validate.yml

name: Validate

on:
  push:
  pull_request:

permissions:
  contents: read

jobs:
  actionlint:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v6
      - name: Actionlint
        uses: docker://rhysd/actionlint:1.7.12

  python:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"
      - name: Install Python packaging tools
        run: |
          set -euo pipefail
          python3 -m pip install --upgrade pip
          python3 -m pip install build -e ./python
      - name: Verify Python dependencies
        run: python3 -m pip check
      - name: Check whitespace
        run: |
          set -euo pipefail
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            git fetch --no-tags --depth=1 origin "${{ github.base_ref }}"
            git diff --check "origin/${{ github.base_ref }}...HEAD"
          else
            # -M matters. `git diff-tree` is plumbing and does no rename
            # detection unless asked, so a renamed file is compared as if it
            # were wholly new and every trailing space already in it is
            # reported against this commit. `git diff` above does detect
            # renames, which is why only this branch has the problem.
            git diff-tree --check --no-commit-id --root -r -M HEAD
          fi
      - name: Validate generated display names
        run: python3 python/scripts/build_display_names.py --check
      - name: Validate platform config
        run: python3 python/scripts/build_config.py --check
      - name: Validate runtime targets
        run: python3 python/scripts/runtime_settings.py validate
      - name: Run Python unit tests
        run: python3 -m unittest discover -s python/tests -v
      - name: Build Python package
        run: python3 -m build ./python
      - name: Checkout internal dependency consumer repos
        env:
          GH_TOKEN: ${{ github.token }}
        run: bash python/shell/checkout_internal_dependency_consumers.sh --output-root ..
      - name: Report internal dependency matrix
        run: python3 python/scripts/check_internal_dependency_matrix.py --projects-root .. --json --require-consumer-files
      - name: Enforce internal dependency matrix when its ledger changes
        run: |
          set -euo pipefail
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            comparison_range="origin/${{ github.base_ref }}...HEAD"
          elif git rev-parse --verify HEAD^ >/dev/null 2>&1; then
            comparison_range="HEAD^...HEAD"
          else
            echo "No parent commit is available; reporting dependency drift without a strict ledger gate."
            exit 0
          fi
          if git diff --quiet "$comparison_range" -- internal_dependency_matrix.json; then
            echo "Internal dependency ledger did not change; retaining the report without making this unrelated PR non-hermetic."
            exit 0
          fi
          python3 python/scripts/check_internal_dependency_matrix.py --projects-root .. --json --strict --require-consumer-files

  js:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - uses: actions/setup-node@v6
        with:
          node-version: "22"
      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"
      - name: Validate offline synthetic reconciliation console
        run: node tests/offline_reconciliation_console_validation.mjs
      - name: Install local Worker test runtime
        working-directory: web/strategy-switch-console
        run: npm ci
      - name: Select QRS 946 evidence scope
        id: qrs946_scope
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
        shell: bash
        run: |
          set -euo pipefail
          needed=true
          if [[ "$BASE_SHA" =~ ^[0-9a-f]{40}$ ]] && [[ "$BASE_SHA" != 0000000000000000000000000000000000000000 ]] \
            && [[ "$(git rev-parse HEAD)" == "$GITHUB_SHA" ]] \
            && git cat-file -e "${BASE_SHA}^{commit}" 2>/dev/null \
            && git merge-base --is-ancestor "$BASE_SHA" "$GITHUB_SHA"; then
            if git diff --quiet "$BASE_SHA" "$GITHUB_SHA" -- \
              ':(glob)scripts/console_946*' ':(glob)scripts/console_54e*' scripts/console_active_module_probe.mjs \
              ':(glob)tests/console_946*' ':(glob)tests/console_54e*' tests/console_active_module_probe.test.mjs \
              .github/workflows/validate.yml .github/workflows/deploy-strategy-switch-console.yml \
              web/strategy-switch-console/package.json web/strategy-switch-console/package-lock.json \
              web/strategy-switch-console/frontend/package.json web/strategy-switch-console/frontend/package-lock.json; then
              needed=false
            fi
          fi
          printf 'needed=%s\n' "$needed" >> "$GITHUB_OUTPUT"
      - name: Build synthetic QRS 946 bundle evidence
        if: steps.qrs946_scope.outputs.needed == 'true'
        run: |
          bash scripts/console_946_bundle_evidence.sh
          bash scripts/console_54e_baseline_build.sh
      - name: Preserve synthetic QRS 946 bundle evidence
        if: steps.qrs946_scope.outputs.needed == 'true'
        uses: actions/upload-artifact@v4
        with:
          name: qrs946-synthetic-bundle-evidence
          path: ${{ runner.temp }}/qrs946-bundle-evidence/
          if-no-files-found: error
          retention-days: 3
      - name: Validate strategy switch web assets
        env:
          CLOUDFLARE_CF_FETCH_ENABLED: "false"
          npm_config_update_notifier: "false"
          QRS946_EVIDENCE_NEEDED: ${{ steps.qrs946_scope.outputs.needed }}
        run: |
          set -euo pipefail
          node tests/display_names_validation.mjs
          node tests/console_v2_assets_validation.mjs
          node tests/console_deploy_safety_validation.mjs
          node --test tests/console_active_module_probe.test.mjs
          npm ci --prefix web/strategy-switch-console/frontend
          node --test tests/console_946_patch_unit.test.mjs tests/console_54e_baseline_report.test.mjs tests/console_946_54e_patch.test.mjs tests/console_946_54e_pipeline_unit.test.mjs tests/console_946_backend_release.test.mjs tests/console_946_backend_workflow.test.mjs
          node --test tests/console_946_readonly_state.test.mjs tests/console_946_readonly_flow.test.mjs
          if [[ "$QRS946_EVIDENCE_NEEDED" == true ]]; then
            node tests/console_946_candidate_validation.mjs
            node tests/console_54e_baseline_real_ast.test.mjs
            node tests/console_946_54e_candidate_validation.mjs
          fi
          node --test tests/website_execution_evidence_release_validation.mjs
          node tests/website_release_combination_validation.mjs
          npm run build --prefix web/strategy-switch-console/frontend
          npm run sync:v2-assets --prefix web/strategy-switch-console/frontend
          node tests/console_v2_assets_validation.mjs
          npm run test:operations --prefix web/strategy-switch-console
          npm run check:style-guards --prefix web/strategy-switch-console/frontend  # warn-only until P5-5
          node tests/console_candidate_readiness_validation.mjs
          node tests/console_acceptance_budget_validation.mjs
          node tests/kv_directory_validation.mjs
          node tests/console_source_quota_validation.mjs
          node tests/console_current_strategies_kv_dedup_validation.mjs
          node tests/console_inbox_requests_validation.mjs
          node tests/console_v2_i18n_validation.mjs
          node tests/console_account_state_validation.mjs
          node --experimental-strip-types tests/console_presentation_validation.mjs
          node --experimental-strip-types tests/strategy_display_identity_validation.mjs
          node tests/console_catalog_release_validation.mjs
          git diff --exit-code -- web/strategy-switch-console/v2_asset_map.js
          python3 python/scripts/build_config.py --check
          python3 python/scripts/build_config.py
          python3 python/scripts/build_platform_config.py --check
          git diff --exit-code -- web/strategy-switch-console/config.js web/strategy-switch-console/strategy_profiles_asset.js web/strategy-switch-console/runtime-catalog-projection.json
          jq empty web/strategy-switch-console/strategy-profiles.example.json
          node --experimental-default-type=module tests/strategy_switch_worker_validation.mjs
          node tests/frozen_strategy_selection_validation.mjs
          node tests/credential_rotation_worker_validation.mjs
          node tests/credential_rotation_proxy_client_validation.mjs
          node tests/secret_rotation_proxy_validation.mjs
          node tests/credential_maintenance_worker_validation.mjs
          node --experimental-strip-types tests/credential_maintenance_presentation_validation.mjs
          node tests/runtime_daily_worker_validation.mjs
          node tests/runtime_today_request_reuse_validation.mjs
          node tests/account_facts_validation.mjs
          node tests/account_facts_history_currencies_validation.mjs
          node tests/console_equity_history_validation.mjs
          node tests/console_calendar_currency_validation.mjs
          node tests/ibkr_period_return_validation.mjs
          node tests/native_return_research_read_validation.mjs
          node tests/console_external_flow_validation.mjs
          node tests/external_flow_receiver_validation.mjs
          node tests/external_flow_date_precision_validation.mjs
          node tests/binance_account_facts_validation.mjs
          node tests/binance_receiver_deploy_acceptance_validation.mjs
          node tests/account_facts_binding_workflow_validation.mjs
          node tests/firstrade_account_facts_preparation_validation.mjs
          node tests/ibkr_runtime_lifecycle_inspection_validation.mjs
          node tests/ibkr_primary_binding_backup_validation.mjs
          node tests/ibkr_daily_binding_comparison_validation.mjs
          node tests/binance_daily_binding_validation.mjs
          node tests/binance_daily_source_reader_validation.mjs
          node tests/ibkr_daily_setup_checks_validation.mjs
          node tests/ibkr_daily_version_prepare_validation.mjs
          node tests/ibkr_daily_setup_validation.mjs
          node tests/execution_daily_registration_validation.mjs
          node tests/ibkr_daily_transport_validation.mjs
          node tests/strategy_profiles_consumer_freeze_validation.mjs
          node --experimental-strip-types tests/account_history_presentation_validation.mjs
          node --experimental-strip-types tests/console_chart_visibility_validation.mjs
          node tests/console_synthetic_development_validation.mjs
          node tests/console_read_recovery_ui_validation.mjs
          node tests/option_retirement_render_validation.mjs
          node --experimental-strip-types tests/option_retirement_ui_validation.mjs
          node --experimental-strip-types tests/overview_benchmark_aggregate_validation.mjs
          node --experimental-strip-types tests/overview_fx_proxy_validation.mjs
          node --experimental-strip-types tests/market_benchmark_validation.mjs
          node tests/market_benchmark_revision_policy_validation.mjs
          node tests/market_benchmark_revision_apply_validation.mjs
          node tests/account_facts_readonly_extract_validation.mjs
          node tests/account_facts_sync_extract_validation.mjs
          node tests/owner_decision_extract_validation.mjs
          node tests/research_promotion_application_extract_validation.mjs
          node --experimental-strip-types tests/research_summary_worker_validation.mjs
          node tests/console_v2_worker_validation.mjs
          node --experimental-strip-types tests/console_update_notice_validation.mjs
          node --experimental-default-type=module tests/runtime_instances_worker_validation.mjs
          node --experimental-default-type=module tests/account_diagnosis_worker_validation.mjs
          node --experimental-strip-types tests/account_diagnosis_targets_validation.mjs
          node --experimental-default-type=module tests/research_promotion_application_worker_validation.mjs
          node tests/human_decisions_worker_validation.mjs
          node tests/initial_enrollment_bindings_validation.mjs
          node tests/initial_enrollment_worker_validation.mjs
          node tests/initial_enrollment_ui_validation.mjs
          node tests/reconciliation_material_presentation_validation.mjs
          node --experimental-strip-types tests/decision_review_material_pure_validation.mjs
          node tests/console_api_contract_validation.mjs
          node tests/console_binance_current_holdings_validation.mjs
          node tests/console_api_worker_validation.mjs
          node tests/decision_cockpit_api_validation.mjs
          node tests/runtime_readback_validation.mjs
          node tests/audit_pagination_validation.mjs
          node tests/console_design_api_validation.mjs
          node web/strategy-switch-console/frontend/node_modules/typescript/bin/tsc -p tests/tsconfig.console-gaps.json
          node --experimental-strip-types tests/console_gap_contract_validation.mjs
          node --experimental-strip-types tests/console_returns_adapter_validation.mjs
          node --experimental-strip-types tests/native_daily_gap_ui_validation.mjs
          node tests/native_daily_returns_validation.mjs
          node --experimental-strip-types tests/console_display_gaps_validation.mjs
          node --experimental-strip-types tests/console_cashflow_method_presentation_validation.mjs
          node --experimental-strip-types tests/console_runtime_daily_selection_validation.mjs
          node tests/console_performance_stats_validation.mjs
          node tests/product_financial_boundary_validation.mjs
          node tests/website_coverage_regression_validation.mjs
          node tests/website_cohort_regression_validation.mjs
          node tests/website_strategy_freshness_validation.mjs
          node --experimental-strip-types tests/website_mobile_gaps_validation.mjs
          node tests/website_latest_balance_ui_validation.mjs
          node tests/console_calendar_currency_validation.mjs
          node --test tests/fe8a_performance_validation.mjs tests/fe8a_runtime_today_validation.mjs tests/fe8a_overview_runtime_ui_validation.mjs
          node tests/account_settings_worker_validation.mjs
          node --experimental-default-type=module tests/console_evidence_metadata_validation.mjs
          node --experimental-strip-types tests/account_settings_state_validation.mjs
          node --experimental-strip-types tests/overview_refresh_validation.mjs
          node --experimental-strip-types tests/runtime_history_validation.mjs
          node --experimental-strip-types tests/workflow_clarity_validation.mjs
          node --experimental-strip-types tests/runtime_stop_worker_validation.mjs
          node tests/runtime_stop_requests_worker_validation.mjs
          node tests/runtime_control_request_validation.mjs
          node tests/runtime_control_receipt_validation.mjs
          node --experimental-default-type=module tests/binance_resume_worker_validation.mjs
          node --experimental-default-type=module tests/ux1_research_worker_validation.mjs
          node --experimental-default-type=module tests/ux1_async_worker_validation.mjs
          node --experimental-default-type=module tests/ux1_async_ui_validation.mjs
          node --experimental-strip-types --test tests/console_runtime_state_validation.mjs
          node --experimental-strip-types --test tests/binance_private_scope_worker_validation.mjs
          node --check --input-type=module < web/strategy-switch-console/strategy_profiles_asset.js
          node --check --input-type=module < web/strategy-switch-console/worker.js