Repo hygiene: align metadata and add CI baseline

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @Pigbibi

.github/dependabot.yml

@@ -0,0 +1,12 @@
+version: 2
+updates:
+- package-ecosystem: "pip"
+  directory: "/"
+  schedule:
+    interval: "weekly"
+  open-pull-requests-limit: 5
+- package-ecosystem: "github-actions"
+  directory: "/"
+  schedule:
+    interval: "weekly"
+  open-pull-requests-limit: 5

.github/workflows/ci.yml

@@ -0,0 +1,34 @@
+name: CI
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Setup Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+
+      - name: Install dependencies
+        run: |
+          set -euo pipefail
+          python -m pip install --upgrade pip
+          python -m pip install -e . numpy pandas ruff
+
+      - name: Run Ruff
+        run: |
+          set -euo pipefail
+          ruff check .
+
+      - name: Run unit tests
+        run: |
+          set -euo pipefail
+          PYTHONPATH=src python -m unittest discover -s tests -v

.gitignore

@@ -0,0 +1,4 @@
+__pycache__/
+*.py[cod]
+.pytest_cache/
+.venv/

CONTRIBUTING.md

@@ -0,0 +1,24 @@
+# Contributing
+
+Thanks for contributing to `QuantPlatformKit`.
+
+## Ground Rules
+
+- Prefer small, low-risk pull requests.
+- Keep refactors separate from behavior changes.
+- Add or update tests when changing runtime behavior.
+- Do not use deployment or scheduled workflows as a substitute for local verification.
+
+## Branching and Pull Requests
+
+- Create a topic branch for each change.
+- Open a pull request with a short summary and a concrete test plan.
+- Wait for CI to pass before merging.
+
+## Local Verification
+
+Run the main verification command before opening a pull request:
+
+```bash
+PYTHONPATH=src python3 -m unittest discover -s tests -v
+```

README.md

@@ -73,15 +73,15 @@ PYTHONPATH=src python3 -m unittest discover -s tests
 `QuantPlatformKit` is a shared dependency, not a runtime service. Strategy repos should pin a fixed Git tag such as:
 
 ```text
-quant-platform-kit @ git+https://github.com/QuantStrategyLab/QuantPlatformKit.git@v0.5.0
+quant-platform-kit @ git+https://github.com/QuantStrategyLab/QuantPlatformKit.git@v0.6.0
 ```
 
 Cloud Run and self-hosted runner deployments should continue to deploy the strategy repositories only. See [docs/deployment_model.md](./docs/deployment_model.md) for:
 
 - service naming suggestions
 - fixed-tag dependency rules
 - Google Cloud trigger rebind steps after repo rename
-- HK / SG multi-service guidance for `LongBridgeQuant`
+- HK / SG multi-service guidance for `LongBridgePlatform`
 
 ---
 

README.zh-CN.md

@@ -63,7 +63,7 @@ PYTHONPATH=src python3 -m unittest discover -s tests
 `QuantPlatformKit` 是共享依赖，不单独部署。策略仓库应该固定依赖某个 Git tag，例如：
 
 ```text
-quant-platform-kit @ git+https://github.com/QuantStrategyLab/QuantPlatformKit.git@v0.5.0
+quant-platform-kit @ git+https://github.com/QuantStrategyLab/QuantPlatformKit.git@v0.6.0
 ```
 
 部署相关说明见：

SECURITY.md

@@ -0,0 +1,23 @@
+# Security Policy
+
+Thanks for helping keep `QuantPlatformKit` safe.
+
+This repository is part of a shared platform library. Please do **not** open a public issue for vulnerabilities involving credentials, broker access, cloud resources, order execution, or secret material.
+
+## Reporting a Vulnerability
+
+- Contact the maintainer directly at GitHub: `@Pigbibi`.
+- If private vulnerability reporting is enabled for this repository, prefer that channel.
+- Include the repository name, affected commit or branch, environment details, and exact reproduction steps.
+
+## Secret and Credential Exposure
+
+If you suspect tokens, passwords, API keys, service-account keys, or broker credentials were exposed:
+
+1. Rotate the exposed secrets immediately.
+2. Pause scheduled jobs or deployments if the exposure can affect automation or trading behavior.
+3. Share only the minimum evidence needed to reproduce the issue.
+
+## Scope Notes
+
+Security fixes should stay minimal and focused. Please avoid bundling unrelated refactors with a security report or patch.

docs/deployment_model.md

@@ -97,7 +97,7 @@ They should **not** own:
 All strategy or platform runtime repositories should pin a fixed tag, for example:
 
 ```text
-quant-platform-kit @ git+https://github.com/QuantStrategyLab/QuantPlatformKit.git@v0.5.0
+quant-platform-kit @ git+https://github.com/QuantStrategyLab/QuantPlatformKit.git@v0.6.0
 ```
 
 Avoid:

docs/deployment_model.zh-CN.md

@@ -64,7 +64,7 @@
 策略仓库应该固定依赖某个 tag，例如：
 
 ```text
-quant-platform-kit @ git+https://github.com/QuantStrategyLab/QuantPlatformKit.git@v0.5.0
+quant-platform-kit @ git+https://github.com/QuantStrategyLab/QuantPlatformKit.git@v0.6.0
 ```
 
 不要用：

pyproject.toml

@@ -19,3 +19,6 @@ package-dir = { "" = "src" }
 
 [tool.setuptools.packages.find]
 where = ["src"]
+
+[tool.ruff]
+target-version = "py39"

setup.py

@@ -3,7 +3,7 @@
 
 setup(
     name="quant-platform-kit",
-    version="0.5.0",
+    version="0.6.0",
     description="Shared broker adapters, domain models, execution ports, and notification utilities for QuantStrategyLab strategies.",
     package_dir={"": "src"},
     packages=find_packages(where="src"),

src/quant_platform_kit/__init__.py

@@ -1,6 +1,6 @@
 """QuantPlatformKit public package surface."""
 
-__version__ = "0.5.0"
+__version__ = "0.6.0"
 
 from .common.models import (
     ExecutionReport,

src/quant_platform_kit/longbridge/portfolio.py

@@ -2,6 +2,8 @@
 
 from typing import Any, Iterable
 
+from .market_data import fetch_last_price
+
 
 def fetch_strategy_account_state(
     q_ctx: Any,
@@ -46,6 +48,3 @@ def fetch_strategy_account_state(
         "sellable_quantities": sellable_quantities,
         "total_strategy_equity": available_cash + sum(market_values.values()),
     }
-
-
-from .market_data import fetch_last_price