release: promote 1.4.0 iteration 28/29 to development

.github/CODEOWNERS

@@ -22,6 +22,7 @@
 
 # 引擎 / 策略 / 经纪商 / 数据源（R2）
 /backtrader/cerebro.py   @cloudQuant
+/backtrader/_cerebro/    @cloudQuant
 /backtrader/strategy.py  @cloudQuant
 /backtrader/broker.py    @cloudQuant
 /backtrader/brokers/     @cloudQuant

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -24,7 +24,7 @@ body:
     attributes:
       label: 环境
       description: Python 版本、操作系统、backtrader 版本、安装方式
-      placeholder: "Python 3.11, macOS, backtrader 1.3.0, pip install -e ."
+      placeholder: "Python 3.11, macOS, backtrader 1.4.0, pip install -e ."
     validations:
       required: true
   - type: textarea

.github/workflows/codeql.yml

@@ -0,0 +1,56 @@
+name: CodeQL Security Analysis
+
+on:
+  push:
+    branches: [dev, development, master]
+  pull_request:
+    branches: [dev, development, master]
+  schedule:
+    - cron: '30 5 * * 1'
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze Python
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: python
+          # Quality findings are owned by ruff/mypy/bandit; CodeQL focuses on
+          # security here. The inline config narrows the scan to released
+          # product code (backtrader/) and disables queries that conflict with
+          # the framework design: direct bt.Strategy subclasses deliberately
+          # never call super().__init__() (Strategy.__new__ already performs
+          # base initialization), so py/missing-super-init is a pure false
+          # positive across example strategies.
+          queries: security-extended
+          config: |
+            paths-ignore:
+              - docs
+              - examples
+              - tests
+              - tools
+              - studies
+              - scripts
+              - .joyincode
+              - conftest.py
+            disable:
+              queries:
+                - py/missing-super-init
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: '/language:python'

.github/workflows/docs-auto-build.yml

@@ -5,7 +5,7 @@ name: Documentation CI Checks
 
 on:
   pull_request:
-    branches: [development, master]
+    branches: [dev, development, master]
     paths:
       - 'docs/**'
       - 'backtrader/**/*.py'

.github/workflows/docs.yml

@@ -124,7 +124,10 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
     needs: build
-    if: github.event_name == 'push' && (github.ref == 'refs/heads/development' || github.ref == 'refs/heads/master')
+    # The existing github-pages environment authorizes only development.
+    # Master releases still build both languages and retain the Pages artifact;
+    # publishing a different branch requires a separate environment-policy change.
+    if: github.event_name == 'push' && github.ref == 'refs/heads/development'
     steps:
       - name: Deploy to GitHub Pages
         id: deployment

.github/workflows/test.yml

@@ -54,7 +54,7 @@ jobs:
       - name: Install linting tools
         run: |
           python -m pip install --upgrade pip
-          pip install ruff 'black==26.1.0' isort 'mypy==1.16.1' bandit pip-audit
+          pip install ruff 'black==26.1.0' 'isort==9.0.1' 'mypy==1.16.1' bandit pip-audit
 
       - name: Run ruff
         run: ruff check backtrader/
@@ -81,7 +81,8 @@ jobs:
           # mypy==1.16.1 keeps the Python 3.8 target available; the current
           # gate is fully clean and should fail on any new type error.
           MYPY_THRESHOLD=0
-          mypy backtrader --config-file=pyproject.toml | tee mypy-report.txt || true
+          set -o pipefail
+          mypy backtrader --config-file=pyproject.toml | tee mypy-report.txt
           count="$(grep -cE 'error:' mypy-report.txt || true)"
           echo "mypy error count: ${count} (gate threshold ${MYPY_THRESHOLD})"
           if [ "${count}" -gt "${MYPY_THRESHOLD}" ]; then
@@ -229,12 +230,87 @@ jobs:
           # Choose tier by event: pull_request => fast gate; everything else => full suite.
           if [ "${EVENT_NAME}" = "pull_request" ]; then
             echo "=== PR fast gate: pytest -m 'not slow' ==="
-            pytest tests/ -m "not slow" -n auto --tb=short --timeout=300 -q
+            pytest tests/ -m "not slow and not performance" -n auto --tb=short --timeout=300 -q
           else
             echo "=== Full suite: pytest tests/ ==="
-            pytest tests/ -n auto --tb=short --timeout=300 -q
+            pytest tests/ -m "not performance" -n auto --tb=short --timeout=300 -q
           fi
 
+  sdk:
+    name: Optional SDK Contracts
+    runs-on: ubuntu-latest
+    needs: lint
+    timeout-minutes: 40
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+          cache: 'pip'
+      - name: Install core and pinned SDK acceptance dependencies
+        run: python -m pip install -e ".[dev]" -r requirements-ci-sdk.txt
+      - name: Require SDK adapters and run complete functional suite
+        env:
+          PYTEST_ADDOPTS: ''
+        run: |
+          python -c "import bt_api_py, bt_api_base, bt_api_binance, bt_api_okx, bt_api_ctp, spdlog; print('All required SDK adapters present')"
+          # ``-n auto`` varies with runner CPU exposure.  Eight workers are
+          # the release-validated SDK-contract profile and keep this job bounded.
+          python -m pytest tests -m 'not performance' -n 8 --tb=short --timeout=300 -q
+
+  performance:
+    name: Serial Performance
+    runs-on: ubuntu-latest
+    needs: lint
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+          cache: 'pip'
+      - name: Install dependencies
+        run: python -m pip install -e ".[dev]" -r requirements-ci-sdk.txt
+      - name: Run serial performance and isolated RSS contracts
+        env:
+          PYTEST_ADDOPTS: ''
+        run: make test-performance BT_CONDA_PYTHON=python
+
+  wheel-consumer:
+    name: Wheel Consumer
+    runs-on: ubuntu-latest
+    needs: lint
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+          cache: 'pip'
+      - name: Build and install isolated release artifacts
+        shell: bash
+        run: |
+          python -m pip install --upgrade pip setuptools wheel build twine
+          python -m pip install .
+          python -m build --outdir "$RUNNER_TEMP/dist"
+          python -m twine check "$RUNNER_TEMP"/dist/*
+          wheel_path=$(find "$RUNNER_TEMP/dist" -name '*.whl' -print -quit)
+          test -n "$wheel_path"
+          python -m pip install --no-deps --target "$RUNNER_TEMP/installed" "$wheel_path"
+      - name: Verify source identity and run consumer trades outside checkout
+        shell: bash
+        run: |
+          version=$(python -c "import runpy; print(runpy.run_path('backtrader/version.py')['__version__'])")
+          wheel_path=$(find "$RUNNER_TEMP/dist" -name '*.whl' -print -quit)
+          cd "$RUNNER_TEMP"
+          PYTHONPATH="$RUNNER_TEMP/installed" python "$GITHUB_WORKSPACE/scripts/ci/verify_release_wheel.py" \
+            --wheel "$wheel_path" --source-root "$GITHUB_WORKSPACE" \
+            --install-root "$RUNNER_TEMP/installed" --version "$version" \
+            --output "$RUNNER_TEMP/wheel-consumer.json"
+      - uses: actions/upload-artifact@v4
+        with:
+          name: wheel-consumer-evidence
+          path: ${{ runner.temp }}/wheel-consumer.json
+
   coverage:
     name: Coverage (non-strategy subset, non-blocking floor)
     runs-on: ubuntu-latest
@@ -269,13 +345,13 @@ jobs:
   test-summary:
     name: Test Summary
     runs-on: ubuntu-latest
-    needs: test
+    needs: [test, sdk, performance, wheel-consumer]
     if: always()
     steps:
       - name: Check test results
         run: |
-          if [ "${{ needs.test.result }}" == "success" ]; then
-            echo "All matrix tests passed."
+          if [ "${{ needs.test.result }}" == "success" ] && [ "${{ needs.sdk.result }}" == "success" ] && [ "${{ needs.performance.result }}" == "success" ] && [ "${{ needs.wheel-consumer.result }}" == "success" ]; then
+            echo "All matrix tests, serial performance contracts and wheel consumers passed."
           else
             echo "At least one matrix test job failed"
             exit 1
@@ -346,7 +422,7 @@ jobs:
       - name: Run development R2/R3 strategy regression gate
         if: github.base_ref == 'development'
         shell: bash
-        run: make test-strategies
+        run: make test-strategies BT_CONDA_PYTHON=python
 
       - name: Run original-baseline hotfix gate
         if: github.base_ref == 'master'

.gitignore

@@ -162,10 +162,10 @@ backtrader_remove_metaprogramming_report_timing.json
 performance_comparison.json
 backtrader-master/*htmlcov/
 docs/_internal/opts/requirements/迭代3-宏源期货完成穿透式认证/
-examples/live_certification/hongyuan_penetration/reports/
+examples/007_ctp/live_certification/hongyuan_penetration/reports/
 examples/003_hft_notebook_examples/data/
-examples/live_certification/simnow_penetration/reports/
-examples/live_certification/hongyuan_penetration/*.docx
+examples/007_ctp/live_certification/simnow_penetration/reports/
+examples/007_ctp/live_certification/hongyuan_penetration/*.docx
 
 # Generated visualizations and reports from runnable examples
 /examples/output/

.joyincode/joyin-project-skills.json

@@ -2,11 +2,12 @@
   "projectId": "0",
   "managedEntries": [
     "demo",
+    "未经授权禁止动已有代码",
     "specx",
     "opsx",
-    "devwiki",
     "jcdb",
     "markitdown",
+    "jccb",
     "grill-with-docs"
   ]
 }