Fingerprint the Qdrant corpus by content, not by count

2026-08-17 14:31:56 +07:00
parent c778f7e9cc
commit d1c9933b9e
8 changed files with 391 additions and 43 deletions
@@ -0,0 +1,53 @@
+name: Audit production Qdrant corpus (read-only)
+
+# Answers "is the practice corpus the same corpus production serves?" with
+# content hashes rather than a point count, which two different corpora can
+# share. The identical script runs against the k3s cluster over SSH, so the
+# two fingerprints are directly comparable.
+#
+# Read-only: it scrolls points and reads collection info. It changes nothing on
+# production, and its path is not in deploy.yml's filters, so merging it cannot
+# restart the Compose stack.
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: audit-qdrant-corpus
+  cancel-in-progress: false
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      # Ship the script rather than inlining it, so production and practice
+      # provably run the same bytes instead of two copies that can drift.
+      - name: Encode fingerprint script
+        run: echo "SCRIPT_B64=$(base64 -w0 scripts/qdrant_fingerprint.py)" >> "$GITHUB_ENV"
+
+      - name: Fingerprint production corpus over SSH
+        uses: appleboy/ssh-action@v1.0.3
+        env:
+          SCRIPT_B64: ${{ env.SCRIPT_B64 }}
+        with:
+          host: ${{ secrets.EC2_HOST }}
+          username: ubuntu
+          key: ${{ secrets.EC2_SSH_KEY }}
+          command_timeout: 30m
+          envs: SCRIPT_B64
+          script: |
+            set -eu
+            cd ~/app/infra/docker
+            ai_id=$(sudo docker compose -f docker-compose.prod.yml ps -q ai-service)
+            test -n "$ai_id"
+
+            printf '%s\n' '=== qdrant_version ==='
+            sudo docker compose -f docker-compose.prod.yml images qdrant
+
+            printf '%s\n' '=== corpus_fingerprint ==='
+            printf '%s' "$SCRIPT_B64" | base64 -d | sudo docker exec -i "$ai_id" python -