[truealpha-bt] Enforce required CI before merge and release

[wangzitian0]

Dependency

#199 merged as ba34a31a219ba5c9057f1a4694c7ea02fbdeb88a. This PR is rebased onto that exact main commit, its Gate manifest integration base is refreshed, and its diff contains only the merge and release gate.

Summary

• add one always-present, path-aware ci-required result
• convert database, Python, Qlib, runtime, web, governance, security, and image workflows into reusable checks
• make database changes run Python integration coverage and make affected Qlib runtime tests non-optional
• use frozen Python dependency synchronization and add bounded job timeouts
• build PR images without publishing and publish main/tag images only after all exact-SHA prerequisites pass
• isolate packages: write to publication and emit provenance/SBOM metadata
• add CODEOWNERS routing for CI and governance controls
• include the data-engine image from [truealpha-datahub] Accept full-denominator Yahoo persistence #196 automatically when its Dockerfile exists

Root cause

Component workflows used workflow-level path filters, so they could not all be required without leaving unaffected PRs permanently pending. No terminal aggregate distinguished an intentional skip from a failed required component. Image publication listened directly to push events and could therefore publish a SHA independently of governance or functional CI.

Evidence and ceiling

Passed:

• actionlint .github/workflows/*.yml
• uv run pytest libs/runtime/tests/test_delivery_governance.py libs/runtime/tests/test_gate0_candidate.py -q (101 passed)
• uv run --project libs/factors/qlib-runtime pytest libs/factors/tests/batches/issuer_strategy_selection_tiny libs/factors/tests/batches/qlib_expression_contract_tiny -q (33 passed, no optional skip)
• make gate0-candidate-check
• make issue-graph-check
• uv run ruff check libs/runtime/tests/test_delivery_governance.py
• exact-head offline graph, live GitHub parity, and pull-request authorization validation

Static regression tests require the aggregate to consume every reusable workflow, reject any result other than success/explicit skip, prohibit direct release push/PR triggers, and place publication after both image build and all required checks.

This PR changes CI/release enforcement only. It does not accept Gate 0 or claim Production readiness.

Repository setting follow-up

The repository currently has only one write collaborator, wangzitian0. Enabling one required independent approval would make author-owned PRs impossible to merge. CODEOWNERS routing is included; the approval rule remains an explicit external prerequisite after a second write collaborator is added.

Manifest: governance/gate0/manifest-v4.json

Manifest SHA-256: 0e7ff13b56240b783e5e4b79c27fdb284b68ec92f8f18bb2f29a3583475636fa

Closes #198

[wangzitian0]

Final stacked-head verification passed in https://github.com/wangzitian0/truealpha/actions/runs/29391378668. The terminal ci-required check consumed the affected database, Python, Qlib, runtime, web, governance, security, and image jobs and passed. Image publication was correctly skipped for the pull request.

This PR is ready for review after #199; do not squash it into the dependency branch. After #199 merges, retarget/rebase this PR, refresh the Gate manifest hashes, and rerun before changing the main ruleset.

[Copilot]

Pull request overview

This PR restructures CI and image publication around a single always-present ci-required workflow that is path-aware, aggregates reusable component checks, and gates image publication on the exact SHA’s prerequisite results. It fits into the repo’s Delivery Governance model by making “mergeable” and “releasable” depend on a deterministic, terminal CI outcome rather than path-filtered workflows that may not emit statuses.

Changes:

• Introduces ci-required as a terminal aggregate that runs (or explicitly skips) DB/Python/Qlib/runtime/web/governance/security/images based on changed paths.
• Converts multiple component workflows (DB/Python/runtime/web/governance/security/images) to reusable workflow_call checks, adds bounded timeouts, and freezes dependency sync (uv ... --frozen).
• Refactors batch-issue syncing into a dedicated reusable workflow and updates Gate 0 manifest hashes for the new control surface.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
libs/runtime/tests/test_delivery_governance.py	Updates governance regression tests to validate the new ci-required caller/aggregate and reusable workflows.
governance/gate0/manifest-v4.json	Refreshes integration base SHA and candidate tree hash for the new CI/governance control surface.
.github/workflows/ci-required.yml	Adds the always-present, path-aware aggregate workflow and gates image publication behind required checks.
.github/workflows/ci-governance.yml	Converts governance validation to a reusable workflow and keys PR authorization to passed-in exact SHAs.
.github/workflows/ci-python.yml	Makes Python CI reusable; freezes deps; adds bounded timeouts and improves MinIO readiness output.
.github/workflows/ci-db.yml	Makes DB migration check reusable and bounded.
.github/workflows/ci-runtime.yml	Makes runtime smoke check reusable and bounded.
.github/workflows/ci-web.yml	Makes web check reusable and bounded.
.github/workflows/ci-qlib.yml	Adds a reusable Qlib runtime test workflow with frozen deps and no optional skips.
.github/workflows/security-gate.yml	Moves PR/main execution under ci-required via workflow_call, keeps direct scanning for feature-branch pushes.
.github/workflows/release-images.yml	Makes image build/publish reusable; builds on PRs without push; publishes only when called with publish: true, with provenance/SBOM enabled.
.github/workflows/sync-batch-issues.yml	Adds reusable batch issue status/body mirroring on main pushes after governance validation.
.github/CODEOWNERS	Adds owner routing for CI/governance control paths.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[wangzitian0]

Rebased onto the actual #199 squash merge, ba34a31a219ba5c9057f1a4694c7ea02fbdeb88a, and refreshed the Gate manifest integration base. New head: 58de3d6; new manifest SHA-256: 824c347b3a4abef913127565dd56ee4c523ac1918f8306fd0d9e1ca6f3f128a3. Local Gate validation, issue-graph validation, and 101 governance regression tests pass. Awaiting exact-head GitHub CI.

[wangzitian0]

Exact-head CI passed after rebase: https://github.com/wangzitian0/truealpha/actions/runs/29392261634. The active main ruleset now requires ci-required; legacy contexts were removed. No bypass was added.

[wangzitian0]

The first post-review run correctly failed closed because ruff format --check rejected the new regression test; image jobs were blocked. Formatted the test in d10fe51. Local Ruff, Gate validation, issue graph, and 102 governance tests now pass. New manifest SHA-256: 0e7ff13b56240b783e5e4b79c27fdb284b68ec92f8f18bb2f29a3583475636fa.

[wangzitian0]

Final exact-head verification passed at d10fe517906f2de0ccdc46efa9fff9a3f5252eaf: https://github.com/wangzitian0/truealpha/actions/runs/29392635908. All required component checks and image builds passed, PR publication was skipped, terminal ci-required passed, all review threads are resolved, and GitHub reports MERGEABLE/CLEAN.