matitos
2ca5032e7e
- NOTIFY_LEVELS chooses which event levels are sent (default trade,error). - NOTIFY_LIFECYCLE sends explicit start/stop messages; the kill switch always notifies at error level. - SUMMARY_INTERVAL_MINUTES sends a periodic portfolio summary (equity, per strategy P&L, allocation, halted state) via a background task started with the run and stopped on stop/kill/shutdown. - Wires the new vars plus the go-live vars through both compose files and the deploy workflow. Adds tests.
275 lines
12 KiB
YAML
275 lines
12 KiB
YAML
name: CI/CD
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
pull_request:
|
|
branches: [main]
|
|
paths-ignore:
|
|
- '**.md'
|
|
push:
|
|
branches: [main]
|
|
paths-ignore:
|
|
- '**.md'
|
|
|
|
# Never let two deploys interleave (build/up/rollback flapping).
|
|
concurrency:
|
|
group: crypto-trading-deploy
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
backend:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Set up Python
|
|
uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.12"
|
|
cache: "pip"
|
|
cache-dependency-path: backend/requirements.txt
|
|
|
|
- name: Install dependencies
|
|
run: pip install -r backend/requirements-dev.txt
|
|
|
|
- name: Lint (ruff)
|
|
run: |
|
|
cd backend
|
|
ruff check .
|
|
ruff format --check .
|
|
|
|
- name: Run tests
|
|
run: cd backend && python -m pytest -q
|
|
|
|
frontend:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "22"
|
|
cache: "npm"
|
|
cache-dependency-path: frontend/package-lock.json
|
|
|
|
- name: Install dependencies
|
|
run: cd frontend && npm ci
|
|
|
|
- name: Test
|
|
run: cd frontend && npm test
|
|
|
|
- name: Build
|
|
run: cd frontend && npm run build
|
|
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
needs: [backend, frontend]
|
|
if: github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Log in to Docker Hub (optional)
|
|
env:
|
|
DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
run: |
|
|
if [ -n "$DOCKERHUB_USERNAME" ] && [ -n "$DOCKERHUB_TOKEN" ]; then
|
|
echo "$DOCKERHUB_TOKEN" | docker login -u "$DOCKERHUB_USERNAME" --password-stdin
|
|
else
|
|
echo "Docker Hub credentials not set; using anonymous pulls"
|
|
fi
|
|
|
|
- name: Build backend
|
|
run: |
|
|
for i in 1 2 3; do
|
|
docker build -t crypto_trading-backend ./backend && exit 0
|
|
echo "backend build failed (attempt $i); retrying in 30s"; sleep 30
|
|
done
|
|
exit 1
|
|
|
|
- name: Build frontend
|
|
run: |
|
|
for i in 1 2 3; do
|
|
docker build -t crypto_trading-frontend ./frontend && exit 0
|
|
echo "frontend build failed (attempt $i); retrying in 30s"; sleep 30
|
|
done
|
|
exit 1
|
|
|
|
deploy:
|
|
runs-on: ubuntu-latest
|
|
needs: build
|
|
if: github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
|
|
env:
|
|
BASE_DOMAIN: ${{ secrets.BASE_DOMAIN || 'matitos.org' }}
|
|
# htpasswd string for the WebUI. Prefer the crypto-trading specific
|
|
# variable/secret, falling back to the shared org-level SCA users. The
|
|
# compose basicauth middleware is fail-closed, so it must be present for
|
|
# every `docker compose` command in this job to interpolate the file.
|
|
CRYPTO_FRONTEND_AUTH_USERS: ${{ vars.CRYPTO_FRONTEND_AUTH_USERS || secrets.CRYPTO_FRONTEND_AUTH_USERS || vars.SCA_FRONTEND_AUTH_USERS || secrets.SCA_FRONTEND_AUTH_USERS }}
|
|
CRYPTO_MODE: ${{ vars.CRYPTO_MODE || 'paper' }}
|
|
CRYPTO_EXCHANGE: ${{ vars.CRYPTO_EXCHANGE || 'binance' }}
|
|
CRYPTO_SYMBOL: ${{ vars.CRYPTO_SYMBOL || 'BTC/USDT' }}
|
|
CRYPTO_TIMEFRAME: ${{ vars.CRYPTO_TIMEFRAME || '5m' }}
|
|
CRYPTO_POLL_INTERVAL: ${{ vars.CRYPTO_POLL_INTERVAL || '5' }}
|
|
CRYPTO_STARTING_BALANCE: ${{ vars.CRYPTO_STARTING_BALANCE || '10000' }}
|
|
CRYPTO_CORS_ORIGINS: ${{ vars.CRYPTO_CORS_ORIGINS || format('https://crypto.{0}', secrets.BASE_DOMAIN || 'matitos.org') }}
|
|
CRYPTO_EXCHANGE_API_KEY: ${{ secrets.CRYPTO_EXCHANGE_API_KEY }}
|
|
CRYPTO_EXCHANGE_API_SECRET: ${{ secrets.CRYPTO_EXCHANGE_API_SECRET }}
|
|
CRYPTO_EXCHANGE_SANDBOX: ${{ vars.CRYPTO_EXCHANGE_SANDBOX || 'false' }}
|
|
# Risk controls (0 disables a limit).
|
|
CRYPTO_MAX_DAILY_LOSS: ${{ vars.CRYPTO_MAX_DAILY_LOSS || '0' }}
|
|
CRYPTO_MAX_DRAWDOWN_PCT: ${{ vars.CRYPTO_MAX_DRAWDOWN_PCT || '0' }}
|
|
CRYPTO_MAX_POSITION_PCT: ${{ vars.CRYPTO_MAX_POSITION_PCT || '1.0' }}
|
|
CRYPTO_MAX_TRADES_PER_DAY: ${{ vars.CRYPTO_MAX_TRADES_PER_DAY || '0' }}
|
|
# Notifications.
|
|
CRYPTO_TELEGRAM_BOT_TOKEN: ${{ secrets.CRYPTO_TELEGRAM_BOT_TOKEN }}
|
|
CRYPTO_TELEGRAM_CHAT_ID: ${{ vars.CRYPTO_TELEGRAM_CHAT_ID || secrets.CRYPTO_TELEGRAM_CHAT_ID }}
|
|
CRYPTO_NOTIFY_WEBHOOK_URL: ${{ secrets.CRYPTO_NOTIFY_WEBHOOK_URL }}
|
|
CRYPTO_NOTIFY_LEVELS: ${{ vars.CRYPTO_NOTIFY_LEVELS || 'trade,error' }}
|
|
CRYPTO_NOTIFY_LIFECYCLE: ${{ vars.CRYPTO_NOTIFY_LIFECYCLE || 'true' }}
|
|
CRYPTO_SUMMARY_INTERVAL_MINUTES: ${{ vars.CRYPTO_SUMMARY_INTERVAL_MINUTES || '0' }}
|
|
CRYPTO_LIVE_CONFIRMATION: ${{ secrets.CRYPTO_LIVE_CONFIRMATION }}
|
|
CRYPTO_MIN_LIVE_BALANCE: ${{ vars.CRYPTO_MIN_LIVE_BALANCE || '100' }}
|
|
# Optional API bearer token (injected server-side by the frontend nginx).
|
|
CRYPTO_API_TOKEN: ${{ secrets.CRYPTO_API_TOKEN }}
|
|
CRYPTO_API_TOKEN_HEADER: ${{ vars.CRYPTO_API_TOKEN_HEADER || 'X-API-Token' }}
|
|
CRYPTO_AUTH_RATE_LIMIT_AVERAGE: ${{ vars.CRYPTO_AUTH_RATE_LIMIT_AVERAGE || '10' }}
|
|
CRYPTO_AUTH_RATE_LIMIT_BURST: ${{ vars.CRYPTO_AUTH_RATE_LIMIT_BURST || '5' }}
|
|
# Persistent data root: repo var wins, else derive from the org
|
|
# PERSISTENT_MOUNT (absolute HOST path), else the workspace fallback.
|
|
CRYPTO_DATA_DIR: ${{ vars.CRYPTO_DATA_DIR || (vars.PERSISTENT_MOUNT && format('{0}/crypto_trading', vars.PERSISTENT_MOUNT)) || './data' }}
|
|
# Stamped into both images so the client can detect a stale cached bundle.
|
|
CRYPTO_BUILD_VERSION: ${{ github.sha }}
|
|
DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Require CRYPTO_FRONTEND_AUTH_USERS
|
|
run: |
|
|
# The compose basicauth middleware is fail-closed, so refuse early
|
|
# with a clear message instead of starting an unauthenticated UI that
|
|
# can control a trading bot.
|
|
if [ -z "$CRYPTO_FRONTEND_AUTH_USERS" ]; then
|
|
echo "::error::CRYPTO_FRONTEND_AUTH_USERS is not set (repo/org variable or secret); refusing to deploy"
|
|
exit 1
|
|
fi
|
|
# CRYPTO_API_TOKEN is optional. When unset, the API and the /api/ws
|
|
# live feed are unauthenticated beyond the Traefik Basic auth that
|
|
# still guards everything except /api/ws. Set it to require a bearer
|
|
# token on /api (nginx injects it server-side, so the browser never
|
|
# sees it).
|
|
if [ -z "$CRYPTO_API_TOKEN" ]; then
|
|
echo "Note: CRYPTO_API_TOKEN is not set; /api and /api/ws will not require a bearer token."
|
|
fi
|
|
|
|
- name: Log in to Docker Hub (optional)
|
|
run: |
|
|
if [ -n "$DOCKERHUB_USERNAME" ] && [ -n "$DOCKERHUB_TOKEN" ]; then
|
|
echo "$DOCKERHUB_TOKEN" | docker login -u "$DOCKERHUB_USERNAME" --password-stdin
|
|
else
|
|
echo "Docker Hub credentials not set; using anonymous pulls"
|
|
fi
|
|
|
|
- name: Deploy with Docker Compose
|
|
run: |
|
|
echo "Deploying to crypto.${BASE_DOMAIN} (mode=${CRYPTO_MODE})"
|
|
echo "Data dir: ${CRYPTO_DATA_DIR}"
|
|
# Keep the currently-running images so we can roll back on failure.
|
|
for img in crypto_trading-backend crypto_trading-frontend; do
|
|
if docker image inspect "$img" >/dev/null 2>&1; then
|
|
docker tag "$img" "${img}:prev"
|
|
fi
|
|
done
|
|
built=0
|
|
for i in 1 2 3 4 5; do
|
|
# --pull refreshes base images; the build args carry the new commit
|
|
# so the cache is invalidated per release.
|
|
if docker compose build --pull; then built=1; break; fi
|
|
echo "docker compose build failed (attempt $i); retrying in 30s"
|
|
sleep 30
|
|
done
|
|
[ "$built" = "1" ] || { echo "::error::compose build failed after retries"; exit 1; }
|
|
# --force-recreate guarantees the containers are replaced with the
|
|
# freshly built images. Without it a config-identical service can be
|
|
# left running the previous image (stale UI after a deploy).
|
|
# No pre-`down`, so the old containers keep serving until the new ones
|
|
# are healthy.
|
|
if ! docker compose up -d --remove-orphans --force-recreate --wait --wait-timeout 300; then
|
|
echo "::error::New stack is unhealthy; rolling back to previous images"
|
|
docker compose down --remove-orphans || true
|
|
for img in crypto_trading-backend crypto_trading-frontend; do
|
|
if docker image inspect "${img}:prev" >/dev/null 2>&1; then
|
|
docker tag "${img}:prev" "$img"
|
|
fi
|
|
done
|
|
docker compose up -d --remove-orphans --force-recreate --wait --wait-timeout 300 || true
|
|
exit 1
|
|
fi
|
|
|
|
- name: Services and recent logs
|
|
run: |
|
|
docker compose ps
|
|
docker compose logs --tail=80
|
|
|
|
- name: Verify the deployed frontend matches this commit
|
|
run: |
|
|
# The container must serve the build stamped with this commit's SHA.
|
|
# Without this, a config-identical service could keep an old image and
|
|
# serve a stale UI even though the deploy "succeeded".
|
|
want="${CRYPTO_BUILD_VERSION:-unknown}"
|
|
got="$(docker compose exec -T frontend cat /usr/share/nginx/html/.build-version 2>/dev/null | tr -d '[:space:]' || true)"
|
|
echo "expected=${want} served=${got:-<missing>}"
|
|
if [ "$want" != "unknown" ] && [ "$got" != "$want" ]; then
|
|
echo "::error::frontend container is serving a stale build; failing deploy"
|
|
exit 1
|
|
fi
|
|
|
|
- name: Health check (HTTP)
|
|
run: |
|
|
probe_backend() {
|
|
docker compose exec -T backend python -c \
|
|
"import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8000/api/health', timeout=5).status==200 else 1)"
|
|
}
|
|
probe_frontend() {
|
|
docker compose exec -T frontend wget -q --spider http://127.0.0.1:80/
|
|
}
|
|
for i in 1 2 3 4 5 6; do
|
|
echo "Attempt $i/6..."
|
|
if probe_backend && probe_frontend; then
|
|
echo "All services healthy"
|
|
exit 0
|
|
fi
|
|
sleep 15
|
|
done
|
|
echo "::error::Health checks failed; rolling back"
|
|
docker compose down --remove-orphans || true
|
|
for img in crypto_trading-backend crypto_trading-frontend; do
|
|
if docker image inspect "${img}:prev" >/dev/null 2>&1; then
|
|
docker tag "${img}:prev" "$img"
|
|
fi
|
|
done
|
|
docker compose up -d --remove-orphans --wait --wait-timeout 300 || true
|
|
exit 1
|
|
|
|
cleanup:
|
|
runs-on: ubuntu-latest
|
|
needs: [backend, frontend]
|
|
if: github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Delete branches merged into main
|
|
run: |
|
|
git fetch --all --prune
|
|
git branch -r --merged origin/main \
|
|
| grep -vE 'origin/(main|HEAD)([[:space:]]|$)' \
|
|
| sed -E 's|^[[:space:]]*origin/||' \
|
|
| while read -r branch; do
|
|
[ -z "$branch" ] && continue
|
|
echo "Deleting merged branch: $branch"
|
|
git push origin --delete "$branch" || echo " (could not delete $branch)"
|
|
done
|