Crypto trading bot: engine, brokers, backtester, dashboard, deploy

FastAPI backend with a single-strategy async engine, paper and Binance brokers, pure-python indicators, a backtester that shares the engine's portfolio math, and a Vue dashboard with a live WebSocket feed. Adds the Gitea Actions CI/CD workflow that deploys to Traefik via docker_default.
2026-09-18 17:02:33 +00:00
1 parent 98028248c2
commit 9c3bee87ac
@@ -0,0 +1,229 @@
+name: CI/CD
+
+on:
+  workflow_dispatch:
+  pull_request:
+    branches: [main]
+    paths-ignore:
+      - '**.md'
+  push:
+    branches: [main]
+    paths-ignore:
+      - '**.md'
+
+# Never let two deploys interleave (build/up/rollback flapping).
+concurrency:
+  group: crypto-trading-deploy
+  cancel-in-progress: false
+
+jobs:
+  backend:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: "pip"
+          cache-dependency-path: backend/requirements.txt
+
+      - name: Install dependencies
+        run: pip install -r backend/requirements-dev.txt
+
+      - name: Lint (ruff)
+        run: |
+          cd backend
+          ruff check .
+          ruff format --check .
+
+      - name: Run tests
+        run: cd backend && python -m pytest -q
+
+  frontend:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: "npm"
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install dependencies
+        run: cd frontend && npm ci
+
+      - name: Test
+        run: cd frontend && npm test
+
+      - name: Build
+        run: cd frontend && npm run build
+
+  build:
+    runs-on: ubuntu-latest
+    needs: [backend, frontend]
+    if: github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Log in to Docker Hub (optional)
+        env:
+          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+        run: |
+          if [ -n "$DOCKERHUB_USERNAME" ] && [ -n "$DOCKERHUB_TOKEN" ]; then
+            echo "$DOCKERHUB_TOKEN" | docker login -u "$DOCKERHUB_USERNAME" --password-stdin
+          else
+            echo "Docker Hub credentials not set; using anonymous pulls"
+          fi
+
+      - name: Build backend
+        run: |
+          for i in 1 2 3; do
+            docker build -t crypto_trading-backend ./backend && exit 0
+            echo "backend build failed (attempt $i); retrying in 30s"; sleep 30
+          done
+          exit 1
+
+      - name: Build frontend
+        run: |
+          for i in 1 2 3; do
+            docker build -t crypto_trading-frontend ./frontend && exit 0
+            echo "frontend build failed (attempt $i); retrying in 30s"; sleep 30
+          done
+          exit 1
+
+  deploy:
+    runs-on: ubuntu-latest
+    needs: build
+    if: github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
+    env:
+      BASE_DOMAIN: ${{ secrets.BASE_DOMAIN || 'matitos.org' }}
+      # htpasswd string for the WebUI. Prefer the crypto-trading specific
+      # variable/secret, falling back to the shared org-level SCA users. The
+      # compose basicauth middleware is fail-closed, so it must be present for
+      # every `docker compose` command in this job to interpolate the file.
+      CRYPTO_FRONTEND_AUTH_USERS: ${{ vars.CRYPTO_FRONTEND_AUTH_USERS || secrets.CRYPTO_FRONTEND_AUTH_USERS || vars.SCA_FRONTEND_AUTH_USERS || secrets.SCA_FRONTEND_AUTH_USERS }}
+      CRYPTO_MODE: ${{ vars.CRYPTO_MODE || 'paper' }}
+      CRYPTO_EXCHANGE: ${{ vars.CRYPTO_EXCHANGE || 'binance' }}
+      CRYPTO_SYMBOL: ${{ vars.CRYPTO_SYMBOL || 'BTC/USDT' }}
+      CRYPTO_TIMEFRAME: ${{ vars.CRYPTO_TIMEFRAME || '1m' }}
+      CRYPTO_POLL_INTERVAL: ${{ vars.CRYPTO_POLL_INTERVAL || '5' }}
+      CRYPTO_STARTING_BALANCE: ${{ vars.CRYPTO_STARTING_BALANCE || '10000' }}
+      CRYPTO_CORS_ORIGINS: ${{ vars.CRYPTO_CORS_ORIGINS || format('https://crypto.{0}', secrets.BASE_DOMAIN || 'matitos.org') }}
+      CRYPTO_EXCHANGE_API_KEY: ${{ secrets.CRYPTO_EXCHANGE_API_KEY }}
+      CRYPTO_EXCHANGE_API_SECRET: ${{ secrets.CRYPTO_EXCHANGE_API_SECRET }}
+      CRYPTO_EXCHANGE_SANDBOX: ${{ vars.CRYPTO_EXCHANGE_SANDBOX || 'false' }}
+      CRYPTO_AUTH_RATE_LIMIT_AVERAGE: ${{ vars.CRYPTO_AUTH_RATE_LIMIT_AVERAGE || '10' }}
+      CRYPTO_AUTH_RATE_LIMIT_BURST: ${{ vars.CRYPTO_AUTH_RATE_LIMIT_BURST || '5' }}
+      # Persistent data root: repo var wins, else derive from the org
+      # PERSISTENT_MOUNT (absolute HOST path), else the workspace fallback.
+      CRYPTO_DATA_DIR: ${{ vars.CRYPTO_DATA_DIR || (vars.PERSISTENT_MOUNT && format('{0}/crypto_trading', vars.PERSISTENT_MOUNT)) || './data' }}
+      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Require CRYPTO_FRONTEND_AUTH_USERS
+        run: |
+          # The compose basicauth middleware is fail-closed, so refuse early
+          # with a clear message instead of starting an unauthenticated UI that
+          # can control a trading bot.
+          if [ -z "$CRYPTO_FRONTEND_AUTH_USERS" ]; then
+            echo "::error::CRYPTO_FRONTEND_AUTH_USERS is not set (repo/org variable or secret); refusing to deploy"
+            exit 1
+          fi
+
+      - name: Log in to Docker Hub (optional)
+        run: |
+          if [ -n "$DOCKERHUB_USERNAME" ] && [ -n "$DOCKERHUB_TOKEN" ]; then
+            echo "$DOCKERHUB_TOKEN" | docker login -u "$DOCKERHUB_USERNAME" --password-stdin
+          else
+            echo "Docker Hub credentials not set; using anonymous pulls"
+          fi
+
+      - name: Deploy with Docker Compose
+        run: |
+          echo "Deploying to crypto.${BASE_DOMAIN} (mode=${CRYPTO_MODE})"
+          echo "Data dir: ${CRYPTO_DATA_DIR}"
+          # Keep the currently-running images so we can roll back on failure.
+          for img in crypto_trading-backend crypto_trading-frontend; do
+            if docker image inspect "$img" >/dev/null 2>&1; then
+              docker tag "$img" "${img}:prev"
+            fi
+          done
+          built=0
+          for i in 1 2 3 4 5; do
+            if docker compose build; then built=1; break; fi
+            echo "docker compose build failed (attempt $i); retrying in 30s"
+            sleep 30
+          done
+          [ "$built" = "1" ] || { echo "::error::compose build failed after retries"; exit 1; }
+          # Bring the new stack up and wait for healthchecks. No pre-`down`, so
+          # the old containers keep serving until the new ones are healthy.
+          if ! docker compose up -d --remove-orphans --wait --wait-timeout 300; then
+            echo "::error::New stack is unhealthy; rolling back to previous images"
+            docker compose down --remove-orphans || true
+            for img in crypto_trading-backend crypto_trading-frontend; do
+              if docker image inspect "${img}:prev" >/dev/null 2>&1; then
+                docker tag "${img}:prev" "$img"
+              fi
+            done
+            docker compose up -d --remove-orphans --wait --wait-timeout 300 || true
+            exit 1
+          fi
+
+      - name: Services and recent logs
+        run: |
+          docker compose ps
+          docker compose logs --tail=80
+
+      - name: Health check (HTTP)
+        run: |
+          probe_backend() {
+            docker compose exec -T backend python -c \
+              "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8000/api/health', timeout=5).status==200 else 1)"
+          }
+          probe_frontend() {
+            docker compose exec -T frontend wget -q --spider http://127.0.0.1:80/
+          }
+          for i in 1 2 3 4 5 6; do
+            echo "Attempt $i/6..."
+            if probe_backend && probe_frontend; then
+              echo "All services healthy"
+              exit 0
+            fi
+            sleep 15
+          done
+          echo "::error::Health checks failed; rolling back"
+          docker compose down --remove-orphans || true
+          for img in crypto_trading-backend crypto_trading-frontend; do
+            if docker image inspect "${img}:prev" >/dev/null 2>&1; then
+              docker tag "${img}:prev" "$img"
+            fi
+          done
+          docker compose up -d --remove-orphans --wait --wait-timeout 300 || true
+          exit 1
+
+  cleanup:
+    runs-on: ubuntu-latest
+    needs: [backend, frontend]
+    if: github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Delete branches merged into main
+        run: |
+          git fetch --all --prune
+          git branch -r --merged origin/main \
+            | grep -vE 'origin/(main|HEAD)([[:space:]]|$)' \
+            | sed -E 's|^[[:space:]]*origin/||' \
+            | while read -r branch; do
+                [ -z "$branch" ] && continue
+                echo "Deleting merged branch: $branch"
+                git push origin --delete "$branch" || echo "  (could not delete $branch)"
+              done