daily stock analysis

Abstract

LLM 驱动的多市场股票智能分析系统：多源行情、实时新闻、决策看板与自动推送，支持零成本定时运行。 LLM-powered multi-market stock analysis system with multi-source market data, real-time news, decision dashboard, automated notifications, and cost-free scheduled runs.

The Problem

Retail and semi-professional investors juggle multiple markets (A-share, HK, US, JP, KR) and need daily, AI-generated decision briefs without paying for a terminal or spending hours aggregating quotes, news, and technical indicators. The repo solves this by automating the full pipeline—data collection, LLM analysis, report generation, and push notifications—on a schedule that costs nothing to run.

What This Does

This is a collection of six self-contained projects, not a single codebase. The core is a Python analysis engine (src/, data_provider/, strategies/) that pulls multi-source market data, applies technical indicators, and feeds it to an LLM (OpenAI-compatible, Gemini, DeepSeek, local Ollama, etc.) to produce a structured decision report. A FastAPI backend (api/) exposes analysis, backtest, portfolio, and alert endpoints. Two front-ends exist: a React web app (apps/dsa-web/) and an Electron desktop app (apps/dsa-desktop/). A bot module (bot/) handles chat-based strategy queries, and GitHub Actions workflows orchestrate scheduled runs with zero server cost.

How It Is Wired

Execution starts either from a GitHub Actions schedule (.github/workflows/00-daily-analysis.yml) or the FastAPI server (api/app.py). The pipeline routes through src/core/pipeline, which calls data_provider/base to fetch quotes and news, src/analyzer to generate the LLM report, and src/storage to persist results. The most connected modules are src/config (130 modules import it, 10 it imports) and src/storage (65 importers, 4 imports) — both are high-blast-radius hubs. Three modules (src/config, data_provider/base, src/analyzer) sit in a circular import cycle, which makes isolated changes risky. The web app's UiLanguageContext is a front-end hub (59 importers). The wiring for the desktop app and bot is not mapped in this analysis.

How To Use It

Setup: Python backend uses pyproject.toml (pip or uv). Front-ends use package.json (npm). Docker is available via docker/Dockerfile and docker/docker-compose.yml.

Configuration: Copy .env.example to .env and set LLM API keys (Anspire, OpenAI-compatible, etc.), data source tokens (AkShare, Tushare, YFinance), and push channel webhooks (WeCom, Feishu, Telegram, Slack, email).

Running it:

# Backend API
uvicorn api.app:app --reload

# Web app
cd apps/dsa-web && npm install && npm run dev

# Scheduled analysis via GitHub Actions
# Fork the repo, add secrets, enable the workflow

Real-World Use

A user forks the repo, sets LLM_API_KEY and TUSHARE_TOKEN in GitHub Secrets, and enables the daily workflow. Each morning at 8am UTC, the pipeline fetches quotes for configured watchlists, pulls news, generates a Markdown decision report with entry/exit points and risk alerts, and pushes it to a WeCom group. The same engine can be called on-demand via the FastAPI /api/v1/analysis endpoint from a portfolio tool.

Code Health & Issues

Static analysis (not opinion) found 457 issues: 162 high, 295 medium. Key findings:

High – Oversized files: src/config.py, src/storage.py, data_provider/base.py (up to 2593 lines) — hard to hold in one head, changes ripple widely.
High – Import cycle members: src/config.py, data_provider/base.py, src/analyzer.py — circular dependencies make isolated refactoring fragile.
High – Deep nesting (max depth 6) in the same three files — control flow hard to follow.
High – Hub modules: src/config (130 dependents), src/storage (65 dependents) — high-blast-radius churn.
Medium – Broad exception handling (except Exception) in src/storage.py, data_provider/base.py, src/analyzer.py — swallows errors indiscriminately.

SDLC observations: CI is present (GitHub Actions) with tests (310 test files), a license, and lockfiles. Two high-severity hygiene issues: GitHub Actions pinned to mutable tags (@v3, @v5) instead of commit SHAs, and pyproject.toml has no committed lockfile. Docker base images are unpinned (node:20-slim), and no dependency vulnerability scan runs in CI.

The Bottom Line

The system is functionally complete and genuinely useful for automated multi-market analysis at zero hosting cost. The main risk is maintainability: oversized hub modules and import cycles in the core engine will make any non-trivial change slow and error-prone. Use it if you want a working daily-analysis pipeline and are prepared to refactor the src/config and src/storage modules before extending them.

What the analyser found

Deployment readiness

7/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

925 files

Python462
TSX149
TypeScript108
Markdown59
YAML30
JSON9

ReactFlaskFastAPIExpressTailwindDocker

Architecture

Top-level areas of the codebase, sized by module count. Arrows show how many imports cross from one area into another.

graph TD g0["apps 263 modules"] g1["tests 205 modules"] g2["src 164 modules"] g3["api 38 modules"] g4["bot 22 modules"] g5["data_provider 17 modules"] g6["scripts 10 modules"] g1 -->|367| g2 g3 -->|74| g2 g1 -->|60| g5 g1 -->|48| g3 g4 -->|41| g2 g2 -->|33| g5 g1 -->|20| g4 g5 -->|14| g2 g6 -->|8| g2 g2 -->|4| g4 g3 -->|3| g5 g4 -->|2| g5

Module dependencies

The 10 most depended-upon modules of 725, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_src_config["config"] n1_src_storage["storage"] n2_c_contexts_UiLanguageContext["UiLanguageContext"] n3_data_provider_base["base"] n4__src_components_common_index["index"] n5_s_dsa_web_src_types_analysis["analysis"] n6_apps_dsa_web_src_utils_cn["cn"] n7_tests_litellm_stub["litellm_stub"] n8_src_analyzer["analyzer"] n9_apps_dsa_web_src_api_error["error"] n3_data_provider_base --> n0_src_config n8_src_analyzer --> n0_src_config n8_src_analyzer --> n1_src_storage n8_src_analyzer --> n3_data_provider_base n0_src_config --> n3_data_provider_base n1_src_storage --> n0_src_config classDef cyc stroke:#ef4444,stroke-width:2px; class n0_src_config,n3_data_provider_base,n8_src_analyzer cyc;

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high2

medium6

low1

Pin third-party GitHub Actions to a commit SHAhigh6 occurrences

.github/workflows

softprops/action-gh-release@v2, docker/setup-buildx-action@v3, docker/login-action@v3, docker/metadata-action@v5

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Commit a lockfile beside the manifesthigh

pyproject.toml

manifest with no lockfile in scope

An unlocked range means the artifact you tested and the artifact you ship can contain different transitive code, so a malicious patch release reaches production with no diff.

Fix: Run the package manager once and commit the generated lockfile.

Enable Dependabot or Renovatemedium

5 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Pin the container base image by digestmedium2 occurrences

docker/Dockerfile

node:20-slim, python:3.11-slim-bookworm

An untagged or mutable base means today's build and last month's contain different libc and a different CVE set, with no record of which shipped.

Fix: Use image:tag@sha256:<digest> and enable Dependabot's docker ecosystem.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Move large binaries to Git LFS or out of the repositorymedium4 occurrences

docs/assets/2026-01-10_155341_daily_analysis.gif

4 blobs over 5MB: 2026-01-10_155341_daily_analysis.gif 30.0MB, darklogo.psd 13.1MB, lightlogo.psd 8.8MB

One repository here carries twenty blobs over 5MB including a 10.9MB spreadsheet, so every clone and every CI checkout pays for data nobody diffs.

Fix: Track those extensions with LFS, or move datasets to object storage and fetch them in a setup step.

Set persist-credentials: false on checkoutmedium

.github/workflows/docker-publish.yml

checkout keeps the token, then dependencies are installed

The token stays in .git/config for every later step, so a malicious postinstall script reads a pushable credential without one ever being passed to it.

Fix: Add with: persist-credentials: false, and pass an explicit token only to the step that pushes.

Add a non-root USER to the imagemedium

docker/Dockerfile

CMD or ENTRYPOINT with no USER directive

A process running as root in the container is root against every mounted volume, and it turns any container escape or writable-mount mistake from a contained problem into a host one.

Fix: Create an unprivileged user, chown what it needs, and end the Dockerfile with USER.

Set timeout-minutes on the workflow jobslow4 occurrences

.github/workflows/create-release.yml

4 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.