Support secret-backed Telegram token sync

Author: Pigbibi

.github/workflows/sync-cloud-run-env.yml

@@ -12,6 +12,7 @@ jobs:
       ENABLE_GITHUB_ENV_SYNC: ${{ vars.ENABLE_GITHUB_ENV_SYNC }}
       CLOUD_RUN_REGION: ${{ vars.CLOUD_RUN_REGION }}
       CLOUD_RUN_SERVICE: ${{ vars.CLOUD_RUN_SERVICE }}
+      TELEGRAM_TOKEN_SECRET_NAME: ${{ vars.TELEGRAM_TOKEN_SECRET_NAME }}
       STRATEGY_PROFILE: ${{ vars.STRATEGY_PROFILE }}
       ACCOUNT_GROUP: ${{ vars.ACCOUNT_GROUP }}
       IB_ACCOUNT_GROUP_CONFIG_SECRET_NAME: ${{ vars.IB_ACCOUNT_GROUP_CONFIG_SECRET_NAME }}
@@ -42,7 +43,6 @@ jobs:
             GLOBAL_TELEGRAM_CHAT_ID
             NOTIFY_LANG
             GCP_SA_KEY
-            TELEGRAM_TOKEN
           )
 
           missing_vars=()
@@ -52,6 +52,10 @@ jobs:
             fi
           done
 
+          if [ -z "${TELEGRAM_TOKEN_SECRET_NAME:-}" ] && [ -z "${TELEGRAM_TOKEN:-}" ]; then
+            missing_vars+=("TELEGRAM_TOKEN_SECRET_NAME or TELEGRAM_TOKEN")
+          fi
+
           if [ "${#missing_vars[@]}" -gt 0 ]; then
             echo "enabled=false" >> "$GITHUB_OUTPUT"
             echo "Cloud Run env sync is enabled, but these values are missing:" >&2
@@ -81,13 +85,13 @@ jobs:
           set -euo pipefail
 
           env_pairs=(
-            "TELEGRAM_TOKEN=${TELEGRAM_TOKEN}"
             "GLOBAL_TELEGRAM_CHAT_ID=${GLOBAL_TELEGRAM_CHAT_ID}"
             "NOTIFY_LANG=${NOTIFY_LANG}"
             "STRATEGY_PROFILE=${STRATEGY_PROFILE}"
             "ACCOUNT_GROUP=${ACCOUNT_GROUP}"
             "IB_ACCOUNT_GROUP_CONFIG_SECRET_NAME=${IB_ACCOUNT_GROUP_CONFIG_SECRET_NAME}"
           )
+          secret_pairs=()
 
           remove_env_vars=(
             "IB_GATEWAY_HOST"
@@ -97,6 +101,14 @@ jobs:
             "IB_GATEWAY_INSTANCE_NAME"
             "IB_GATEWAY_MODE"
           )
+          remove_secret_vars=()
+
+          if [ -n "${TELEGRAM_TOKEN_SECRET_NAME:-}" ]; then
+            secret_pairs+=("TELEGRAM_TOKEN=${TELEGRAM_TOKEN_SECRET_NAME}:latest")
+          else
+            env_pairs+=("TELEGRAM_TOKEN=${TELEGRAM_TOKEN}")
+            remove_secret_vars+=("TELEGRAM_TOKEN")
+          fi
 
           if [ -n "${IB_GATEWAY_ZONE:-}" ]; then
             env_pairs+=("IB_GATEWAY_ZONE=${IB_GATEWAY_ZONE}")
@@ -110,7 +122,19 @@ jobs:
             remove_env_vars+=("IB_GATEWAY_IP_MODE")
           fi
 
-          gcloud run services update "${CLOUD_RUN_SERVICE}" \
-            --region "${CLOUD_RUN_REGION}" \
-            --remove-env-vars "$(IFS=,; echo "${remove_env_vars[*]}")" \
+          gcloud_args=(
+            run services update "${CLOUD_RUN_SERVICE}"
+            --region "${CLOUD_RUN_REGION}"
+            --remove-env-vars "$(IFS=,; echo "${remove_env_vars[*]}")"
             --update-env-vars "$(IFS=,; echo "${env_pairs[*]}")"
+          )
+
+          if [ "${#remove_secret_vars[@]}" -gt 0 ]; then
+            gcloud_args+=(--remove-secrets "$(IFS=,; echo "${remove_secret_vars[*]}")")
+          fi
+
+          if [ "${#secret_pairs[@]}" -gt 0 ]; then
+            gcloud_args+=(--update-secrets "$(IFS=,; echo "${secret_pairs[*]}")")
+          fi
+
+          gcloud "${gcloud_args[@]}"

README.md

@@ -109,7 +109,7 @@ The selected `ACCOUNT_GROUP` is now the runtime identity. Keep broker-specific i
 | `ACCOUNT_GROUP` | Yes | Account-group selector. No default fallback. |
 | `IB_ACCOUNT_GROUP_CONFIG_SECRET_NAME` | Yes for Cloud Run | Secret Manager secret name for account-group config JSON. Recommended production source. |
 | `IB_ACCOUNT_GROUP_CONFIG_JSON` | No | Local/dev JSON fallback for account-group config. Not recommended for production Cloud Run. |
-| `TELEGRAM_TOKEN` | Yes | Telegram bot token |
+| `TELEGRAM_TOKEN` | Yes | Telegram bot token. For Cloud Run, prefer a Secret Manager reference instead of a literal env var. |
 | `GLOBAL_TELEGRAM_CHAT_ID` | Yes | Telegram chat ID used by this service. |
 | `NOTIFY_LANG` | No | `en` (default) or `zh` |
 
@@ -155,7 +155,7 @@ Recommended account-group config payload:
       "ib_gateway_mode": "paper",
       "ib_gateway_ip_mode": "internal",
       "ib_client_id": 1,
-      "service_name": "interactive-brokers-quant",
+      "service_name": "interactive-brokers-quant-global-etf-rotation",
       "account_ids": ["DU1234567"]
     },
     "ira": {
@@ -164,7 +164,7 @@ Recommended account-group config payload:
       "ib_gateway_mode": "paper",
       "ib_gateway_ip_mode": "internal",
       "ib_client_id": 7,
-      "service_name": "interactive-brokers-quant-ira",
+      "service_name": "interactive-brokers-quant-global-etf-rotation-ira",
       "account_ids": ["U1234567"]
     }
   }
@@ -190,14 +190,15 @@ Recommended setup:
   - `ENABLE_GITHUB_ENV_SYNC` = `true`
   - `CLOUD_RUN_REGION`
   - `CLOUD_RUN_SERVICE`
+  - `TELEGRAM_TOKEN_SECRET_NAME` (recommended when Cloud Run already uses Secret Manager for `TELEGRAM_TOKEN`)
   - `STRATEGY_PROFILE` (recommended: `global_etf_rotation`)
   - `ACCOUNT_GROUP` (recommended: `default`)
   - `IB_ACCOUNT_GROUP_CONFIG_SECRET_NAME`
   - `GLOBAL_TELEGRAM_CHAT_ID`
   - `NOTIFY_LANG`
 - **Repository Secrets**
   - `GCP_SA_KEY`
-  - `TELEGRAM_TOKEN`
+  - `TELEGRAM_TOKEN` (fallback only when `TELEGRAM_TOKEN_SECRET_NAME` is not set)
 - **Optional transition Variables**
   - `IB_GATEWAY_ZONE`
   - `IB_GATEWAY_IP_MODE`
@@ -209,14 +210,14 @@ For now, `STRATEGY_PROFILE` still only supports one strategy profile. `ACCOUNT_G
 Important:
 
 - The workflow only becomes strict when `ENABLE_GITHUB_ENV_SYNC=true`. If this variable is unset, the sync job is skipped.
-- Here "shared config" still only means the **IBKR pair** (`IBKRQuant` + `IBKRGatewayManager`). `GCP_SA_KEY` and `TELEGRAM_TOKEN` remain repository-specific.
+- Here "shared config" still only means the **IBKR pair** (`InteractiveBrokersPlatform` + `IBKRGatewayManager`). `GCP_SA_KEY`, `TELEGRAM_TOKEN`, and `TELEGRAM_TOKEN_SECRET_NAME` remain repository-specific.
 - If `IB_ACCOUNT_GROUP_CONFIG_SECRET_NAME` is set, the Cloud Run runtime needs Secret Manager access to that secret.
 - `GCP_SA_KEY` belongs to the GitHub Actions deploy identity, not to the Cloud Run runtime service account.
 
 ### Deployment unit and naming
 
-- `QuantPlatformKit` is only a shared dependency; Cloud Run still deploys `InteractiveBrokersQuant` itself.
-- Recommended Cloud Run service name: `interactive-brokers-quant`.
+- `QuantPlatformKit` is only a shared dependency; Cloud Run now deploys `InteractiveBrokersPlatform`.
+- Recommended Cloud Run service name: `interactive-brokers-quant-global-etf-rotation`.
 - For future multi-account rollout, keep one Cloud Run service per `ACCOUNT_GROUP`, and let each service select its account-group config at runtime.
 - If you later rename or move this repository, reselect the GitHub source in Cloud Build / Cloud Run trigger instead of assuming the existing source binding will update itself.
 - For the shared deployment model and trigger migration checklist, see [`QuantPlatformKit/docs/deployment_model.md`](../QuantPlatformKit/docs/deployment_model.md).
@@ -233,7 +234,7 @@ Important:
 Example deploy/update command:
 
 ```bash
-gcloud run deploy interactive-brokers-quant \
+gcloud run deploy interactive-brokers-quant-global-etf-rotation \
   --source . \
   --region us-central1 \
   --service-account interactive-brokers-quant-runtime@PROJECT_ID.iam.gserviceaccount.com \
@@ -320,7 +321,7 @@ IBKR 账户
 | `ACCOUNT_GROUP` | 是 | 账号组选择器，不再提供默认回退。 |
 | `IB_ACCOUNT_GROUP_CONFIG_SECRET_NAME` | Cloud Run 建议必填 | 账号组配置 JSON 在 Secret Manager 里的密钥名。生产环境推荐使用。 |
 | `IB_ACCOUNT_GROUP_CONFIG_JSON` | 否 | 本地开发用的账号组配置 JSON fallback。不建议在生产 Cloud Run 直接使用。 |
-| `TELEGRAM_TOKEN` | 是 | Telegram 机器人 Token |
+| `TELEGRAM_TOKEN` | 是 | Telegram 机器人 Token。Cloud Run 上更推荐走 Secret Manager 引用，不要直接写成明文 env。 |
 | `GLOBAL_TELEGRAM_CHAT_ID` | 是 | 这个服务使用的 Telegram Chat ID。 |
 | `NOTIFY_LANG` | 否 | `en`（默认）或 `zh` |
 
@@ -366,7 +367,7 @@ IB_GATEWAY_IP_MODE=internal
       "ib_gateway_mode": "paper",
       "ib_gateway_ip_mode": "internal",
       "ib_client_id": 1,
-      "service_name": "interactive-brokers-quant",
+      "service_name": "interactive-brokers-quant-global-etf-rotation",
       "account_ids": ["DU1234567"]
     },
     "ira": {
@@ -375,7 +376,7 @@ IB_GATEWAY_IP_MODE=internal
       "ib_gateway_mode": "paper",
       "ib_gateway_ip_mode": "internal",
       "ib_client_id": 7,
-      "service_name": "interactive-brokers-quant-ira",
+      "service_name": "interactive-brokers-quant-global-etf-rotation-ira",
       "account_ids": ["U1234567"]
     }
   }
@@ -401,14 +402,15 @@ IB_GATEWAY_IP_MODE=internal
   - `ENABLE_GITHUB_ENV_SYNC` = `true`
   - `CLOUD_RUN_REGION`
   - `CLOUD_RUN_SERVICE`
+  - `TELEGRAM_TOKEN_SECRET_NAME`（如果 Cloud Run 上的 `TELEGRAM_TOKEN` 已经改成 Secret Manager，建议配置）
   - `STRATEGY_PROFILE`（建议设为 `global_etf_rotation`）
   - `ACCOUNT_GROUP`（建议设为 `default`）
   - `IB_ACCOUNT_GROUP_CONFIG_SECRET_NAME`
   - `GLOBAL_TELEGRAM_CHAT_ID`
   - `NOTIFY_LANG`
 - **仓库级 Secrets**
   - `GCP_SA_KEY`
-  - `TELEGRAM_TOKEN`
+  - `TELEGRAM_TOKEN`（仅在没设置 `TELEGRAM_TOKEN_SECRET_NAME` 时作为 fallback）
 - **可选过渡 Variables**
   - `IB_GATEWAY_ZONE`
   - `IB_GATEWAY_IP_MODE`
@@ -420,14 +422,14 @@ IB_GATEWAY_IP_MODE=internal
 注意：
 
 - 只有在 `ENABLE_GITHUB_ENV_SYNC=true` 时，这个 workflow 才会严格校验并执行同步。没打开时会直接跳过。
-- 这里说的“共享配置”仍然只针对 **IBKR 这一组系统**。`GCP_SA_KEY` 和 `TELEGRAM_TOKEN` 依然是这个仓库自己的 secrets，不建议提升成所有 quant 共用的全局 secret。
+- 这里说的“共享配置”仍然只针对 **IBKR 这一组系统**。`GCP_SA_KEY`、`TELEGRAM_TOKEN` 和 `TELEGRAM_TOKEN_SECRET_NAME` 都还是这个仓库自己的配置，不建议提升成所有 quant 共用的全局配置。
 - 如果设置了 `IB_ACCOUNT_GROUP_CONFIG_SECRET_NAME`，Cloud Run 运行时还需要有对应 Secret 的访问权限。
 - `GCP_SA_KEY` 对应的是 GitHub Actions 的部署身份，不是 Cloud Run runtime service account。
 
 ### 部署单元和命名建议
 
-- `QuantPlatformKit` 只是共享依赖，不单独部署；Cloud Run 继续只部署 `InteractiveBrokersQuant`。
-- 推荐 Cloud Run 服务名：`interactive-brokers-quant`。
+- `QuantPlatformKit` 只是共享依赖，不单独部署；Cloud Run 现在部署的是 `InteractiveBrokersPlatform`。
+- 推荐 Cloud Run 服务名：`interactive-brokers-quant-global-etf-rotation`。
 - 后续如果扩到多账户，建议按 `ACCOUNT_GROUP` 拆成多个 Cloud Run 服务，并让每个服务在运行时选中自己的账号组配置。
 - 如果后面改 GitHub 仓库名或再次迁组织，Cloud Build / Cloud Run 里的 GitHub 来源需要重新选择，不要假设旧绑定会自动跟过去。
 - 统一部署模型和触发器迁移清单见 [`QuantPlatformKit/docs/deployment_model.md`](../QuantPlatformKit/docs/deployment_model.md)。
@@ -444,7 +446,7 @@ IB_GATEWAY_IP_MODE=internal
 示例部署命令：
 
 ```bash
-gcloud run deploy interactive-brokers-quant \
+gcloud run deploy interactive-brokers-quant-global-etf-rotation \
   --source . \
   --region us-central1 \
   --service-account interactive-brokers-quant-runtime@PROJECT_ID.iam.gserviceaccount.com \

docs/examples/ibkr-account-groups.default.json

@@ -6,7 +6,7 @@
       "ib_gateway_mode": "paper",
       "ib_gateway_ip_mode": "internal",
       "ib_client_id": 1,
-      "service_name": "interactive-brokers-quant",
+      "service_name": "interactive-brokers-quant-global-etf-rotation",
       "account_ids": [
         "DU1234567"
       ]

docs/ibkr_runtime_rollout.md

@@ -1,6 +1,6 @@
 # IBKRQuant 配置落地：先跑通 `ACCOUNT_GROUP=default`
 
-这份文档只管当前这一步：**先把 `interactive-brokers-quant` 这一个 Cloud Run 服务，用 `ACCOUNT_GROUP=default` 跑通。**
+这份文档只管当前这一步：**先把 `interactive-brokers-quant-global-etf-rotation` 这一个 Cloud Run 服务，用 `ACCOUNT_GROUP=default` 跑通。**
 
 不在这一步里做的事：
 
@@ -20,7 +20,8 @@
 - `IB_ACCOUNT_GROUP_CONFIG_SECRET_NAME`
 - `GLOBAL_TELEGRAM_CHAT_ID`
 - `NOTIFY_LANG`
-- `TELEGRAM_TOKEN`
+- `TELEGRAM_TOKEN_SECRET_NAME`（推荐）
+- `TELEGRAM_TOKEN`（fallback）
 
 可选过渡变量：
 
@@ -66,7 +67,7 @@ cp docs/examples/ibkr-account-groups.default.json /tmp/ibkr-account-groups.json
       "ib_gateway_mode": "paper",
       "ib_gateway_ip_mode": "internal",
       "ib_client_id": 1,
-      "service_name": "interactive-brokers-quant",
+      "service_name": "interactive-brokers-quant-global-etf-rotation",
       "account_ids": ["DU1234567"]
     }
   }
@@ -166,6 +167,7 @@ gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
 - `ENABLE_GITHUB_ENV_SYNC=true`
 - `CLOUD_RUN_REGION`
 - `CLOUD_RUN_SERVICE`
+- `TELEGRAM_TOKEN_SECRET_NAME=interactive-brokers-telegram-token`
 - `STRATEGY_PROFILE=global_etf_rotation`
 - `ACCOUNT_GROUP=default`
 - `IB_ACCOUNT_GROUP_CONFIG_SECRET_NAME=ibkr-account-groups`
@@ -185,7 +187,7 @@ gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
 ### Repository Secrets
 
 - `GCP_SA_KEY`
-- `TELEGRAM_TOKEN`
+- `TELEGRAM_TOKEN`（仅在没设置 `TELEGRAM_TOKEN_SECRET_NAME` 时作为 fallback）
 
 说明：
 
@@ -223,7 +225,7 @@ gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
 6. **检查 Cloud Run 当前 env**
 
 ```bash
-gcloud run services describe interactive-brokers-quant \
+gcloud run services describe interactive-brokers-quant-global-etf-rotation \
   --project "${PROJECT_ID}" \
   --region "us-central1" \
   --format="yaml(spec.template.spec.serviceAccountName,spec.template.spec.containers[0].env)"
@@ -232,7 +234,7 @@ gcloud run services describe interactive-brokers-quant \
 7. **看启动日志**
 
 ```bash
-gcloud run services logs read interactive-brokers-quant \
+gcloud run services logs read interactive-brokers-quant-global-etf-rotation \
   --project "${PROJECT_ID}" \
   --region "us-central1" \
   --limit=100

tests/test_account_group_examples.py

@@ -19,5 +19,5 @@ def test_default_account_group_example_is_valid():
     assert default_group.ib_gateway_mode == "paper"
     assert default_group.ib_gateway_ip_mode == "internal"
     assert default_group.ib_client_id == 1
-    assert default_group.service_name == "interactive-brokers-quant"
+    assert default_group.service_name == "interactive-brokers-quant-global-etf-rotation"
     assert default_group.account_ids == ("DU1234567",)

tests/test_sync_cloud_run_env_workflow.sh

@@ -7,6 +7,7 @@ workflow_file="$repo_dir/.github/workflows/sync-cloud-run-env.yml"
 grep -Fq 'ENABLE_GITHUB_ENV_SYNC: ${{ vars.ENABLE_GITHUB_ENV_SYNC }}' "$workflow_file"
 grep -Fq 'CLOUD_RUN_REGION: ${{ vars.CLOUD_RUN_REGION }}' "$workflow_file"
 grep -Fq 'CLOUD_RUN_SERVICE: ${{ vars.CLOUD_RUN_SERVICE }}' "$workflow_file"
+grep -Fq 'TELEGRAM_TOKEN_SECRET_NAME: ${{ vars.TELEGRAM_TOKEN_SECRET_NAME }}' "$workflow_file"
 grep -Fq 'STRATEGY_PROFILE: ${{ vars.STRATEGY_PROFILE }}' "$workflow_file"
 grep -Fq 'ACCOUNT_GROUP: ${{ vars.ACCOUNT_GROUP }}' "$workflow_file"
 grep -Fq 'IB_ACCOUNT_GROUP_CONFIG_SECRET_NAME: ${{ vars.IB_ACCOUNT_GROUP_CONFIG_SECRET_NAME }}' "$workflow_file"
@@ -19,16 +20,23 @@ grep -Fq 'TELEGRAM_TOKEN: ${{ secrets.TELEGRAM_TOKEN }}' "$workflow_file"
 grep -Fq 'credentials_json: ${{ env.GCP_SA_KEY }}' "$workflow_file"
 grep -Fq "Skipping Cloud Run env sync because ENABLE_GITHUB_ENV_SYNC is not set to true." "$workflow_file"
 grep -Fq "Cloud Run env sync is enabled, but these values are missing:" "$workflow_file"
+grep -Fq 'TELEGRAM_TOKEN_SECRET_NAME or TELEGRAM_TOKEN' "$workflow_file"
 grep -Fq "if: steps.config.outputs.enabled == 'true'" "$workflow_file"
 grep -Fq 'env_pairs=(' "$workflow_file"
+grep -Fq 'secret_pairs=(' "$workflow_file"
 grep -Fq 'remove_env_vars=(' "$workflow_file"
+grep -Fq 'remove_secret_vars=(' "$workflow_file"
 grep -Fq 'STRATEGY_PROFILE=${STRATEGY_PROFILE}' "$workflow_file"
 grep -Fq 'ACCOUNT_GROUP=${ACCOUNT_GROUP}' "$workflow_file"
 grep -Fq 'IB_ACCOUNT_GROUP_CONFIG_SECRET_NAME=${IB_ACCOUNT_GROUP_CONFIG_SECRET_NAME}' "$workflow_file"
+grep -Fq 'secret_pairs+=("TELEGRAM_TOKEN=${TELEGRAM_TOKEN_SECRET_NAME}:latest")' "$workflow_file"
+grep -Fq 'env_pairs+=("TELEGRAM_TOKEN=${TELEGRAM_TOKEN}")' "$workflow_file"
 grep -Fq 'remove_env_vars+=("IB_GATEWAY_ZONE")' "$workflow_file"
 grep -Fq 'remove_env_vars+=("IB_GATEWAY_IP_MODE")' "$workflow_file"
 grep -Fq '"IB_CLIENT_ID"' "$workflow_file"
 grep -Fq '"IB_GATEWAY_INSTANCE_NAME"' "$workflow_file"
 grep -Fq '"IB_GATEWAY_MODE"' "$workflow_file"
+grep -Fq -- '--remove-secrets "$(IFS=,; echo "${remove_secret_vars[*]}")"' "$workflow_file"
+grep -Fq -- '--update-secrets "$(IFS=,; echo "${secret_pairs[*]}")"' "$workflow_file"
 grep -Fq -- '--remove-env-vars "$(IFS=,; echo "${remove_env_vars[*]}")"' "$workflow_file"
 grep -Fq -- '--update-env-vars "$(IFS=,; echo "${env_pairs[*]}")"' "$workflow_file"