Spaces:
Sleeping
Sleeping
File size: 1,889 Bytes
2e658e7 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 | #!/usr/bin/env python3
"""CI negative gates: prove unsafe inputs and deliberate faults fail closed."""
from __future__ import annotations
import os
import sys
import tempfile
from pathlib import Path
ROOT = Path(__file__).resolve().parents[1]
sys.path.insert(0, str(ROOT / "hermes_overlay"))
sys.path.insert(0, str(ROOT / "scripts"))
from trading.config_validation import validate_configuration # noqa: E402
from trading.futures_execution import is_execution_enabled # noqa: E402
from ci_secret_scan import scan # noqa: E402
def main() -> int:
failures: list[str] = []
if validate_configuration({"TRADING_MODE": "paper", "SYNC_INTERVAL": "0"}).safe:
failures.append("zero sync interval did not fail")
if validate_configuration({
"TRADING_MODE": "live",
"HERMES_EXECUTION_ENABLED": "true",
"HERMES_NONPAPER_EXECUTION_ENABLED": "true",
"FUTURES_API_KEY": "test-key-value-123456",
"FUTURES_API_SECRET": "test-secret-value-123456",
}).safe:
failures.append("fully armed non-Paper config did not fail")
previous = os.environ.pop("HERMES_EXECUTION_ENABLED", None)
try:
if is_execution_enabled():
failures.append("execution kill switch did not default off")
finally:
if previous is not None:
os.environ["HERMES_EXECUTION_ENABLED"] = previous
with tempfile.TemporaryDirectory() as tmp:
leak = Path(tmp) / "leak.txt"
leak.write_text('api_key = "abcdefghijklmnopqrstuvwxyz123456"', encoding="utf-8")
if not scan(Path(tmp), allow_fixtures=False):
failures.append("secret fixture did not trigger scanner")
for item in failures:
print(f"ERROR: {item}")
print(f"required_failure_checks={'PASS' if not failures else 'FAIL'}")
return 1 if failures else 0
if __name__ == "__main__":
raise SystemExit(main())
|