56 lines
2.0 KiB
YAML
56 lines
2.0 KiB
YAML
name: Audit Compose rollback Qdrant corpus (read-only)
|
|
|
|
# `realvuxbaro.me` has run on k3s since the 2026-08-17 cutover; this workflow
|
|
# still SSHes into secrets.EC2_HOST, which is the retired Compose EC2 kept
|
|
# only as a manual DNS fallback. It fingerprints that box's Qdrant with
|
|
# content hashes rather than a point count, which two different corpora can
|
|
# share — the same script can be run against the k3s side (over SSH, or via
|
|
# `docker exec` on its ai-service pod) to check the fallback still matches
|
|
# real production before ever relying on it.
|
|
#
|
|
# Read-only: it scrolls points and reads collection info. It changes nothing,
|
|
# on this box or any other, and cannot trigger a rebuild of it.
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: audit-qdrant-corpus
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
audit:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
# Ship the script rather than inlining it, so production and practice
|
|
# provably run the same bytes instead of two copies that can drift.
|
|
- name: Encode fingerprint script
|
|
run: echo "SCRIPT_B64=$(base64 -w0 scripts/qdrant_fingerprint.py)" >> "$GITHUB_ENV"
|
|
|
|
- name: Fingerprint the Compose rollback corpus over SSH
|
|
uses: appleboy/ssh-action@v1.0.3
|
|
env:
|
|
SCRIPT_B64: ${{ env.SCRIPT_B64 }}
|
|
with:
|
|
host: ${{ secrets.EC2_HOST }}
|
|
username: ubuntu
|
|
key: ${{ secrets.EC2_SSH_KEY }}
|
|
command_timeout: 30m
|
|
envs: SCRIPT_B64
|
|
script: |
|
|
set -eu
|
|
cd ~/app/infra/docker
|
|
ai_id=$(sudo docker compose -f docker-compose.prod.yml ps -q ai-service)
|
|
test -n "$ai_id"
|
|
|
|
printf '%s\n' '=== qdrant_version ==='
|
|
sudo docker compose -f docker-compose.prod.yml images qdrant
|
|
|
|
printf '%s\n' '=== corpus_fingerprint ==='
|
|
printf '%s' "$SCRIPT_B64" | base64 -d | sudo docker exec -i "$ai_id" python -
|