Add LongBridge API probe workflow

[Pigbibi]

Summary

• add a manual LongBridge API Probe workflow that runs only against the longbridge-hk GitHub Environment
• use GitHub OIDC to read HK LongPort app credentials and token from Secret Manager
• checkout a selected QuantPlatformKit ref and run its skipped fractional-order API probe against the HK simulated account
• document the manual probe and add workflow structure coverage

Validation

• /home/ubuntu/Projects/LongBridgePlatform/.venv/bin/python -m unittest tests.test_longbridge_api_probe_workflow -v
• bash tests/test_longbridge_api_probe_workflow.sh
• /home/ubuntu/Projects/LongBridgePlatform/.venv/bin/python -m ruff check tests/test_longbridge_api_probe_workflow.py
• git diff --check

Notes

The workflow does not run on normal CI or push events. After the QuantPlatformKit probe PR lands, trigger this workflow manually with qpk_ref=main to test the HK simulated LongBridge API.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5e31e2320d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Prevent running editable install after exporting LongPort secrets

The workflow allows a user-provided qpk_ref to control which QuantPlatformKit code is checked out, then exports LONGPORT_* credentials to GITHUB_ENV before running python -m pip install -e quant-platform-kit pytest longport. Editable installs can execute package build/install hooks from that checked-out ref, so a malicious or unreviewed ref can read and exfiltrate the broker credentials during install. This is a real secret-exposure path whenever the dispatch input is set to an untrusted ref; move secret export after all untrusted code execution or restrict qpk_ref to trusted immutable refs.

Useful? React with 👍 / 👎.