feat(actions): publish repository context to Pages - #423
Conversation
dcec1aa to
e9f17b4
Compare
41c3624 to
d270ad7
Compare
e9f17b4 to
f6dbe2c
Compare
github-actions
Bot
added
type/docs
c6a7bce to
95592a8
Compare
Add commit-validated BM25/vector serving artifacts and a publish CLI that pairs them with static Wiki exports. Keep credentials, machine paths, mutable vector state, and overlapping output roots out of distributable data.\n\nVerified with focused artifact/CLI/static-export tests and the full unit tier.
Add a reusable no-model or semantic publishing workflow that builds the static Wiki and matching commit-addressed context artifact. Bind cache and artifact identity to the indexed checkout, constrain credential exposure, reject unsafe inputs, and document GitHub Models and BYO routes.\n\nVerified with the full unit tier, pre-commit, action-validator, and strict MkDocs build.
Lowercase repository identity before deriving the default artifact name so GitHub lookup and cache consumers use one stable owner/repository spelling.\n\nVerified with the Action tests, action-validator, and pre-commit.
95592a8 to
ee0eb66
Compare
Convert trusted local vector document pickles into inert JSON when packaging query-serving artifacts. Prefer that portable format at load time while retaining the legacy pickle fallback for local indexes. Verified with focused artifact and vector-store tests.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5c5576def6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| relative=relative, | ||
| ) | ||
| entry_data = entry.to_dict() | ||
| entry_data["path"] = relative |
There was a problem hiding this comment.
When the downloaded context artifact is consumed by existing runtimes, this relative views/... path is passed through unchanged (for example, ServerContext.load() and the web registry load entry.path directly). Unless the caller happens to start the process from the artifact root, codenib mcp /tmp/context/repo_manifest.json will look for views/bm25 under the current working directory and fail to load the packaged BM25/vector views. Please either make the loaders resolve artifact-relative manifest paths from the manifest location, or write paths here in a form the current loaders can open.
Useful? React with 👍 / 👎.
| if output_dir == source or source in output_dir.parents: | ||
| raise ValueError(f"static export output must be outside the {label}") |
There was a problem hiding this comment.
When codenib export is run without --output, _run_export still defaults to manifest_path.parent / "static-wiki"; this new index-root overlap check rejects that exact default because it is inside manifest_path.parent. The documented/default export invocation now exits before building anything, so either move the default outside the index root or allow this owned subdirectory.
Useful? React with 👍 / 👎.
| name = str(key).strip().lower().replace("-", "_") | ||
| if name in _CREDENTIAL_FIELDS: | ||
| raise ValueError(f"{source} contains a credential field: {key}") |
There was a problem hiding this comment.
For published artifacts, this check only lowercases and converts hyphens to underscores, so common credential keys such as accessToken, clientSecret, privateKey, or a generic secret do not match _CREDENTIAL_FIELDS and can be serialized into the portable manifest from legacy/custom view config or metadata. Use the same canonicalization/suffix coverage as the provider-route validation so these credential-shaped fields are rejected before publication.
Useful? React with 👍 / 👎.
| metadata = json.loads(metadata_path.read_text(encoding="utf-8")) | ||
| if not isinstance(metadata, dict): | ||
| raise ValueError("portable BM25 metadata must be a JSON object") | ||
| metadata["project_root"] = "source" |
There was a problem hiding this comment.
For an Action-uploaded context artifact there is no source/ directory, but this rewrite makes BM25CodeIndexer.search(..., return_code_content=True) try to open source/<file> and silently omit the snippet instead of using the copied documents.json page content. That leaves MCP BM25 results from the portable artifact without source evidence; either stage the source, resolve source to a real checkout, or fall back to the stored document content.
Useful? React with 👍 / 👎.
github-actions
Bot
added
the
scope/indexing
Summary
Add a zero-credential GitHub Pages path that builds a static repository Wiki and a matching portable, commit-addressed context artifact. The default
fastroute deploys the precomputed Wiki and packages BM25 without a model download or credential. The optionalsemanticroute adds vectors through a local Hugging Face model or an explicit BYO OpenAI-compatible endpoint without serializing credentials.The provider and static-export dependencies are merged. This PR is now independently reviewable against
main. Closes #422 and advances H3 of #415.Changes
codenib artifact packandcodenib publishwith portable BM25/vector manifests, inert JSON vector documents, SHA-256 inventories, checkout identity checks, path normalization, and publication secret scanningfastsecret-free, defaultsemanticto local Hugging Face embeddings, and allow remote embeddings only through an explicit OpenAI-compatible route and optional caller secretType of Change
Testing
Tests pass locally
Added new tests for the changes
full unit tier on the complete stack: 2658 passed, 10 skipped, 183 deselected
post-restack Action, artifact, static-export, CLI, and provider suite: 100 passed
portable-vector conversion and loader suite: 28 passed
strict MkDocs build
pre-commit run --all-files
GitHub-hosted no-model Action smoke passed
real
pallets/itsdangerous@672971d6canary: fast publication and artifact verification passed; CPU-local CodeRankEmbed and BYO OpenAI-compatible semantic builds both produced verified JSON-backed BM25/vector artifacts; configured credential scan was cleanChecklist