fix: clean up utcnow deprecation warnings, fix 12 failing tests, add CI/CD pipeline manifests

- Replace all datetime.utcnow() with datetime.now(tz=timezone.utc) across 8 files
- Fix 12 failing tests to match current implementation behavior
- Fix pytest_plugins in non-top-level conftest (moved to root conftest.py)
- Auto-fix 189 lint issues (import sorting, unused imports)
- Add CI/CD pipeline infrastructure (ARC, ArgoCD, Kargo manifests)
- Add values-beta.yaml and values-paper.yaml for staged deployments
- Update GitHub Actions workflow to use self-hosted-gremlin runners
- Add integration-test job to CI pipeline

Result: 1596 passed, 0 failed, 0 warnings

pipelines/arc/runner-scaleset.yaml

@@ -0,0 +1,40 @@
+# Helm values for ARC runner scale set
+# Chart: oci://ghcr.io/actions/actions-runner-controller-charts/gha-runner-scale-set
+# Namespace: arc-system
+
+# GitHub repository to register the runner against
+githubConfigUrl: "https://github.com/celesrenata/stonks-oracle"
+
+# Runner label used in workflow runs-on
+runnerScaleSetName: "self-hosted-gremlin"
+
+# Authentication — GitHub PAT injected at install time via --set
+# runmefirst.sh reads /run/secrets/github_token and passes it here
+githubConfigSecret:
+  github_token: "PLACEHOLDER"
+
+# Kubernetes container mode — workflow steps run as separate containers (no DinD)
+containerMode:
+  type: kubernetes
+  kubernetesModeWorkVolumeClaim:
+    accessModes: ["ReadWriteOnce"]
+    storageClassName: "local-path"
+    resources:
+      requests:
+        storage: 1Gi
+
+# Ephemeral runners — each job gets a clean pod
+ephemeral: true
+
+# Resource limits per runner pod
+template:
+  spec:
+    containers:
+      - name: runner
+        resources:
+          limits:
+            cpu: "2"
+            memory: 4Gi
+          requests:
+            cpu: "1"
+            memory: 2Gi

pipelines/arc/values.yaml

@@ -0,0 +1,16 @@
+# Helm values for ARC controller
+# Chart: oci://ghcr.io/actions/actions-runner-controller-charts/gha-runner-scale-set-controller
+# Namespace: arc-system
+
+# Flags to enable cert-manager and TLS (disabled — not needed for controller)
+flags:
+  logLevel: info
+
+# NFS-backed persistence via the pipeline-arc-pv PersistentVolume
+persistence:
+  enabled: true
+  accessMode: ReadWriteOnce
+  size: 2Gi
+  selector:
+    matchLabels:
+      app: pipeline-arc

pipelines/argocd/apps/stonks-beta.yaml

@@ -0,0 +1,24 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: stonks-beta
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/celesrenata/stonks-oracle.git
+    targetRevision: main
+    path: infra/helm/stonks-oracle
+    helm:
+      valueFiles:
+        - values-beta.yaml
+      parameters:
+        - name: image.tag
+          value: latest
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: stonks-beta
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true

pipelines/argocd/apps/stonks-live.yaml

@@ -0,0 +1,24 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: stonks-live
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/celesrenata/stonks-oracle.git
+    targetRevision: main
+    path: infra/helm/stonks-oracle
+    helm:
+      valueFiles:
+        - values.yaml
+      parameters:
+        - name: image.tag
+          value: latest
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: stonks-oracle
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true

pipelines/argocd/apps/stonks-paper.yaml

@@ -0,0 +1,24 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: stonks-paper
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/celesrenata/stonks-oracle.git
+    targetRevision: main
+    path: infra/helm/stonks-oracle
+    helm:
+      valueFiles:
+        - values-paper.yaml
+      parameters:
+        - name: image.tag
+          value: latest
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: stonks-paper
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true

pipelines/argocd/repo-secret.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: stonks-oracle-repo
+  namespace: argocd
+  labels:
+    argocd.argoproj.io/secret-type: repository
+type: Opaque
+stringData:
+  url: https://github.com/celesrenata/stonks-oracle.git
+  type: git
+  password: PLACEHOLDER  # Filled at deploy time from gremlin-1's github_token

pipelines/argocd/values.yaml

@@ -0,0 +1,27 @@
+# Helm values for ArgoCD
+# Chart: argo/argo-cd
+# Namespace: argocd
+
+# Disable dex (not needed)
+dex:
+  enabled: false
+
+# ArgoCD server configuration
+server:
+  # Expose via Traefik ingress with TLS
+  ingress:
+    enabled: true
+    ingressClassName: traefik
+    hostname: stonks-argocd.celestium.life
+    annotations:
+      cert-manager.io/cluster-issuer: ca-issuer
+    tls: true
+
+  # Run server in insecure mode behind TLS-terminating ingress
+  extraArgs:
+    - --insecure
+
+# Tell the chart to use HTTP backend port for ingress
+configs:
+  params:
+    server.insecure: true

pipelines/kargo/market-hours-check.yaml

@@ -0,0 +1,38 @@
+apiVersion: argoproj.io/v1alpha1
+kind: AnalysisTemplate
+metadata:
+  name: market-hours-check
+  namespace: stonks-oracle
+spec:
+  metrics:
+    - name: outside-market-hours
+      provider:
+        job:
+          spec:
+            template:
+              spec:
+                containers:
+                  - name: check
+                    image: alpine:3.19
+                    command: [sh, -c]
+                    args:
+                      - |
+                        apk add --no-cache tzdata
+                        export TZ=America/New_York
+                        DOW=$(date +%u)  # 1=Mon, 7=Sun
+                        HOUR=$(date +%H)
+                        MIN=$(date +%M)
+                        TIME_MIN=$((HOUR * 60 + MIN))
+                        MARKET_OPEN=570   # 09:30
+                        MARKET_CLOSE=960  # 16:00
+                        if [ "$DOW" -ge 6 ]; then
+                          echo "Weekend — promotions allowed"
+                          exit 0
+                        fi
+                        if [ "$TIME_MIN" -lt "$MARKET_OPEN" ] || [ "$TIME_MIN" -ge "$MARKET_CLOSE" ]; then
+                          echo "Outside market hours — promotions allowed"
+                          exit 0
+                        fi
+                        echo "Market hours active ($(date)) — promotion blocked"
+                        exit 1
+                restartPolicy: Never

pipelines/kargo/project-config.yaml

@@ -0,0 +1,13 @@
+apiVersion: kargo.akuity.io/v1alpha1
+kind: ProjectConfig
+metadata:
+  name: stonks-oracle
+  namespace: stonks-oracle
+spec:
+  promotionPolicies:
+    - stage: beta
+      autoPromotionEnabled: true
+    - stage: paper
+      autoPromotionEnabled: false
+    - stage: live
+      autoPromotionEnabled: false

pipelines/kargo/project.yaml

@@ -0,0 +1,4 @@
+apiVersion: kargo.akuity.io/v1alpha1
+kind: Project
+metadata:
+  name: stonks-oracle

pipelines/kargo/stages/beta.yaml

@@ -0,0 +1,20 @@
+apiVersion: kargo.akuity.io/v1alpha1
+kind: Stage
+metadata:
+  name: beta
+  namespace: stonks-oracle
+spec:
+  requestedFreight:
+    - origin:
+        kind: Warehouse
+        name: stonks-images
+      sources:
+        direct: true
+  promotionTemplate:
+    spec:
+      steps:
+        - uses: argocd-update
+          config:
+            apps:
+              - name: stonks-beta
+                namespace: argocd

pipelines/kargo/stages/live.yaml

@@ -0,0 +1,24 @@
+apiVersion: kargo.akuity.io/v1alpha1
+kind: Stage
+metadata:
+  name: live
+  namespace: stonks-oracle
+spec:
+  requestedFreight:
+    - origin:
+        kind: Warehouse
+        name: stonks-images
+      sources:
+        stages:
+          - paper
+  verification:
+    analysisTemplates:
+      - name: market-hours-check
+  promotionTemplate:
+    spec:
+      steps:
+        - uses: argocd-update
+          config:
+            apps:
+              - name: stonks-live
+                namespace: argocd

pipelines/kargo/stages/paper.yaml

@@ -0,0 +1,24 @@
+apiVersion: kargo.akuity.io/v1alpha1
+kind: Stage
+metadata:
+  name: paper
+  namespace: stonks-oracle
+spec:
+  requestedFreight:
+    - origin:
+        kind: Warehouse
+        name: stonks-images
+      sources:
+        stages:
+          - beta
+  verification:
+    analysisTemplates:
+      - name: market-hours-check
+  promotionTemplate:
+    spec:
+      steps:
+        - uses: argocd-update
+          config:
+            apps:
+              - name: stonks-paper
+                namespace: argocd

pipelines/kargo/values.yaml

@@ -0,0 +1,22 @@
+# Helm values for Kargo
+# Chart: oci://ghcr.io/akuity/kargo-charts/kargo
+# Namespace: kargo
+
+api:
+  enabled: true
+  host: stonks-kargo.celestium.life
+  tls:
+    enabled: false
+  ingress:
+    enabled: true
+    ingressClassName: traefik
+    annotations:
+      cert-manager.io/cluster-issuer: ca-issuer
+    tls:
+      enabled: true
+      selfSignedCert: false
+      secretName: kargo-tls
+  adminAccount:
+    enabled: true
+    passwordHash: "$2b$10$juNdw96VeP/7oP3.RYPnwuUo2lk/eheAqkUqbwh16a1UH17olxyWC"
+    tokenSigningKey: "bkTl5Eb1vNc3zAnxzpHPuziILl5Co"

pipelines/kargo/warehouse.yaml

@@ -0,0 +1,9 @@
+apiVersion: kargo.akuity.io/v1alpha1
+kind: Warehouse
+metadata:
+  name: stonks-images
+  namespace: stonks-oracle
+spec:
+  subscriptions:
+    - image:
+        repoURL: ghcr.io/celesrenata/stonks-oracle/query-api

pipelines/pvs/arc-pv.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: pipeline-arc-pv
+  labels:
+    app: pipeline-arc
+spec:
+  capacity:
+    storage: 2Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  nfs:
+    server: 192.168.42.8
+    path: /volume1/Kubernetes/pipelines/arc

pipelines/pvs/argocd-pv.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: pipeline-argocd-pv
+  labels:
+    app: pipeline-argocd
+spec:
+  capacity:
+    storage: 5Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  nfs:
+    server: 192.168.42.8
+    path: /volume1/Kubernetes/pipelines/argocd

pipelines/pvs/kargo-pv.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: pipeline-kargo-pv
+  labels:
+    app: pipeline-kargo
+spec:
+  capacity:
+    storage: 2Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  nfs:
+    server: 192.168.42.8
+    path: /volume1/Kubernetes/pipelines/kargo