mirror of
https://github.com/semantica-agi/semantica.git
synced 2026-09-11 04:01:32 +00:00
KaifAhmad1
365391cb5b
Adds a live-PostgreSQL integration workflow (.github/workflows/integration.yml) that runs the existing tests/vector_store/test_pgvector_store.py suite against a real pgvector/pgvector:pg16 service container, on pull_request/weekly cron/workflow_dispatch. Kept separate from ci.yml (a required check) so an image pull, Postgres startup, or occasional service flake can't block unrelated merges, matching install-matrix.yml's existing precedent. Design notes: - Service image pinned by digest (verify-action-pins.sh only checks `uses:` entries, not service images, so that's called out explicitly in-workflow). - The postgres service uses POSTGRES_HOST_AUTH_METHOD: trust rather than a password: it's a throwaway container reachable only from this job, so trust auth avoids putting any credential in the workflow at all. - vector extension is created in its own step (PgVectorStore intentionally refuses to auto-create it) which doubles as an explicit connectivity gate. - pg_available() now raises instead of skipping when TEST_PGVECTOR_URL was set explicitly (which CI always does), so a genuinely broken service fails the job instead of the suite quietly reporting green having run nothing. - Installs are hash-verified throughout (pep517-build.txt + --no-build-isolation + a new pgvector-extra.txt lockfile), matching ci.yml's existing convention for the OpenSSF Scorecard Pinned-Dependencies check. - Two pre-existing test issues the first live run exposed are fixed: a dead leftover cleanup block in test_search_empty_store that targeted the wrong table through an already-closed connection, and a vacuous assert all(uuid.UUID(...)) that could never evaluate False. History note: this replaces several earlier commits on this branch, squashed to drop an early revision that briefly hardcoded a throwaway POSTGRES_PASSWORD for the ephemeral CI-only service container before this was reworked to trust auth. That value was never reachable outside the job and protected no real data, but GitGuardian correctly flags any committed secret-shaped string regardless of real-world risk, so it's removed from history rather than just superseded.