File size: 1,889 Bytes
2e658e7
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
#!/usr/bin/env python3
"""CI negative gates: prove unsafe inputs and deliberate faults fail closed."""
from __future__ import annotations

import os
import sys
import tempfile
from pathlib import Path

ROOT = Path(__file__).resolve().parents[1]
sys.path.insert(0, str(ROOT / "hermes_overlay"))
sys.path.insert(0, str(ROOT / "scripts"))

from trading.config_validation import validate_configuration  # noqa: E402
from trading.futures_execution import is_execution_enabled  # noqa: E402
from ci_secret_scan import scan  # noqa: E402


def main() -> int:
    failures: list[str] = []
    if validate_configuration({"TRADING_MODE": "paper", "SYNC_INTERVAL": "0"}).safe:
        failures.append("zero sync interval did not fail")
    if validate_configuration({
        "TRADING_MODE": "live",
        "HERMES_EXECUTION_ENABLED": "true",
        "HERMES_NONPAPER_EXECUTION_ENABLED": "true",
        "FUTURES_API_KEY": "test-key-value-123456",
        "FUTURES_API_SECRET": "test-secret-value-123456",
    }).safe:
        failures.append("fully armed non-Paper config did not fail")
    previous = os.environ.pop("HERMES_EXECUTION_ENABLED", None)
    try:
        if is_execution_enabled():
            failures.append("execution kill switch did not default off")
    finally:
        if previous is not None:
            os.environ["HERMES_EXECUTION_ENABLED"] = previous
    with tempfile.TemporaryDirectory() as tmp:
        leak = Path(tmp) / "leak.txt"
        leak.write_text('api_key = "abcdefghijklmnopqrstuvwxyz123456"', encoding="utf-8")
        if not scan(Path(tmp), allow_fixtures=False):
            failures.append("secret fixture did not trigger scanner")
    for item in failures:
        print(f"ERROR: {item}")
    print(f"required_failure_checks={'PASS' if not failures else 'FAIL'}")
    return 1 if failures else 0


if __name__ == "__main__":
    raise SystemExit(main())