Merge branch 'main' into dependabot/uv/aiohttp-3.14.0

Author: leseb

.github/ISSUE_TEMPLATE/config.yml

@@ -4,6 +4,6 @@ contact_links:
   - name: Have you read the docs?
     url: https://ogx-ai.github.io/docs
     about: Much help can be found in the docs
-  - name: Chat on Slack
-    url: https://join.slack.com/t/ogx-ai/shared_invite/zt-3uyw5bxj9-tSEwsNZncgkGEKbd4dXIpw
-    about: Maybe chatting with the community can help
+  - name: Join the Discord community
+    url: https://discord.gg/bUYRqEvK6
+    about: Ask questions and chat with the community

.github/actions/run-and-record-tests/action.yml

@@ -24,6 +24,10 @@ inputs:
     description: 'Regex pattern to pass to pytest -k'
     required: false
     default: ''
+  text-model:
+    description: 'Text model override to pass to integration-tests.sh'
+    required: false
+    default: ''
   target-branch:
     description: 'Target branch for recording commits (for PRs, use the PR head branch)'
     required: false
@@ -56,6 +60,7 @@ runs:
         INPUT_SUITE: ${{ inputs.suite }}
         INPUT_SUBDIRS: ${{ inputs.subdirs }}
         INPUT_PATTERN: ${{ inputs.pattern }}
+        INPUT_TEXT_MODEL: ${{ inputs.text-model }}
       run: |
         SCRIPT_ARGS="--stack-config ${INPUT_STACK_CONFIG} --inference-mode ${INPUT_INFERENCE_MODE}"
 
@@ -72,6 +77,9 @@ runs:
         if [ -n "${INPUT_PATTERN}" ]; then
           SCRIPT_ARGS="${SCRIPT_ARGS} --pattern ${INPUT_PATTERN}"
         fi
+        if [ -n "${INPUT_TEXT_MODEL}" ]; then
+          SCRIPT_ARGS="${SCRIPT_ARGS} --text-model ${INPUT_TEXT_MODEL}"
+        fi
 
         echo "=== Running command ==="
         echo "uv run --no-sync ./scripts/integration-tests.sh $SCRIPT_ARGS"

.github/workflows/README.md

@@ -17,7 +17,8 @@ OGX uses GitHub Actions for Continuous Integration (CI). Below is a table detail
 | Integration Auth Tests | [integration-auth-tests.yml](integration-auth-tests.yml) | Run the integration test suite with Kubernetes authentication |
 | Integration Responses, Conversations & Prompts Auth Tests | [integration-responses-conversations-auth-tests.yml](integration-responses-conversations-auth-tests.yml) | Run responses, conversations, and prompts auth tests with Kubernetes authentication |
 | SqlStore Integration Tests | [integration-sql-store-tests.yml](integration-sql-store-tests.yml) | Run the integration test suite with SqlStore |
-| Messages API - Claude Code CLI Smoke Test | [integration-tests-messages-cli.yml](integration-tests-messages-cli.yml) | Drive the real Claude Code CLI against /v1/messages (live, Ollama) |
+| Responses API - Codex CLI Smoke Test | [integration-tests-codex-cli.yml](integration-tests-codex-cli.yml) | Manually drive the real Codex CLI against /v1/responses |
+| Messages API - Claude Code Client Smoke Tests | [integration-tests-messages-clients.yml](integration-tests-messages-clients.yml) | Drive the Claude Code CLI and Agent SDK against /v1/messages (live, Ollama) |
 | Integration Tests (Replay) | [integration-tests.yml](integration-tests.yml) | Run the integration test suites from tests/integration in replay mode |
 | Vector IO Integration Tests | [integration-vector-io-tests.yml](integration-vector-io-tests.yml) | Run the integration test suite with various VectorIO providers |
 | OpenAPI Generator SDK Validation | [openapi-generator-validation.yml](openapi-generator-validation.yml) | Validate OpenAPI Generator SDK generation |

.github/workflows/backward-compat.yml

@@ -41,7 +41,7 @@ jobs:
           python-version: '3.12'
 
       - name: Install uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: true
 
@@ -451,7 +451,7 @@ jobs:
           python-version: '3.12'
 
       - name: Install uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: true
 

.github/workflows/ci-status.yml

@@ -43,8 +43,8 @@ jobs:
             const excludedApps = new Set(['mergify']);
 
             const terminalStatuses = new Set(['completed']);
-            const successConclusions = new Set(['success', 'skipped', 'neutral']);
-            const failureConclusions = new Set(['failure', 'cancelled', 'timed_out']);
+            const successConclusions = new Set(['success', 'skipped', 'neutral', 'cancelled']);
+            const failureConclusions = new Set(['failure', 'timed_out']);
 
             while (true) {
               const { data: checkRuns } = await github.rest.checks.listForRef({

.github/workflows/codeql.yml

@@ -23,7 +23,7 @@ jobs:
 
     # Initializes CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v3
+      uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v3
       with:
         languages: ${{ matrix.language }}
         # "security-extended" is recommended for higher severity coverage - not necessary can be removed to speed up
@@ -32,6 +32,6 @@ jobs:
     # Scans the code and uploads results to GitHub Security tab.
     # The "Fail on High" logic is handled by Branch Protection Rules in Settings
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v3
+      uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v3
       with:
         category: "/language:${{ matrix.language }}"

.github/workflows/dependabot-constraints.yml

@@ -44,7 +44,7 @@ jobs:
           python-version: '3.12'
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
 
       - name: Parse dependency info from Dependabot commit
         id: parse

.github/workflows/integration-tests-codex-cli.yml

@@ -0,0 +1,62 @@
+name: Responses API - Codex CLI Smoke Test
+
+run-name: Manually drive the real Codex CLI against /v1/responses
+
+on:
+  # Keep this manual until local providers can complete a clean Codex turn.
+  # See https://github.com/ogx-ai/ogx/issues/6069.
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref == 'refs/heads/main' && github.run_id || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  CODEX_CLI_VERSION: '0.136.0'
+  CODEX_SMOKE_TEXT_MODEL: 'ollama/llama3.2:1b'
+
+jobs:
+  codex-cli-smoke:
+    name: Codex CLI smoke (ollama, live)
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      # Live mode (not replay) so the Ollama backend is provisioned and the
+      # real Codex CLI traffic reaches a real model through /v1/responses.
+      - name: Setup test environment
+        uses: ./.github/actions/setup-test-environment
+        with:
+          python-version: '3.12'
+          client-version: 'latest'
+          setup: 'ollama'
+          suite: 'responses'
+          inference-mode: 'live'
+
+      - name: Install Codex CLI
+        run: |
+          npm install -g "@openai/codex@${CODEX_CLI_VERSION}"
+          codex --version
+
+      - name: Pull Codex smoke model
+        run: docker exec ollama ollama pull "${CODEX_SMOKE_TEXT_MODEL#ollama/}"
+
+      - name: Run Codex CLI smoke test
+        uses: ./.github/actions/run-and-record-tests
+        env:
+          OGX_ENABLE_CODEX_CLI_SMOKE: '1'
+        with:
+          stack-config: 'server:ci-tests'
+          setup: 'ollama'
+          suite: 'responses'
+          inference-mode: 'live'
+          pattern: 'test_codex_cli_smoke_uses_generated_ogx_profile'
+          text-model: ${{ env.CODEX_SMOKE_TEXT_MODEL }}

…flows/integration-tests-messages-cli.yml …s/integration-tests-messages-clients.yml.github/workflows/integration-tests-messages-cli.yml renamed to .github/workflows/integration-tests-messages-clients.yml .github/workflows/integration-tests-messages-cli.yml renamed to .github/workflows/integration-tests-messages-clients.yml

@@ -1,6 +1,6 @@
-name: Messages API - Claude Code CLI Smoke Test
+name: Messages API - Claude Code Client Smoke Tests
 
-run-name: Drive the real Claude Code CLI against /v1/messages (live, Ollama)
+run-name: Drive the Claude Code CLI and Agent SDK against /v1/messages (live, Ollama)
 
 on:
   push:
@@ -18,7 +18,7 @@ on:
       - 'tests/integration/messages/**'
       - 'uv.lock'
       - 'pyproject.toml'
-      - '.github/workflows/integration-tests-messages-cli.yml'
+      - '.github/workflows/integration-tests-messages-clients.yml'
       - '.github/actions/setup-test-environment/action.yml'
       - '.github/actions/run-and-record-tests/action.yml'
       - 'scripts/integration-tests.sh'
@@ -36,27 +36,31 @@ permissions:
   contents: read
 
 env:
-  # Pinned for reproducibility. The CLI bakes the cwd, date, and platform into
-  # every request body, so its traffic cannot be recorded/replayed; this test
-  # runs live against Ollama instead. Bumping only changes the client behavior
-  # under test, not any committed recordings.
+  # Pinned for reproducibility. Both clients ultimately drive the Claude Code
+  # CLI, which bakes the cwd, date, and platform into every request body, so
+  # their traffic cannot be recorded/replayed; these tests run live against
+  # Ollama instead. Bumping only changes the client behavior under test.
   CLAUDE_CODE_CLI_VERSION: '2.1.159'
+  # The Agent SDK is installed at workflow time rather than as a project
+  # dependency, since only this one live smoke test uses it; it spawns the same
+  # CLI. The SDK test self-skips if the package is unavailable.
+  CLAUDE_AGENT_SDK_VERSION: '0.2.87'
 
 jobs:
-  claude-code-cli-smoke:
-    name: Claude Code CLI smoke (ollama, live)
+  claude-code-client-smoke:
+    name: Claude Code CLI + Agent SDK smoke (ollama, live)
     runs-on: ubuntu-latest
-    # CPU-only runners generate slowly; the live CLI session can take several
-    # minutes against the Ollama model. Keep ample headroom over the test's own
-    # 600s subprocess timeout plus environment setup.
+    # CPU-only runners generate slowly; the live sessions can take several
+    # minutes against the Ollama model. Keep ample headroom over the tests' own
+    # 600s timeouts plus environment setup.
     timeout-minutes: 30
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      # Live mode (not replay) so the Ollama backend is provisioned and the
-      # real CLI traffic reaches a real model.
+      # Live mode (not replay) so the Ollama backend is provisioned and the real
+      # client traffic reaches a real model.
       - name: Setup test environment
         uses: ./.github/actions/setup-test-environment
         with:
@@ -66,17 +70,26 @@ jobs:
           suite: 'messages'
           inference-mode: 'live'
 
+      # Both clients need the Claude Code CLI at runtime: the CLI test invokes it
+      # directly, and the SDK spawns it as a subprocess.
       - name: Install Claude Code CLI
         run: |
           curl -fsSL https://claude.ai/install.sh | bash -s -- "${CLAUDE_CODE_CLI_VERSION}"
           echo "$HOME/.local/bin" >> "$GITHUB_PATH"
           "$HOME/.local/bin/claude" --version
 
-      - name: Run Claude Code CLI smoke test
+      - name: Install Claude Agent SDK
+        run: uv pip install "claude-agent-sdk==${CLAUDE_AGENT_SDK_VERSION}"
+
+      - name: Run Claude Code client smoke tests
         uses: ./.github/actions/run-and-record-tests
         with:
           stack-config: 'server:ci-tests'
           setup: 'ollama'
           suite: 'messages'
           inference-mode: 'live'
-          pattern: 'test_claude_code_cli_smoke'
+          # Selects both test_claude_code_cli_smoke and test_claude_agent_sdk_smoke.
+          # Must stay a single shell word: run-and-record-tests passes --pattern
+          # unquoted, so a -k expression with spaces would be split into separate
+          # arguments.
+          pattern: 'test_claude'

.github/workflows/integration-vector-io-tests.yml

@@ -195,10 +195,23 @@ jobs:
           docker logs infinispan
           exit 1
 
+      - name: Cache Hugging Face models
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+        with:
+          path: ~/.cache/huggingface
+          key: hf-${{ runner.os }}-${{ matrix.python-version }}-nomic-embed-text-v1.5
+
       - name: Build OGX
         run: |
           uv run --no-sync ogx stack list-deps ci-tests | xargs -L1 uv pip install
 
+      - name: Pre-download embedding model
+        run: |
+          uv run --no-sync python - <<'PY'
+          from sentence_transformers import SentenceTransformer
+          SentenceTransformer("nomic-ai/nomic-embed-text-v1.5", trust_remote_code=True)
+          PY
+
       - name: Check Storage and Memory Available Before Tests
         if: ${{ always() }}
         run: |
@@ -207,6 +220,8 @@ jobs:
 
       - name: Run Vector IO Integration Tests
         env:
+          HF_HUB_OFFLINE: "1"
+          TRANSFORMERS_OFFLINE: "1"
           ENABLE_CHROMADB: ${{ matrix.vector-io-provider == 'remote::chromadb' && 'true' || '' }}
           CHROMADB_URL: ${{ matrix.vector-io-provider == 'remote::chromadb' && 'http://localhost:8000' || '' }}
           ENABLE_PGVECTOR: ${{ matrix.vector-io-provider == 'remote::pgvector' && 'true' || '' }}