feat(risk): stack Greeks/VaR as two 3-column rows + Marginal-VaR care… #374
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: codeql | |
| # CodeQL static analysis. Scans the Python backend (FastAPI + engines + | |
| # shared + core) and the JavaScript/TypeScript frontend for the usual | |
| # security + correctness suspects (SQLi, path traversal, XSS, insecure | |
| # deserialization, taint flows into subprocess, etc.). | |
| # | |
| # Triggers : pull requests against main (catch issues before merge), | |
| # pushes on main (baseline tracking), and a weekly scheduled run so | |
| # new CodeQL rules get applied to old code without requiring a push. | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| # 07:13 UTC every Monday — off-peak, doesn't collide with deploy slots. | |
| - cron: "13 7 * * 1" | |
| permissions: | |
| # CodeQL needs to write scan results to the Security tab. | |
| security-events: write | |
| # Required by actions/checkout and to read package manifests. | |
| contents: read | |
| actions: read | |
| jobs: | |
| analyze: | |
| name: CodeQL (${{ matrix.language }}) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - language: python | |
| # Setup-python for better autobuild resolution. | |
| setup: python | |
| - language: javascript-typescript | |
| setup: node | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Set up Python 3.11 | |
| if: matrix.setup == 'python' | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.11" | |
| - name: Install Python dependencies (for CodeQL autobuild) | |
| if: matrix.setup == 'python' | |
| # Project's single source of truth = pyproject.toml. The api + | |
| # quant extras pull in enough of the codebase (FastAPI app, ORM, | |
| # vol/risk engines) for CodeQL's autobuild step to resolve all | |
| # imports it scans. | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -e ".[api,quant]" | |
| - name: Set up Node 20 | |
| if: matrix.setup == 'node' | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: "20" | |
| cache: "npm" | |
| cache-dependency-path: frontend/package-lock.json | |
| - name: Install frontend dependencies | |
| if: matrix.setup == 'node' | |
| working-directory: frontend | |
| run: npm ci | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v3 | |
| with: | |
| languages: ${{ matrix.language }} | |
| # security-extended picks the broader rule set (OWASP + CWE top 25) | |
| # at the cost of a slightly longer run. | |
| queries: security-extended | |
| - name: Autobuild | |
| uses: github/codeql-action/autobuild@v3 | |
| - name: Perform CodeQL analysis | |
| uses: github/codeql-action/analyze@v3 | |
| with: | |
| category: "/language:${{ matrix.language }}" |