Files
duocthu/.github/workflows/audit-qdrant-corpus.yml
T

56 lines
2.0 KiB
YAML

name: Audit Compose rollback Qdrant corpus (read-only)
# `realvuxbaro.me` has run on k3s since the 2026-08-17 cutover; this workflow
# still SSHes into secrets.EC2_HOST, which is the retired Compose EC2 kept
# only as a manual DNS fallback. It fingerprints that box's Qdrant with
# content hashes rather than a point count, which two different corpora can
# share — the same script can be run against the k3s side (over SSH, or via
# `docker exec` on its ai-service pod) to check the fallback still matches
# real production before ever relying on it.
#
# Read-only: it scrolls points and reads collection info. It changes nothing,
# on this box or any other, and cannot trigger a rebuild of it.
on:
workflow_dispatch:
permissions:
contents: read
concurrency:
group: audit-qdrant-corpus
cancel-in-progress: false
jobs:
audit:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
# Ship the script rather than inlining it, so production and practice
# provably run the same bytes instead of two copies that can drift.
- name: Encode fingerprint script
run: echo "SCRIPT_B64=$(base64 -w0 scripts/qdrant_fingerprint.py)" >> "$GITHUB_ENV"
- name: Fingerprint the Compose rollback corpus over SSH
uses: appleboy/ssh-action@v1.0.3
env:
SCRIPT_B64: ${{ env.SCRIPT_B64 }}
with:
host: ${{ secrets.EC2_HOST }}
username: ubuntu
key: ${{ secrets.EC2_SSH_KEY }}
command_timeout: 30m
envs: SCRIPT_B64
script: |
set -eu
cd ~/app/infra/docker
ai_id=$(sudo docker compose -f docker-compose.prod.yml ps -q ai-service)
test -n "$ai_id"
printf '%s\n' '=== qdrant_version ==='
sudo docker compose -f docker-compose.prod.yml images qdrant
printf '%s\n' '=== corpus_fingerprint ==='
printf '%s' "$SCRIPT_B64" | base64 -d | sudo docker exec -i "$ai_id" python -