts and node --checks each WASM .html module script, and python -m py_compile's every examples/python/.py — so a broken example edit fails CI instead of landing silently. * docs(examples): list the new Node + WASM strategy examples Add the three Node strategy scripts and three WASM strategy demos to the examples README tables, bringing Node and WASM to parity with the existing Rust and Python strategy rows. * chore(examples): refresh examples/node lockfile for the linked wickra binding npm install rewrote the file: dependency snapshot of the local wickra binding that the examples link against (version 0.1.4 -> 0.3.1, license + engines fields), which had gone stale in the committed lockfile. * test(node): add input-validation suite Node counterpart of bindings/python/tests/test_input_validation.py: invalid constructor parameters (ATR zero period, MACD non-increasing fast/slow, BollingerBands negative multiplier, PSAR step > max, ValueArea period/pct, InitialBalance/OpeningRange zero period, Ichimoku non-increasing periods, Ehlers-family ordering) and unequal-length candle/ValueArea batch inputs all throw a JS Error. Validated against the built binding. * test(node): add indicator completeness contract Introspects every exported indicator class and asserts the full interface (update / batch / reset / isReady / warmupPeriod) plus the pre-warmup contract for zero-arg indicators, and guards that the full catalogue (>= 200 classes) is exported. Catches a new indicator wired without the standard methods, or a stale/partial native build dropping exports, with no per-indicator boilerplate. * test(wasm): broaden scalar streaming-vs-batch coverage Extend the inline wasm-bindgen-test suite with a streaming==batch check across ~70 scalar indicators spanning moving averages, momentum, volatility, statistics/regression, Ehlers/cycle and risk/performance families (previously only EMA + the candle-input group were covered per-indicator), plus four more invalid-constructor assertions. Constructor args mirror the CI-passing Node factories. Host-compiles (cargo test -p wickra-wasm --no-run); executed in CI via wasm-pack test --node. * bench(node): add indicator throughput benchmark Node counterpart of the Rust criterion benches / Python compare_libraries: measures streaming (per-tick update) and batch throughput in Mupd/s across a representative indicator set over a synthetic OHLCV series (--bars, default 200k). Dependency-free; wired as 'npm run bench'. * docs(wasm): list strategy demos + document the benchmark story Add the three new strategy demos to the WASM examples table and a Performance section: parallel_assets.html is the in-browser benchmark, with raw throughput covered by the Rust criterion / Python / Node benchmarks (the WASM engine is the same core compiled to wasm32).	2026-05-31 05:09:26 +02:00
dependabot[bot]	37e5e19b57	deps(actions): bump taiki-e/install-action from 2.79.5 to 2.79.15 (#76 ) Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.79.5 to 2.79.15. - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/taiki-e/install-action/compare/6c1f7cf125e42770ff087ea443901b487cc5471a...0fd46367812ee04360509b4169d9f659d6892bb2) --- updated-dependencies: - dependency-name: taiki-e/install-action dependency-version: 2.79.15 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-30 18:54:31 +02:00
dependabot[bot]	c189075491	deps(actions): bump EmbarkStudios/cargo-deny-action (#74 ) Bumps [EmbarkStudios/cargo-deny-action](https://github.com/embarkstudios/cargo-deny-action) from 2.0.19 to 2.0.20. - [Release notes](https://github.com/embarkstudios/cargo-deny-action/releases) - [Commits](https://github.com/embarkstudios/cargo-deny-action/compare/a531616d8ce3b9177443e48a1159bc945a099823...bb137d7af7e4fb67e5f82a49c4fce4fad40782fe) --- updated-dependencies: - dependency-name: EmbarkStudios/cargo-deny-action dependency-version: 2.0.20 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-30 18:52:23 +02:00
kingchenc	0edb9f4857	fix(bindings): clear clippy pedantic lints and lint bindings in CI (#77 ) * fix(bindings): clear clippy pedantic lints and lint bindings in CI Resolve the pedantic lints that only surfaced under a full `cargo clippy --workspace` (the CI clippy job covered only the core crates, so the Python/Node bindings drifted): - manual_midpoint: `(a + b) / 2.0` -> `f64::midpoint(a, b)` (node + python) - new_without_default: add `Default` impls for the six no-arg Node nodes - type_complexity: factor the pivot/Ichimoku return tuples into `PivotLevels` / `WoodieLevels` / `IchimokuLines` aliases (python) - many_single_char_names: allow at crate level — OHLCV batch helpers bind the conventional o/h/l/c/v column names Add a dedicated `clippy-bindings` CI job (ubuntu-only, with Python + Node toolchains) so future binding lints fail CI instead of slipping through. * ci: lint Python and Node bindings in a dedicated clippy job The main `rust` job's clippy step only covers wickra-core/wickra/ wickra-data/wickra-wasm, so pedantic lints in the PyO3/napi bindings slipped through. Add an ubuntu-only `clippy-bindings` job that provisions Python + Node (needed by the build scripts) and runs `cargo clippy -p wickra-node -p wickra-python --all-targets -- -D warnings`.	2026-05-30 18:16:21 +02:00
kingchenc	d9d3ad18aa	feat: Family 03 MACD & Price Oscillators — APO / AO-Hist / CFO / Zero-Lag MACD / Elder Impulse / STC (#41 ) * feat(apo): add Absolute Price Oscillator EMA(close, fast) - EMA(close, slow). Like MACD without the signal EMA. Defaults to (fast = 12, slow = 26); fast must be strictly less than slow. Touchpoints: apo.rs + mod.rs + lib.rs re-export, PyApo + __init__.py + test_new_indicators SCALAR + test_known_values flat reference, ApoNode + index.d.ts/index.js + indicators.test.js factory + reference, WasmApo via scalar macro, scalar-fuzz target, README + CHANGELOG. * fix(apo): add PyApo + ApoNode + WasmApo bindings missed from `ec269d8` The previous APO commit (`ec269d8`) only registered APO in the Python __init__.py / Node index.js / Node index.d.ts / fuzz / tests / docs. The actual PyApo pyclass, ApoNode napi class, and WasmApo wasm class edits silently no-op'd because the underlying lib.rs files had been touched by a branch switch between Read and Edit. The bindings were therefore advertising APO from the Python module / Node package / WASM module but not actually exposing it. Fix: insert PyApo block + add_class call in bindings/python/src/lib.rs, ApoNode block in bindings/node/src/lib.rs, WasmApo macro line in bindings/wasm/src/lib.rs. cargo test workspace stays at 615 (no new tests added; the existing test_known_values + indicators.test.js references would have failed at import once the bindings rebuilt without these classes). * feat(ao-histogram): add Awesome Oscillator Histogram AO - SMA(AO, sma_period). A configurable variant of the existing AcceleratorOscillator (which fixes fast=5, slow=34, sma=5). Three parameters; defaults match Bill Williams' Accelerator. Touchpoints: awesome_oscillator_histogram.rs + mod.rs + lib.rs re-export, PyAoHist + __init__.py + test_new_indicators CANDLE_SCALAR + test_known_values flat reference, AwesomeOscillatorHistogramNode + index.d.ts/index.js + indicators.test.js factory + reference, WasmAoHist, candle-fuzz target, README + CHANGELOG. * feat(cfo): add Chande Forecast Oscillator 100 * (close - LinReg(close, period)) / close. Positive when close overshoots the linear forecast, negative when it undershoots. Holds the previous value if the close is zero (percentage form undefined). Single param period (default 14). Touchpoints: cfo.rs + mod.rs + lib.rs re-export, PyCfo + __init__.py + test_new_indicators SCALAR + test_known_values linear reference, CfoNode + index.d.ts/index.js + indicators.test.js factory + reference, WasmCfo via scalar macro, scalar-fuzz target, README + CHANGELOG. * fix(cfo): add WasmCfo binding missed from `733afd9` * feat(zero-lag-macd): add Zero-Lag MACD Classic MACD topology with ZLEMA substituted for EMA everywhere: faster reaction to trend changes at the cost of slightly noisier readings. Multi-output ZeroLagMacdOutput { macd, signal, histogram }. Three parameters (fast = 12, slow = 26, signal = 9); fast must be strictly less than slow. Touchpoints: zero_lag_macd.rs + mod.rs + lib.rs re-export, PyZeroLagMacd + __init__.py + test_new_indicators MULTI + test_known_values flat reference, ZeroLagMacdNode + ZeroLagMacdValue + index.d.ts/index.js + indicators.test.js multi factory + reference, WasmZeroLagMacd, scalar fuzz with hand-rolled drive (multi-output bypasses the f64-only helper), README + CHANGELOG. * feat(elder-impulse): add Alexander Elder Impulse System Tri-state momentum gauge: +1 (green/buy) when EMA trend and MACD histogram both rise, -1 (red/sell) when both fall, 0 (blue/neutral) on disagreement. Four parameters (ema_period, macd_fast, macd_slow, macd_signal); defaults (13, 12, 26, 9) match Elder. Internally feeds both branches on every input so they warm in parallel; needs one bar past the slowest branch to seed direction state. Touchpoints: elder_impulse.rs + mod.rs + lib.rs re-export, PyElderImpulse + __init__.py + test_new_indicators SCALAR + test_known_values neutral reference, ElderImpulseNode + index.d.ts/index.js + indicators.test.js factory + reference, WasmElderImpulse via scalar macro, scalar-fuzz target, README + CHANGELOG. * feat(stc): add Schaff Trend Cycle Doug Schaff's doubly-Stochastic-smoothed MACD. Bounded [0, 100] reading that reacts faster than MACD by extracting the percentile of MACD within a recent window, half-EMA-smoothing it, and re-stochasing the smoothed series. Four parameters (fast = 23, slow = 50, schaff_period = 10, factor = 0.5); fast must be strictly less than slow and factor must lie in (0, 1]. Output clamped to [0, 100] to absorb floating-point rounding. The stochastic stages clamp to 0 when their rolling range collapses (flat input or perfectly monotone trend), so a flat series settles deterministically at 0 after warmup. Touchpoints: stc.rs + mod.rs + lib.rs re-export, PyStc + __init__.py + test_new_indicators SCALAR + test_known_values flat reference, StcNode + index.d.ts/index.js + indicators.test.js factory + reference, WasmStc via scalar macro, scalar-fuzz target, README + CHANGELOG. * fix(stc): rename last_stc -> last_value to satisfy clippy * ci: Retry setup-node and setup-python on CDN flakes Setup-node on Windows runners and setup-python across all OSes occasionally fail with a silent hang or 5xx mid-download ("Attempting to download 18..." → fail in <1s) — pure upstream CDN flake. The fix ran on this branch's previous merge commit (`24e723f`) had to be re-triggered manually via `gh run rerun --failed`. Wrap both setup actions with continue-on-error and a follow-up retry step that waits 30s and re-runs the same setup. The retry only fires when the first attempt failed (steps.<id>.outcome == 'failure'), so a green setup costs nothing extra. The retry uses the identical pinned SHA so we still get supply-chain verification on both attempts. Applied to ci.yml (Python matrix and Node matrix). release.yml has the same setup-node / setup-python steps but is rarely re-run, so the existing manual rerun pattern stays sufficient for now. * test(zero-lag-macd): Fix MULTI dict shape mismatch + cover warmup_period ZeroLagMACD was registered in the Python MULTI dict (which asserts a (n, 2) batch shape) but actually emits (n, 3) — macd, signal, histogram — like MACD. Moved out into its own standalone test test_zero_lag_macd_streaming_matches_batch (3-tuple shape), and included in the lifecycle sweep. Mirrors the existing Alligator pattern for 3-output candle indicators. Also adds a unit test for ZeroLagMacd::warmup_period that pins both the (12, 26, 9) classic case and a small-period config — these four lines were the codecov/patch miss on PR 41.	2026-05-25 17:26:46 +02:00
kingchenc	466faddd87	feat: Family 01 Moving Averages — ALMA / McGinley / FRAMA / VIDYA / JMA / Alligator / EVWMA (#39 ) * feat(alma): add Arnaud Legoux Moving Average Gaussian-weighted moving average with configurable centre (offset in [0, 1]) and kernel width (sigma > 0). Pre-computes normalised weights at construction so each update is a single rolling window dot product. Reference: Arnaud Legoux and Dimitrios Kouzis-Loukas, 2009. Touchpoints: - crates/wickra-core: alma.rs + mod.rs + lib.rs re-export - bindings/python: PyAlma + __init__.py + test_new_indicators + test_known_values reference - bindings/node: AlmaNode + index.d.ts/index.js + indicators.test.js factory + reference value - bindings/wasm: wasm_scalar_indicator! macro - fuzz: indicator_update target covers ALMA(9, 0.85, 6.0) - crates/wickra/benches: bench_scalar entry - README + CHANGELOG: Moving Averages row + Unreleased entry * feat(mcginley): add McGinley Dynamic moving average John McGinley's self-adjusting moving average with the recurrence MD + (price - MD) / (0.6 * period * (price / MD)^4). Speeds up when price falls below the indicator and damps when price runs above the indicator. Seeded with the simple average of the first period inputs. Reference: McGinley, Technical Analysis of Stocks & Commodities, 1990. Touchpoints: - crates/wickra-core: mcginley_dynamic.rs + mod.rs + lib.rs re-export - bindings/python: PyMcGinleyDynamic + __init__.py + test_new_indicators + test_known_values reference - bindings/node: McGinleyDynamicNode (scalar macro) + index.d.ts/index.js + indicators.test.js factory + reference value - bindings/wasm: wasm_scalar_indicator! macro - fuzz: indicator_update target covers McGinleyDynamic(10) - crates/wickra/benches: bench_scalar entry - README + CHANGELOG: Moving Averages row + Unreleased entry * feat(frama): add Fractal Adaptive Moving Average Ehlers' FRAMA adapts its smoothing constant to the fractal dimension of the recent window: tight tracking in trends, heavy smoothing in chop. Uses the close-only variant where max/min over each window half drive the dimension estimate. Period must be even (default 16). Reference: Ehlers, Fractal Adaptive Moving Average, 2005. Touchpoints: - crates/wickra-core: frama.rs + mod.rs + lib.rs re-export - bindings/python: PyFrama + __init__.py + test_new_indicators + test_known_values reference (constant series + uptrend tracking) - bindings/node: FramaNode (scalar macro) + index.d.ts/index.js + indicators.test.js factory + reference value - bindings/wasm: wasm_scalar_indicator! macro - fuzz: indicator_update target covers Frama(16) - crates/wickra/benches: bench_scalar entry - README + CHANGELOG: Moving Averages row + Unreleased entry * feat(vidya): add Variable Index Dynamic Average Chande's VIDYA — an EMA whose alpha scales with \|CMO(cmo_period)\| / 100. Strong directional momentum lifts the smoothing constant toward the EMA-of-period rate; flat or choppy windows shrink it toward zero so VIDYA coasts on its previous value. Two parameters: period (14) and cmo_period (9). Reuses the existing wickra-core Cmo internally. Reference: Chande, Stocks & Commodities, 1992. Also fixes a silent gap from `d37fbd1` (feat(frama)): the PyFrama Python class wrapper and its add_class registration were dropped because the two edits hit "File has not been read yet" errors that scrolled past in a batch. Adds them here alongside VIDYA's bindings. Touchpoints (VIDYA): vidya.rs + mod.rs + lib.rs re-export, PyVidya + __init__.py + test_new_indicators + test_known_values reference, VidyaNode (manual two-param binding) + index.d.ts/index.js + indicators.test.js factory + reference, wasm_scalar_indicator! macro, fuzz target, bench, README + CHANGELOG. * feat(jma): add Jurik Moving Average Three-stage filter reconstruction of Mark Jurik's adaptive MA (the algorithm is proprietary; this is the form used by most open-source ports since the 1999 TASC article). Parameters: period (14), phase in [-100, 100] (0), power in 1..=4 (2). State is seeded by setting e0 = JMA = first input so a constant input stream is reproduced exactly. Touchpoints: jma.rs + mod.rs + lib.rs re-export, PyJma + __init__.py + test_new_indicators + test_known_values reference, JmaNode (manual three-param binding) + index.d.ts/index.js + indicators.test.js factory + reference, wasm_scalar_indicator! macro, fuzz target, bench, README + CHANGELOG. * feat(alligator): add Bill Williams Alligator Three SMMA lines (Jaw / Teeth / Lips) over the median price (high + low) / 2 with default periods 13 / 8 / 5. Multi-output indicator returning AlligatorOutput { jaw, teeth, lips }. The original chart variant shifts each line forward for display; we publish the unshifted SMMA values and leave the visual shift to the consumer. Reference: Bill Williams, Trading Chaos, 1995. Touchpoints: alligator.rs + mod.rs + lib.rs re-export, PyAlligator (Candle input, returns 3-tuple, ndarray (n, 3) batch) + __init__.py + test_new_indicators + test_known_values reference, AlligatorNode + AlligatorValue + index.d.ts/index.js + indicators.test.js multi factory + reference, WasmAlligator (manual JsValue object) + candle-fuzz target + README + CHANGELOG. * feat(evwma): add Elastic Volume-Weighted Moving Average Christian P. Fries' elastic recurrence where the smoothing weight is the bar's volume relative to the running window total: V_sum_t = sum of volumes over the last period candles EVWMA_t = ((V_sum_t - v_t) * EVWMA_{t-1} + v_t * close_t) / V_sum_t A bar whose volume is small barely moves the average; a bar that dominates the window pulls it strongly toward that bar's close. Seeded with the close of the first full window; holds its previous value if the entire window has zero volume. Reference: Fries, Wilmott Magazine, 2001. Touchpoints: evwma.rs + mod.rs + lib.rs re-export, PyEvwma (close + volume batch) + __init__.py + test_new_indicators CANDLE_SCALAR + test_known_values reference, EvwmaNode + index.d.ts/index.js + indicators.test.js candleScalar factory + reference, WasmEvwma, candle-fuzz target + README + CHANGELOG. * ci: Force local wheel install in Python jobs Use --no-index --no-deps so the Python matrix installs the freshly built wheel from dist/ and never falls back to PyPI. Previously pip sometimes picked the released 0.2.x wheel on macOS / Windows when its platform tag was a wider match than the local build, which made the job test the released package and miss any new symbols added in the PR (e.g. AttributeError: module 'wickra' has no attribute 'ALMA'). numpy is already installed by the preceding pip step, so --no-deps is safe.	2026-05-25 15:01:14 +02:00
kingchenc	3fcf2094f1	ci(wasm): install wasm-pack via taiki-e prebuilt instead of jetli's stale 0.10 jetli/wasm-pack-action@v0.4.0 with no version: input installs whatever wasm-pack the action's bundled installer fetches — currently a ~0.10.x release whose 'build' subcommand does not yet accept --features. Our build invocation 'wasm-pack build … --features panic-hook' now fails with error: Found argument '--features' which wasn't expected, or isn't valid in this context USAGE: wasm-pack build --release --target <target> even though that exact command worked on past runs where the action happened to install a newer wasm-pack. (The bundler-target release.yml job passed for v0.2.1 only because it shared the same cached install on that runner.) wasm-pack's --features top-level flag has been stable since 0.12.0, so the fix is to install a fresh wasm-pack each run. Switch both the ci.yml 'WASM build' step and the release.yml 'wasm-publish' job to the same taiki-e/install-action prebuilt-binary installer we already use for cargo-llvm-cov and cargo-fuzz. taiki-e tracks the latest wasm-pack release and the install is a single binary download — no compile, no shell installer. The wasm-pack invocations themselves are unchanged.	2026-05-23 23:00:13 +02:00
kingchenc	ed57632576	build: lift workspace MSRV to 1.86 to satisfy criterion 0.8.2 criterion 0.8.2 raised its MSRV from 1.85 to 1.86 (rustc 1.85.1 is now explicitly rejected by its Cargo.toml `rust-version`). One more notch on the same upward drift that already took us from 1.75 -> 1.80 (rayon) -> 1.85 (clap_lex/edition2024). Updated: - Cargo.toml workspace rust-version 1.85 -> 1.86 - .github/workflows/ci.yml MSRV matrix name + toolchain - ci.yml comment refreshed to reflect the new driving dep	2026-05-23 21:36:56 +02:00
dependabot[bot]	862a130d8c	deps(actions): bump actions/checkout from 4.3.1 to 6.0.2 Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.1 to 6.0.2. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/34e114876b0b11c390a56381ad16ebd13914f8d5...de0fac2e4500dabe0009e67214ff5f5447ce83dd) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2026-05-23 19:21:27 +00:00
kingchenc	c009ecc7f9	Merge pull request #8 from kingchenc/dependabot/github_actions/actions/setup-python-6.2.0 deps(actions): bump actions/setup-python from 5.6.0 to 6.2.0	2026-05-23 21:19:29 +02:00
kingchenc	bf4faddf0f	Merge pull request #6 from kingchenc/dependabot/github_actions/actions/setup-node-6.4.0 deps(actions): bump actions/setup-node from 4.4.0 to 6.4.0	2026-05-23 21:19:26 +02:00
dependabot[bot]	9b34c84d86	deps(actions): bump actions/setup-python from 5.6.0 to 6.2.0 Bumps [actions/setup-python](https://github.com/actions/setup-python) from 5.6.0 to 6.2.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/a26af69be951a213d495a4c3e4e4022e16d87065...a309ff8b426b58ec0e2a45f0f869d46889d02405) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 6.2.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2026-05-23 18:54:30 +00:00
dependabot[bot]	08928c5b17	deps(actions): bump actions/setup-node from 4.4.0 to 6.4.0 Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4.4.0 to 6.4.0. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/49933ea5288caeca8642d1e84afbd3f7d6820020...48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 6.4.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2026-05-23 18:54:20 +00:00
dependabot[bot]	246d982e93	deps(actions): bump codecov/codecov-action from 5.5.4 to 6.0.1 Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 5.5.4 to 6.0.1. - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/codecov/codecov-action/compare/75cd11691c0faa626561e295848008c8a7dddffe...e79a6962e0d4c0c17b229090214935d2e33f8354) --- updated-dependencies: - dependency-name: codecov/codecov-action dependency-version: 6.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2026-05-23 18:53:50 +00:00
dependabot[bot]	4d8c0ce1a5	deps(actions): bump taiki-e/install-action from 2.79.4 to 2.79.5 Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.79.4 to 2.79.5. - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/taiki-e/install-action/compare/e0eafa9a0d485c37f97c0f7beb930a58a2facbac...6c1f7cf125e42770ff087ea443901b487cc5471a) --- updated-dependencies: - dependency-name: taiki-e/install-action dependency-version: 2.79.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2026-05-23 18:49:22 +00:00
kingchenc	3f9429dd2c	build: lift workspace MSRV further to 1.85 for criterion's clap_lex The first MSRV bump to 1.80 fixed the rayon-core floor but ran into a second transitive-dep floor on the same CI run: error: failed to parse manifest at clap_lex-1.1.0/Cargo.toml Caused by: feature `edition2024` is required The package requires the Cargo feature called `edition2024`, but that feature is not stabilized in this version of Cargo (1.80.1). clap_lex 1.1.0 is pulled in by criterion (dev-dep on the wickra crate) via clap 4.6 -> clap_builder 4.6 -> clap_lex 1.1. edition2024 was stabilized in Rust 1.85, so lift the workspace MSRV one more step. The 1.85 floor subsumes the rayon-core 1.80 requirement; bindings/node stays at 1.88 (napi-build) which already covers everything below it. Also fix the fuzz job: cargo-fuzz defaulted to building for x86_64-unknown-linux-musl, which is not installed on the GitHub-hosted ubuntu runner. Pass --target x86_64-unknown-linux-gnu explicitly on every cargo fuzz run invocation so it builds for the actual host target.	2026-05-23 20:30:46 +02:00
kingchenc	30444ce296	build: lift MSRV to 1.80 workspace / 1.88 node binding The previous MSRV pins were below what current transitive dependencies need: - rayon-core 1.13.0 (pulled in by the optional `parallel` feature on wickra-core via rayon) requires rustc >= 1.80; under the old 1.75 workspace MSRV the CI MSRV job broke with "package `rayon-core v1.13.0` cannot be built because it requires rustc 1.80 or newer". - napi-build 2.3.2 (the build-script crate that napi-derive 2.x calls into) requires rustc >= 1.88; under the old 1.77 node-binding MSRV the CI MSRV-node job broke with "package `napi-build v2.3.2` cannot be built because it requires rustc 1.88 or newer". Pinning the deps backwards would have frozen us out of upstream security/fix releases for both crates. Lifting the MSRV is the cleaner path for a young 0.x library — downstream consumers on older toolchains can stay on the already-published 0.2.0. Updated: - Cargo.toml workspace rust-version 1.75 -> 1.80 - bindings/node/Cargo.toml rust-version 1.77 -> 1.88 - .github/workflows/ci.yml MSRV matrix names + toolchain values + comment - CHANGELOG.md [Unreleased] documents the bump	2026-05-23 20:22:35 +02:00
kingchenc	90d8a299c3	ci(fuzz): install cargo-fuzz from a prebuilt binary The previous `cargo install cargo-fuzz --locked` resolved against cargo-fuzz's own Cargo.lock which pins to rustix 0.36.5. That rustix version still annotates its source with internal #[rustc_*] attributes, and the current nightly compiler rejects those attributes from out-of-tree crates, so cargo-fuzz never finished compiling on CI: error: attributes starting with `rustc` are reserved for use by the `rustc` compiler --> rustix-0.36.5/src/backend/linux_raw/io/errno.rs:28 error: could not compile `rustix` (lib) due to 4 previous errors error: failed to compile `cargo-fuzz v0.13.1` Switch the install to taiki-e/install-action, the same prebuilt-binary provider we already use for cargo-llvm-cov. That skips the full transitive-dependency compile and lets the fuzz-smoke job actually run.	2026-05-23 20:21:03 +02:00
kingchenc	73f8da49bd	ci: build wickra-examples bins instead of removed cargo examples The Z5 reorganisation moved every runnable example out of the per-crate examples/ folders and into a dedicated wickra-examples crate at examples/rust/, with the binaries living under src/bin/<name>.rs. The old ci.yml Compile-examples step still pointed at the now-deleted cargo example targets backtest (wickra) and live_binance (wickra-data), which is why Rust windows-latest failed with 'no example target named backtest in wickra package' and 'no example target named live_binance in wickra-data package'. Replace both calls with a single cargo build -p wickra-examples --bins. That covers backtest, live_binance, fetch_btcusdt, multi_timeframe, parallel_assets and streaming in one shot, and the wickra-examples crate already enables the live-binance feature on its wickra-data dep so no extra --features flag is needed.	2026-05-23 20:19:14 +02:00
kingchenc	6786917cee	ci: move bench to scheduled workflow + add Python 3.13 (R10, R11) R10 — `cross-library-bench` previously ran on every push and every PR to `main`, adding 5–10 minutes of build + bench time per CI run with no automated consumer of the artefact. It moves to a dedicated workflow (`.github/workflows/bench.yml`) that fires nightly at 03:00 UTC and on-demand via `workflow_dispatch` (with optional `size` / `iterations` inputs). The job in `ci.yml` is removed and a pointer comment is left in its place so future readers find the new home. R11 — `pyproject.toml`'s `requires-python = ">=3.9"` already allowed Python 3.13 installs, but the classifier list stopped at 3.12 and CI tested only 3.9 / 3.11 / 3.12. The Python CI matrix gains `"3.13"` and the matching `Programming Language :: Python :: 3.13` classifier is added so PyPI listings and version-search tooling reflect the actually-tested range.	2026-05-23 10:52:20 +02:00
kingchenc	b003321562	test(fuzz): cover every indicator, scalar and candle inputs (R9) The fuzz suite previously covered only `Rsi(14)` and `Ema(20)` — 2 of 71 indicators, no OHLCV coverage at all. Audit finding R9 asked for ATR/ADX/Stochastic/PSAR as a minimum; this commit goes further and brings every indicator under fuzz. - `indicator_update` (rewritten): drives every scalar-input indicator through one streaming pass + one batch call per iteration. Covers SMA, EMA, WMA, RSI, DEMA, TEMA, HMA, ROC, TRIX, SMMA, TRIMA, ZLEMA, KAMA, T3, MOM, CMO, TSI, PMO, StochRSI, DPO, PPO, Coppock, StdDev, UlcerIndex, HistoricalVolatility, LinearRegression, LinRegSlope, LinRegAngle, VHF, ZScore, MACD, BollingerBands. A `drive` helper marked `#[inline(never)]` keeps each indicator on its own panic backtrace frame. - `indicator_update_candle` (new): chunks the fuzz `f64` stream into `[open, high, low, close, volume]` tuples, builds candles via `Candle::new` (skipping ones that fail OHLCV validation — that path is fuzz-tested separately), then drives every candle-input indicator through streaming + batch. Covers ATR, NATR, TrueRange, ChaikinVolatility, Keltner, Donchian, PSAR, SuperTrend, ChandelierExit, ChandeKrollStop, ATRTrailingStop, ADX, Aroon, AroonOscillator, Vortex, MassIndex, ChoppinessIndex, CCI, WilliamsR, AwesomeOscillator, AcceleratorOscillator, UltimateOscillator, BalanceOfPower, OBV, MFI, VWAP, RollingVWAP, VWMA, ADL, VPT, CMF, ChaikinOscillator, ForceIndex, EaseOfMovement, TypicalPrice, MedianPrice, WeightedClose, Stochastic. - `fuzz/Cargo.toml` registers the new target; `fuzz/README.md` describes both expanded targets. - A `fuzz-smoke` CI job runs each of the five targets for 30 s on every push and pull-request — enough to catch a regression in the harness without slowing CI to a crawl. Long fuzz campaigns belong on dedicated infrastructure with persistent corpora.	2026-05-23 10:33:05 +02:00
kingchenc	5568596e18	E8: add code coverage to CI CI had no coverage measurement, and although .gitignore listed coverage artefacts nothing produced them. Add a `coverage` job that runs cargo-llvm-cov over the three pure-Rust crates (with wickra-data's live-binance feature so the Binance parser tests count), emits lcov, and uploads to Codecov. The Codecov upload uses fail_ci_if_error: false so a Codecov outage cannot break CI. Both new actions (taiki-e/install-action, codecov/codecov-action) are SHA-pinned. Add a coverage badge to the README.	2026-05-22 16:38:01 +02:00
kingchenc	71e46a1ea6	E10: add cargo-deny supply-chain checks The repository had no supply-chain auditing — no deny.toml and no CI job to catch vulnerable, unmaintained, wrongly-licensed, or unexpectedly-sourced dependencies. Add deny.toml covering advisories, bans, licenses and sources: - licenses: an allow-list of the permissive licenses the dependency tree actually uses, plus the workspace's own PolyForm-Noncommercial license and a scoped LLVM-exception for target-lexicon. - bans: warn on duplicate versions, deny external wildcard deps (internal path deps are allowed). - sources: only crates.io. - advisories: RUSTSEC-2025-0020 (pyo3 0.22) is ignored with a documented reason — it is reachable only through bindings/python and the pyo3 upgrade is tracked separately; the published crates do not use pyo3. Add a `supply-chain` CI job running cargo-deny-action (SHA-pinned). `cargo deny check` passes locally: advisories/bans/licenses/sources ok.	2026-05-22 16:25:58 +02:00
kingchenc	53b8b6e282	E2: add an MSRV verification job to CI Every CI job used dtolnay/rust-toolchain on stable, so the declared minimum supported Rust version was never exercised — an accidental use of a newer API would only break for downstream users on an older compiler. Add an `msrv` job with a two-row matrix: the workspace crates (wickra-core, wickra, wickra-data) build and test on Rust 1.75, and the node binding on Rust 1.77, matching the rust-version each manifest declares. Both rows use the SHA-pinned toolchain action.	2026-05-22 12:37:15 +02:00
kingchenc	9b11d73273	D1: pin all GitHub Actions to commit SHAs Every action in ci.yml and release.yml was pinned to a movable tag (actions/checkout@v4, dtolnay/rust-toolchain@stable, ...). A compromised upstream tag would run with access to the crates.io / PyPI / npm publish tokens. Pin every `uses:` to the full 40-character commit SHA the referenced ref currently resolves to, with the human-readable version kept as a trailing comment so Dependabot can still bump them: actions/checkout v4.3.1 actions/setup-python v5.6.0 actions/setup-node v4.4.0 actions/upload-artifact v4.6.2 actions/download-artifact v4.3.0 dtolnay/rust-toolchain stable branch @ 2026-03-27 Swatinem/rust-cache v2 jetli/wasm-pack-action v0.4.0 PyO3/maturin-action v1.51.0 softprops/action-gh-release v2.6.2 SHAs were resolved against the GitHub API. The github-actions Dependabot ecosystem that keeps these pins current is added with E3.	2026-05-22 12:35:02 +02:00
kingchenc	8192e576cf	B6: add a WASM binding test suite The WASM binding had no tests; CI only checked that artefacts existed. Adds a wasm-bindgen-test suite covering SMA reference values, EMA batch==streaming equivalence, RSI pure-uptrend behaviour, fallible constructors returning JsError, and the unequal-length batch guards from B3. Wires wasm-pack test --node into the CI wasm job. The suite type-checks on the host; it executes under wasm-pack in CI (the local environment is a non-rustup Rust install without the wasm32 target).	2026-05-22 04:05:15 +02:00
kingchenc	5c40acd288	ci+loader: build with --platform; ship napi-generated loader The Windows Node 18 and Node 20 CI jobs failed because: - ci.yml ran 'napi build --release' (no --platform), which produces a filename without the target triple ('wickra.node'). - The committed loader at bindings/node/index.js looked for the triple-suffixed file ('wickra.win32-x64-msvc.node') and then for the per-platform npm subpackage as a fallback. - 'wickra-win32-x64-msvc' isn't on npm yet (blocked by the spam filter), so Windows had nothing to load. Linux and macOS passed only because their optionalDependencies do exist on npm and got fetched. Two-part fix: - ci.yml now runs 'napi build --platform --release', matching release.yml. --platform encodes the target triple in the filename, so the loader's primary lookup always finds the freshly built binary on every host. - bindings/node/index.js is now the canonical napi-rs auto-generated loader (it gets regenerated by 'napi build'). It covers all the platforms napi knows about (linux glibc/musl, Android, FreeBSD, ARM, etc.) rather than just the four we publish, so unsupported platforms get a clear 'this binding isn't built for your system' error instead of a confusing ENOENT. Local sanity: 'npx napi build --platform --release' then 'node --test __tests__/' succeeds end to end on Windows; the eight existing tests pass.	2026-05-21 21:53:49 +02:00
kingchenc	d42a0d7ad5	ci: fix maturin and wasm-pack jobs Two unrelated failures in the post-release CI run: - Python jobs: `maturin develop` requires an activated virtualenv on CI runners that don't have a system Python set up that way. Switch to `maturin build --release --out dist` followed by `pip install --find-links dist`, which is venv-agnostic and OS-portable. - WASM job: the wasm-opt bundled with wasm-pack is older than the WASM features rustc 1.92 enables by default. The fix is to opt every feature in explicitly via the package metadata — reference-types, multivalue, bulk-memory, sign-ext, mutable-globals, nontrapping-float-to-int — so wasm-opt accepts the input. Same code as before; only the build steps and the wasm-opt config changed.	2026-05-21 18:04:57 +02:00
kingchenc	3be267cb03	Wickra 0.1.0: streaming-first technical indicators A multi-language technical analysis library: 25 indicators across trend, momentum, volatility, and volume families, every one a state machine with O(1) per-tick updates. Batch evaluation is provided by a blanket extension trait over the streaming primitive, so live trading bots and historical backtests run the same code path. What ships in this initial drop: crates/wickra-core - 25 indicators, Indicator/BatchExt/Chain traits, OHLCV types with validation; 171 unit tests, property tests, Wilder/Bollinger textbook tests. crates/wickra - top-level facade + criterion benches for every indicator at 1K/10K/100K series sizes. crates/wickra-data - streaming CSV reader, tick-to-candle aggregator, multi-timeframe resampler, Binance Spot kline WebSocket adapter behind feature live-binance; 11 unit + 1 doctest. bindings/python - PyO3 + maturin, NumPy I/O, type stubs (.pyi), 56 pytest tests including streaming==batch equivalence, Wilder reference values, lifecycle. bindings/node - napi-rs native module, TypeScript .d.ts auto-generated, 7 node --test cases. bindings/wasm - wasm-bindgen ES module for browser/bundler/Node; interactive HTML demo at examples/index.html. examples/ - Python and Rust scripts: backtest, live trading, parallel multi-asset, multi-timeframe, Binance. benchmarks/ - cross-library comparison against TA-Lib, pandas-ta, finta, talipp; Wickra wins every category by 11-1030x (batch) and 17x+ streaming. .github/workflows/ - CI matrix (Rust + Python + Node + WASM on Linux/macOS/Windows), release pipeline for PyPI wheels and npm. Indicators (25): Trend SMA EMA WMA DEMA TEMA HMA KAMA Momentum RSI MACD Stochastic CCI ROC WilliamsR ADX MFI TRIX AwesomeOscillator Aroon Volatility BollingerBands ATR Keltner Donchian PSAR Volume OBV VWAP (cumulative + rolling) cargo clippy --workspace --all-targets -D warnings is clean. License: Apache-2.0.	2026-05-21 17:50:45 +02:00

48 Commits