sync from remote upstream

.dockerignore

@@ -0,0 +1,23 @@
+.git
+__pycache__
+*.py[oc]
+.venv
+.env
+.envrc
+.ruff_cache
+.mypy_cache
+.pytest_cache
+.claude
+.coverage
+.DS_Store
+build
+dist
+wheels
+*.egg-info
+docs
+site
+.github
+.qdrant_code_embeddings
+CLAUDE.md
+AGENTS.md
+PROJECT.md

.env.example

@@ -60,6 +60,17 @@
 # CYPHER_MODEL=gemini-2.5-flash
 # CYPHER_API_KEY=your-google-api-key
 
+# Example 6: LiteLLM with custom provider
+# ORCHESTRATOR_PROVIDER=litellm_proxy
+# ORCHESTRATOR_MODEL=gpt-oss:120b
+# ORCHESTRATOR_ENDPOINT=http://litellm:4000/v1
+# ORCHESTRATOR_API_KEY=sk-your-litellm-key
+
+# CYPHER_PROVIDER=litellm_proxy
+# CYPHER_MODEL=openrouter/gpt-oss:120b
+# CYPHER_ENDPOINT=http://litellm:4000/v1
+# CYPHER_API_KEY=sk-your-litellm-key
+
 # Thinking budget for reasoning models (optional)
 # ORCHESTRATOR_THINKING_BUDGET=10000
 # CYPHER_THINKING_BUDGET=5000
@@ -68,6 +79,12 @@
 MEMGRAPH_HOST=localhost
 MEMGRAPH_PORT=7687
 MEMGRAPH_HTTP_PORT=7444
+# Memgraph authentication credentials
+# Leave MEMGRAPH_USERNAME empty (or omit it) if your Memgraph instance doesn't require authentication
+# If authentication is enabled, provide both username and password
+# Common defaults: username=neo4j, password=password (or your custom credentials)
+MEMGRAPH_USERNAME=
+MEMGRAPH_PASSWORD=
 LAB_PORT=3000
 MEMGRAPH_BATCH_SIZE=1000
 

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @vitali87

.github/FUNDING.yml

@@ -3,5 +3,4 @@
 github: vitali87
 buy_me_a_coffee: vitali87
 
-# Uncomment and add username when you set up Patreon:
-# patreon: YOUR_USERNAME
+patreon: vitali87

.github/ISSUE_TEMPLATE/config.yml

@@ -1,4 +1,4 @@
-blank_issues_enabled: false
+blank_issues_enabled: true
 contact_links:
   - name: 💬 Discussions
     url: https://github.com/vitali87/code-graph-rag/discussions

.github/dependabot.yml

@@ -0,0 +1,16 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/pull_request_template.md

@@ -0,0 +1,38 @@
+## Summary
+
+<!-- What does this PR do? Keep it brief: 1-3 bullet points. -->
+
+-
+
+## Type of Change
+
+<!-- Check all that apply. -->
+
+- [ ] Bug fix
+- [ ] New feature
+- [ ] Performance improvement
+- [ ] Refactoring (no functional changes)
+- [ ] Documentation
+- [ ] CI/CD or tooling
+- [ ] Dependencies
+
+## Related Issues
+
+<!-- Link related issues: "Fixes #123", "Closes #456", or "Related to #789" -->
+
+## Test Plan
+
+<!-- How was this tested? Check all that apply. -->
+
+- [ ] Unit tests pass (`make test-parallel` or `uv run pytest -n auto -m "not integration"`)
+- [ ] New tests added
+- [ ] Integration tests pass (`make test-integration`, requires Docker)
+- [ ] Manual testing (describe below)
+
+## Checklist
+
+- [ ] PR title follows [Conventional Commits](https://www.conventionalcommits.org/) format
+- [ ] All pre-commit checks pass (`make pre-commit`)
+- [ ] No hardcoded strings in non-config/non-constants files
+- [ ] No `# type: ignore`, `cast()`, `Any`, or `object` type hints
+- [ ] No new comments or docstrings (code should be self-documenting)

.github/workflows/build-binaries.yml

@@ -8,10 +8,14 @@ on:
   release:
     types: [created]
 
+permissions: read-all
+
 jobs:
   build:
     name: Build ${{ matrix.platform }}-${{ matrix.arch }}
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: write
     timeout-minutes: 30
     strategy:
       fail-fast: false
@@ -32,18 +36,18 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
           submodules: recursive
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.12"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@e4db8464a088ece1b920f60402e813ea4de65b8f # v4
         with:
           enable-cache: true
           cache-dependency-glob: "uv.lock"
@@ -66,7 +70,7 @@ jobs:
           fi
 
       - name: Upload binary artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: code-graph-rag-${{ matrix.platform }}-${{ matrix.arch }}
           path: dist/code-graph-rag-*
@@ -75,7 +79,39 @@ jobs:
 
       - name: Upload to release
         if: startsWith(github.ref, 'refs/tags/v')
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2
         with:
           files: dist/code-graph-rag-*
           fail_on_unmatched_files: true
+
+  sign-release:
+    name: Sign Release Artifacts
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
+    steps:
+      - name: Install cosign
+        uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
+
+      - name: Download all artifacts
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          path: artifacts
+          merge-multiple: true
+
+      - name: Sign artifacts
+        shell: bash
+        run: |
+          for f in artifacts/*; do
+            [ -f "$f" ] || continue
+            cosign sign-blob --yes --bundle "${f}.sigstore.json" "$f"
+          done
+
+      - name: Upload signatures to release
+        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2
+        with:
+          files: artifacts/*.sigstore.json
+          fail_on_unmatched_files: false

.github/workflows/ci.yml

@@ -7,6 +7,8 @@ on:
     branches: [main, master, develop]
   workflow_dispatch:
 
+permissions: read-all
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -19,16 +21,16 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@e4db8464a088ece1b920f60402e813ea4de65b8f # v4
         with:
           enable-cache: true
           cache-dependency-glob: "uv.lock"
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.12"
 
@@ -51,16 +53,16 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@e4db8464a088ece1b920f60402e813ea4de65b8f # v4
         with:
           enable-cache: true
           cache-dependency-glob: "uv.lock"
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.12"
 
@@ -75,41 +77,47 @@ jobs:
   test-unit:
     name: Unit Tests (${{ matrix.os }})
     runs-on: ${{ matrix.os }}
-    timeout-minutes: 15
+    timeout-minutes: 20
     strategy:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, windows-latest, macos-latest]
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           submodules: recursive
           fetch-depth: 0
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@e4db8464a088ece1b920f60402e813ea4de65b8f # v4
         with:
           enable-cache: true
           cache-dependency-glob: "uv.lock"
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.12"
 
       - name: Install dependencies
         run: |
           uv sync --extra treesitter-full --extra test --extra semantic --group dev
 
-      - name: Run unit tests (parallel)
+      - name: Run unit tests (parallel, with coverage)
+        if: matrix.os == 'macos-latest'
         run: |
           uv run pytest -n auto -m "not integration" --tb=short --cov=codebase_rag --cov-report=xml --cov-report=term
 
+      - name: Run unit tests (parallel, no coverage)
+        if: matrix.os != 'macos-latest'
+        run: |
+          uv run pytest -n auto -m "not integration" --tb=short
+
       - name: Upload coverage to Codecov
-        if: always() && secrets.CODECOV_TOKEN != ''
-        uses: codecov/codecov-action@v4
+        if: always() && matrix.os == 'macos-latest'
+        uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5.5.3
         with:
           files: ./coverage.xml
           flags: unit-${{ matrix.os }}
@@ -123,7 +131,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           submodules: recursive
           fetch-depth: 0
@@ -133,7 +141,7 @@ jobs:
           docker run -d --name memgraph -p 7687:7687 memgraph/memgraph-platform:latest
           echo "Waiting for Memgraph to start..."
           for i in {1..30}; do
-            if docker exec memgraph echo "SELECT 1;" 2>/dev/null; then
+            if docker exec memgraph mgconsole --no-history -c "RETURN 1;" 2>/dev/null; then
               echo "Memgraph is ready!"
               break
             fi
@@ -142,13 +150,13 @@ jobs:
           done
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@e4db8464a088ece1b920f60402e813ea4de65b8f # v4
         with:
           enable-cache: true
           cache-dependency-glob: "uv.lock"
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.12"
 
@@ -164,8 +172,8 @@ jobs:
           uv run pytest -m "integration" -v --tb=short --cov=codebase_rag --cov-report=xml --cov-report=term
 
       - name: Upload coverage to Codecov
-        if: always() && secrets.CODECOV_TOKEN != ''
-        uses: codecov/codecov-action@v4
+        if: always()
+        uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5.5.3
         with:
           files: ./coverage.xml
           flags: integration-ubuntu-latest
@@ -187,7 +195,7 @@ jobs:
 
     steps:
       - name: Check PR title format
-        uses: amannn/action-semantic-pull-request@v5
+        uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

.github/workflows/claude-code-review.yml

@@ -10,6 +10,8 @@ on:
       - "*.py"
       - "pyproject.toml"
 
+permissions: read-all
+
 jobs:
   claude-review:
     name: AI Code Review
@@ -26,13 +28,13 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 1
 
       - name: Run Claude Code Review
         id: claude-review
-        uses: anthropics/claude-code-action@beta
+        uses: anthropics/claude-code-action@28f83620103c48a57093dcc2837eec89e036bb9f # beta
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}