Repository navigation
Conversation
- Replace daily-maintenance.yml with scheduled-check.yml. The old file was invalid YAML (a column-0 line inside a run block), so it never ran on schedule and failed on every push. It was also designed to let an AI agent edit the repo unattended with contents/pull-requests write and an OAuth secret. The replacement is a weekly, read-only run of lint, types and tests against the latest dependency releases. - ci.yml: top-level permissions contents: read; checkout without persisted credentials. - sync-web-demo.yml: top-level contents: read, write scoped to the one job that pushes. - Add .github/dependabot.yml (pip and github-actions, weekly, minor and patch grouped), SECURITY.md and CITATION.cff. - Stop tracking the .coverage data file and ignore coverage output. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A42wbaQJVk97N5TsWqXP4G
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A42wbaQJVk97N5TsWqXP4G
heykav
marked this pull request as ready for review
October 3, 2026 19:25
main only repaired the YAML of daily-maintenance.yml. The hardening branch deletes that workflow on purpose: it ran an AI agent unattended with contents and pull-requests write access plus an OAuth secret. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A42wbaQJVk97N5TsWqXP4G
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Scheduled workflow: decision
daily-maintenance.ymlis removed and replaced byscheduled-check.yml.Why:
contents: writeandpull-requests: write, an OAuth secret in the job, and a PR opened by the bot. Nothing about the maintenance it describes needs to happen unattended.The replacement runs weekly (and on
workflow_dispatch) on Python 3.10 and 3.12, installs the latest dependency releases, and runs the same lint, format, type and test steps as CI. It haspermissions: contents: read, checks out without persisted credentials, uses no secrets and writes nothing. A failure shows up as a failed run; fixing it is a normal PR.The
CLAUDE_CODE_OAUTH_TOKENrepository secret is no longer referenced by any workflow. This PR does not touch secrets; removing it is left to the owner.Other changes
ci.yml: top-levelpermissions: contents: read;persist-credentials: falseon checkout.sync-web-demo.yml: top-levelcontents: read, withcontents: writescoped to the single job that pushes the copied files. Behaviour is unchanged: it copiessrc/quantdeckintodocs/quantdeck_srcon pushes to main that touch the engine and commits only if something changed. It takes no untrusted input. Credentials are still persisted there because the job pushes..github/dependabot.yml:pipandgithub-actions, weekly, minor and patch updates grouped per ecosystem.SECURITY.md: private reporting via GitHub private vulnerability reporting or heykavofficial@gmail.com, best effort, latestmainonly. Also states that strategy files are imported and run as trusted code by design.CITATION.cff: author Krishna Anubhav, version 0.1.0, MIT, no DOI. Validated withcffconvert --validate..coveragewas committed by mistake; it is now untracked and coverage output is ignored.Not changed
actions/checkout@v4andactions/setup-python@v5are still referenced by tag. The GitHub tools available in this session cannot read theactions/*repositories, so the commit SHAs could not be resolved from a trusted source, and I did not want to pin to SHAs taken from memory. Dependabot'sgithub-actionsupdates will keep the tags current; pinning can be done in a follow-up.PaperBrokeronly simulates fills inside a backtest. It makes no test-count claims. The quickstart output was re-run and matches.LICENSEis MIT, matchingpyproject.tomland the README.Verification
Locally on Python 3.10 with
pip install -e ".[dev]":pytest: 76 passed (also with--cov=quantdeck)ruff check .: passedruff format --check src tests examples scripts: passedmypy(strict): no issuesCI on this PR: test (3.10), test (3.11), test (3.12) all pass.