54 lines
1.8 KiB
YAML
54 lines
1.8 KiB
YAML
name: Audit production Qdrant corpus (read-only)
|
|
|
|
# Answers "is the practice corpus the same corpus production serves?" with
|
|
# content hashes rather than a point count, which two different corpora can
|
|
# share. The identical script runs against the k3s cluster over SSH, so the
|
|
# two fingerprints are directly comparable.
|
|
#
|
|
# Read-only: it scrolls points and reads collection info. It changes nothing on
|
|
# production, and its path is not in deploy.yml's filters, so merging it cannot
|
|
# restart the Compose stack.
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: audit-qdrant-corpus
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
audit:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
# Ship the script rather than inlining it, so production and practice
|
|
# provably run the same bytes instead of two copies that can drift.
|
|
- name: Encode fingerprint script
|
|
run: echo "SCRIPT_B64=$(base64 -w0 scripts/qdrant_fingerprint.py)" >> "$GITHUB_ENV"
|
|
|
|
- name: Fingerprint production corpus over SSH
|
|
uses: appleboy/ssh-action@v1.0.3
|
|
env:
|
|
SCRIPT_B64: ${{ env.SCRIPT_B64 }}
|
|
with:
|
|
host: ${{ secrets.EC2_HOST }}
|
|
username: ubuntu
|
|
key: ${{ secrets.EC2_SSH_KEY }}
|
|
command_timeout: 30m
|
|
envs: SCRIPT_B64
|
|
script: |
|
|
set -eu
|
|
cd ~/app/infra/docker
|
|
ai_id=$(sudo docker compose -f docker-compose.prod.yml ps -q ai-service)
|
|
test -n "$ai_id"
|
|
|
|
printf '%s\n' '=== qdrant_version ==='
|
|
sudo docker compose -f docker-compose.prod.yml images qdrant
|
|
|
|
printf '%s\n' '=== corpus_fingerprint ==='
|
|
printf '%s' "$SCRIPT_B64" | base64 -d | sudo docker exec -i "$ai_id" python -
|