Release 1.218.0

See release notes.

Author: cjdsellers

.docker/nautilus_trader.dockerfile

@@ -6,7 +6,7 @@ ENV PYTHONUNBUFFERED=1 \
     PIP_DEFAULT_TIMEOUT=100 \
     PYO3_PYTHON="/usr/local/bin/python3" \
     PYSETUP_PATH="/opt/pysetup" \
-    RUST_TOOLCHAIN="stable" \
+    RUSTUP_TOOLCHAIN="stable" \
     BUILD_MODE="release" \
     CC="clang"
 ENV PATH="/root/.local/bin:/root/.cargo/bin:$PATH"
@@ -16,7 +16,7 @@ FROM base AS builder
 
 # Install build deps
 RUN apt-get update && \
-    apt-get install -y curl clang git libssl-dev make pkg-config && \
+    apt-get install -y curl clang git libssl-dev make pkg-config capnproto libcapnp-dev && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/*
 

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,13 +1,46 @@
 ---
-name: Bug Report
-about: Report a bug here
+ name: Bug Report
+ about: Bug – behavior that contradicts the platform’s documented or intended design
 labels:
 - bug
 ---
 
 # Bug Report
 
-## Expected Behavior
+Use this template only for issues that fit the **Bug** definition.
+
+| Term                          | Definition |
+|-------------------------------|------------|
+| **Bug**                       | Behavior that contradicts the platform’s documented or intended design as per code, docs, or specs. (i.e., the implementation is incorrect.) |
+| **Expectation mismatch** | Behavior that follows the platform’s documented or intended design but differs from what you expected. (i.e., the design/spec might be the problem.) |
+| **Enhancement request**       | A request for new functionality or behavior that is not implied by existing design. (i.e., *“It would be great if the platform could…”*) |
+
+**Note:**
+
+- Submitting this issue automatically applies the `bug` label.
+- `bug`-labeled issues are triaged with higher priority because they require corrective implementation work.
+- **Expectation mismatches** and design-level concerns should be opened as [Discussions](https://github.com/nautechsystems/nautilus_trader/discussions), or RFCs instead, where they can be validated and discussed to consensus before any work is scheduled.
+- The absence of a feature is typically not an expectation mismatch, and should be filed as an enhancement request.
+
+## Confirmation
+
+**Before opening a bug report, please confirm:**
+
+- [ ] I’ve re-read the relevant sections of the documentation.
+- [ ] I’ve searched existing issues and discussions to avoid duplicates.
+- [ ] I’ve reviewed or skimmed the source code (or examples) to confirm the behavior is not by design.
+- [ ] I’ve tested this issue using a recent *development* wheel (`dev` develop or `a` nightly) and can still reproduce it.
+
+Checking a recent development wheel can save time because the issue may already have been fixed.
+You can install a development wheel by running:
+
+```bash
+pip install -U nautilus_trader --pre --index-url https://packages.nautechsystems.io/simple
+```
+
+See the [development-wheels](https://github.com/nautechsystems/nautilus_trader#development-wheels) section for more details.
+
+### Expected Behavior
 
 Add here...
 
@@ -21,6 +54,13 @@ Add here...
 2.
 3.
 
+### Code Snippets or Logs
+
+<!-- If applicable, provide relevant code snippets, error logs, or stack traces. Use code blocks for clarity. -->
+
+<!-- Consider starting from our Minimal Reproducible Example template: -->
+<!-- https://github.com/nautechsystems/nautilus_trader/tree/develop/examples/other/minimal_reproducible_example -->
+
 ### Specifications
 
 - OS platform:

.github/ISSUE_TEMPLATE/config.yml

@@ -2,7 +2,7 @@ blank_issues_enabled: false
 contact_links:
   - name: General Questions
     url: https://github.com/nautechsystems/nautilus_trader/discussions
-    about: Ask questions like "How do I achieve x?" here.
+    about: Ask questions like "How do I achieve x?" here
   - name: Discord
     url: https://discord.gg/AUWVs3XaCS
-    about: Chat with contributors and active users of NautilusTrader on our Discord server!
+    about: Chat with contributors and active users of NautilusTrader on our Discord server

.github/ISSUE_TEMPLATE/rfc.md

@@ -1,16 +1,26 @@
 ---
 name: RFC (Request for Comments)
-about: Propose change or idea for discussion
+about: Propose a change or idea for discussion
 labels:
 - RFC
 ---
 
 # RFC: [Title]
 
+## What is an RFC?
+An RFC (Request for Comments) is a proposal for significant changes or additions to the project,
+such as new features, major refactorings, or process improvements. RFCs are meant for ideas that
+could have a broad impact and benefit from wider community discussion.
+
+## Before you proceed
+
+- Please search existing issues and discussions to see if your idea has already been proposed or is under consideration.
+- To maintain a focused and manageable discussion space, we kindly ask that you limit opening multiple RFCs within a short period (days or weeks). This helps ensure each proposal receives the attention it deserves and prevents overwhelming the community and maintainers.
+
 ## Context
 
 What would you like to propose? This could be improvements, refinements, optimizations, process changes, or other significant topics.
 
 ### Considerations
 
-What should we keep in mind? Include relevant context, tradeoffs, or concerns.
+What should we keep in mind? Include relevant context, such as tradeoffs (e.g., performance vs. complexity), technical feasibility, user impact, or other concerns.

.github/OVERVIEW.md

@@ -0,0 +1,51 @@
+<!--
+  README for the .github directory: composite actions and workflow definitions.
+-->
+# GitHub Actions Overview
+
+This directory contains reusable composite actions and workflow definitions for
+CI/CD, testing, publishing, and automation within the NautilusTrader repository.
+
+## Composite Actions (`.github/actions`)
+
+- **common-setup**: prepares the environment (OS packages, Rust toolchain, Python,
+  sccache, mold, pre-commit).
+- **common-test-data**: caches large test data under `tests/test_data/large`.
+- **common-wheel-build**: builds and installs Python wheels across Linux,
+  macOS, and Windows for multiple Python versions.
+- **publish-wheels**: publishes built wheels to Cloudflare R2, manages old wheel
+  cleanup and index generation.
+- **upload-artifact-wheel**: uploads the latest wheel artifact to GitHub Actions.
+
+## Workflows (`.github/workflows`)
+
+- **build.yml**: runs pre-commit, Rust tests, Python tests, builds wheels on multiple
+  platforms, and uploads wheel artifacts.
+- **build-docs.yml**: dispatches a repository event to trigger the documentation build
+  on `master` and `nightly` pushes.
+- **codeql-analysis.yml**: schedules and runs CodeQL security scans on pull requests
+  and periodically via cron.
+- **coverage.yml**: (optional) coverage report generation for the `nightly` branch.
+- **docker.yml**: builds and pushes Docker images (`nautilus_trader`, `jupyterlab`)
+  for `master` and `nightly` branches using Buildx and QEMU.
+- **nightly-merge.yml**: automatically merges `develop` into `nightly` when the
+  latest `develop` workflows succeed.
+- **performance.yml**: runs Rust/Python performance benchmarks on the `nightly` branch
+  and reports to CodSpeed.
+
+## Security
+
+- **Immutable Action Pinning**: all third-party actions are pinned to specific commit
+  SHAs to guarantee immutability and reproducibility.
+- **Hardened Runners**: most workflows employ `step-security/harden-runner` with an
+  `egress-policy: audit` to reduce attack surface and monitor outbound traffic.
+- **Secret Management**: no secrets or credentials are stored in the repo. AWS, PyPI,
+  and other credentials are provided via GitHub Secrets and injected at runtime.
+- **Code Scanning**: CodeQL is enabled for continuous security analysis.
+- **Dependency Pinning**: key tools (pre-commit, Python versions, Rust toolchain,
+  mold, cargo-nextest) are locked to fixed versions or SHAs.
+- **Caching**: caches for sccache, pip/site-packages, pre-commit, and test data
+  speed up workflows while preserving hermetic builds.
+
+For updates or changes to actions or workflows, please adhere to the repository's
+CONTRIBUTING guidelines and maintain these security best practices.

.github/actions/common-setup/action.yml

@@ -42,6 +42,7 @@ runs:
         sudo apt-get update
         sudo apt-get install -y curl clang git libssl-dev make pkg-config
         sudo apt-get install -y python3-dev libpython3-dev
+        sudo apt-get install -y capnproto libcapnp-dev
 
     - name: Install mold
       # https://github.com/rui314/setup-mold
@@ -67,14 +68,15 @@ runs:
 
     # https://github.com/actions-rust-lang/setup-rust-toolchain
     - name: Set up Rust toolchain
-      uses: actions-rust-lang/setup-rust-toolchain@v1
+      uses: actions-rust-lang/setup-rust-toolchain@9d7e65c320fdb52dcd45ffaa68deb6c02c8754d9 # v1.12.0
       with:
         toolchain: ${{ env.TOOLCHAIN }}
         components: clippy,rustfmt
         override: true
 
     - name: Install cargo-nextest
-      uses: taiki-e/install-action@v2
+      # https://github.com/taiki-e/install-action # v2.50.10
+      uses: taiki-e/install-action@83254c543806f3224380bf1001d6fac8feaf2d0b
       with:
         tool: nextest
 

.github/actions/publish-wheels/action.yml

@@ -1,5 +1,10 @@
 name: Publish wheels (R2)
 description: Publish wheels to Cloudflare R2
+inputs:
+  cleanup-local-dist:
+    description: 'Cleanup local dist directory after publishing to R2'
+    required: false
+    default: 'true'
 
 runs:
   using: "composite"
@@ -55,10 +60,17 @@ runs:
       run: |
         bash ./scripts/ci/publish-wheels-r2-verify-files.sh
 
-    - name: Clean up local artifacts
+    - name: Clean up local dist directory
+      if: ${{ inputs.cleanup-local-dist == 'true' && success() }}
       shell: bash
       run: |
         set -euo pipefail
-        ls -lh dist/ || echo "No dist directory found"
-        rm -rf dist/* 2>/dev/null || true
-        echo "Cleanup completed"
+
+        if [[ -d dist ]]; then
+          echo "Found dist directory:"
+          ls -lh dist/
+          rm -rf dist/*
+          echo "Cleanup completed"
+        else
+          echo "No dist directory found"
+        fi

.github/pull_request_template.md

@@ -1,16 +1,38 @@
 # Pull Request
 
-Include a summary of the changes.
+**NautilusTrader prioritizes correctness and reliability, please follow existing patterns for validation and testing.**
+
+## Summary
+
+<!-- Provide a brief description of *what* changed, *why* it was changed, and the impact on the system or users (2–3 sentences). -->
+
+## Related Issues/PRs
+
+<!-- List any related GitHub issues or PRs (e.g., `Closes #123`, `Related to #456`). -->
 
 ## Type of change
 
-Delete options that are not relevant.
+<!-- Select all that apply. -->
+
+- [ ] Bug fix (non-breaking)
+- [ ] New feature (non-breaking)
+- [ ] Breaking change (impacts existing behavior)
+- [ ] Documentation update
+- [ ] Maintenance / chore
+
+## Breaking change details (if applicable)
+
+<!-- If this is a breaking change, describe the impact and any migration steps required for users or developers. -->
+
+## Release notes
+
+- [ ] I added a concise entry to `RELEASES.md` that follows the existing conventions (when applicable)
+
+## Testing
 
-- [ ] Bug fix (non-breaking change which fixes an issue)
-- [ ] New feature (non-breaking change which adds functionality)
-- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
-- [ ] This change requires a documentation update
+**Ensure new or changed logic is covered by tests.**
 
-## How has this change been tested?
+- [ ] Affected code paths are already covered by the test suite
+- [ ] I added/updated tests to cover new or changed logic
 
-Describe how this code was/is tested.
+<!-- Briefly describe how the changes were tested (e.g., unit tests in `tests/unit/test_file.py`, or *additional* manual testing). -->