FirstradePlatform/.github/workflows/runtime-guard.yml at main · QuantStrategyLab/FirstradePlatform · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
name: Runtime Guard

on:
  workflow_dispatch:
    inputs:
      lookback_minutes:
        description: "Cloud Logging lookback window in minutes."
        required: false
        type: string
        default: "180"
      require_success:
        description: "Alert if no successful Cloud Run request exists in the lookback window."
        required: false
        type: choice
        default: "false"
        options:
          - "false"
          - "true"
      fail_workflow_on_alert:
        description: "Fail this workflow when an alert is emitted."
        required: false
        type: choice
        default: "true"
        options:
          - "true"
          - "false"
  schedule:
    - cron: "17,47 * * * *"

env:
  GCP_PROJECT_ID: firstradequant
  GCP_WORKLOAD_IDENTITY_PROVIDER: projects/1088907247379/locations/global/workloadIdentityPools/github-actions/providers/github-main
  GCP_WORKLOAD_IDENTITY_SERVICE_ACCOUNT: firstrade-platform-deploy@firstradequant.iam.gserviceaccount.com

concurrency:
  group: ${{ github.workflow }}-${{ github.ref_name }}
  cancel-in-progress: false

jobs:
  guard:
    name: Check Cloud Run runtime
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
      id-token: write
    env:
      RUNTIME_GUARD_NAME: FirstradePlatform
      RUNTIME_GUARD_CLOUD_RUN_SERVICES: ${{ vars.RUNTIME_GUARD_CLOUD_RUN_SERVICES }}
      RUNTIME_GUARD_LOOKBACK_MINUTES: ${{ inputs.lookback_minutes || vars.RUNTIME_GUARD_LOOKBACK_MINUTES || '180' }}
      RUNTIME_GUARD_REQUIRE_SUCCESS: ${{ inputs.require_success || vars.RUNTIME_GUARD_REQUIRE_SUCCESS || 'false' }}
      RUNTIME_GUARD_FAIL_WORKFLOW_ON_ALERT: ${{ inputs.fail_workflow_on_alert || vars.RUNTIME_GUARD_FAIL_WORKFLOW_ON_ALERT || 'true' }}
      RUNTIME_GUARD_SCHEDULER_JOB_PATTERN: ${{ vars.RUNTIME_GUARD_SCHEDULER_JOB_PATTERN }}
      CLOUD_RUN_SERVICE: ${{ vars.CLOUD_RUN_SERVICE }}
      GLOBAL_TELEGRAM_CHAT_ID: ${{ vars.GLOBAL_TELEGRAM_CHAT_ID }}
      TELEGRAM_TOKEN: ${{ secrets.TELEGRAM_TOKEN }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Authenticate to Google Cloud
        uses: google-github-actions/auth@v3
        with:
          workload_identity_provider: ${{ env.GCP_WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ env.GCP_WORKLOAD_IDENTITY_SERVICE_ACCOUNT }}

      - name: Set up gcloud
        uses: google-github-actions/setup-gcloud@v3

      - name: Check Cloud Scheduler and Cloud Run logs
        run: python scripts/cloud_run_runtime_guard.py