name: Audit production Qdrant corpus (read-only)

# Answers "is the practice corpus the same corpus production serves?" with
# content hashes rather than a point count, which two different corpora can
# share. The identical script runs against the k3s cluster over SSH, so the
# two fingerprints are directly comparable.
#
# Read-only: it scrolls points and reads collection info. It changes nothing on
# production, and its path is not in deploy.yml's filters, so merging it cannot
# restart the Compose stack.

on:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: audit-qdrant-corpus
  cancel-in-progress: false

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # Ship the script rather than inlining it, so production and practice
      # provably run the same bytes instead of two copies that can drift.
      - name: Encode fingerprint script
        run: echo "SCRIPT_B64=$(base64 -w0 scripts/qdrant_fingerprint.py)" >> "$GITHUB_ENV"

      - name: Fingerprint production corpus over SSH
        uses: appleboy/ssh-action@v1.0.3
        env:
          SCRIPT_B64: ${{ env.SCRIPT_B64 }}
        with:
          host: ${{ secrets.EC2_HOST }}
          username: ubuntu
          key: ${{ secrets.EC2_SSH_KEY }}
          command_timeout: 30m
          envs: SCRIPT_B64
          script: |
            set -eu
            cd ~/app/infra/docker
            ai_id=$(sudo docker compose -f docker-compose.prod.yml ps -q ai-service)
            test -n "$ai_id"

            printf '%s\n' '=== qdrant_version ==='
            sudo docker compose -f docker-compose.prod.yml images qdrant

            printf '%s\n' '=== corpus_fingerprint ==='
            printf '%s' "$SCRIPT_B64" | base64 -d | sudo docker exec -i "$ai_id" python -