Merge remote-tracking branch 'upstream/main' into leseb/api-spec-comparison-v2

Author: leseb

.github/actions/setup-ollama/action.yml

@@ -1,23 +1,46 @@
 name: Setup Ollama
-description: Start Ollama
+description: Start Ollama and pull required models
 inputs:
   suite:
     description: 'Test suite to use: base, responses, vision, etc.'
     required: false
     default: ''
+  setup:
+    description: 'Setup name (ollama, ollama-vision, ollama-reasoning, etc.)'
+    required: false
+    default: 'ollama'
 runs:
   using: "composite"
   steps:
     - name: Start Ollama
       shell: bash
       run: |
-        if [ "${{ inputs.suite }}" == "vision" ]; then
-          image="ollama-with-vision-model"
+        echo "Starting Ollama server..."
+        docker run -d --name ollama -p 11434:11434 ollama/ollama
+        echo "Verifying Ollama status..."
+        timeout 30 bash -c 'while ! curl -s -L http://127.0.0.1:11434; do sleep 1 && echo "."; done'
+        echo "Ollama is ready"
+
+    - name: Pull models
+      shell: bash
+      env:
+        SETUP: ${{ inputs.setup }}
+        SUITE: ${{ inputs.suite }}
+      run: |
+        pull_model() {
+          echo "Pulling $1..."
+          docker exec ollama ollama pull "$1"
+        }
+
+        if [ "$SUITE" == "vision" ]; then
+          pull_model "llama3.2-vision:11b"
+          pull_model "nomic-embed-text:v1.5"
+        elif [ "$SETUP" == "ollama-reasoning" ]; then
+          pull_model "deepseek-r1:1.5b"
         else
-          image="ollama-with-models"
+          pull_model "llama3.2:3b-instruct-fp16"
+          pull_model "nomic-embed-text:v1.5"
+          pull_model "llama-guard3:1b"
         fi
 
-        echo "Starting Ollama with image: $image"
-        docker run -d --name ollama -p 11434:11434 docker.io/ogx/$image
-        echo "Verifying Ollama status..."
-        timeout 30 bash -c 'while ! curl -s -L http://127.0.0.1:11434; do sleep 1 && echo "."; done'
+        echo "All models pulled successfully"

.github/actions/setup-test-environment/action.yml

@@ -67,13 +67,14 @@ runs:
         " 2>/dev/null || echo "Dataset download failed (may already be cached)"
 
     - name: Setup ollama
-      if: ${{ (inputs.setup == 'ollama' || inputs.setup == 'ollama-vision') && inputs.inference-mode == 'record' }}
+      if: ${{ startsWith(inputs.setup, 'ollama') && inputs.inference-mode != 'replay' }}
       uses: ./.github/actions/setup-ollama
       with:
         suite: ${{ inputs.suite }}
+        setup: ${{ inputs.setup }}
 
     - name: Setup vllm
-      if: ${{ inputs.setup == 'vllm' && inputs.inference-mode == 'record' }}
+      if: ${{ startsWith(inputs.setup, 'vllm') && inputs.inference-mode != 'replay' }}
       uses: ./.github/actions/setup-vllm
 
     - name: Start Postgres service

.github/workflows/codeql.yml

@@ -4,9 +4,9 @@ on:
   pull_request:
     # PRs are checked for new issues
     branches: [ "main" ]
-    # Limit scans to changes in the .github directory, bash scripts are not scanned anyway
     paths:
       - '.github/**'
+      - 'src/**'
 
 jobs:
   analyze:
@@ -15,10 +15,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        # actions is the most specific language option for
-        # codeql does NOT support Bash
-        # In case javascript is used in workflows, that should be added or replace
-        language: [ 'actions' ]
+        language: [ 'actions', 'python' ]
 
     steps:
     - name: Checkout repository

.github/workflows/integration-auth-tests.yml

@@ -116,8 +116,8 @@ jobs:
                 table_name: openai_conversations
                 backend: sql_default
               prompts:
-                namespace: prompts
-                backend: kv_default
+                table_name: prompts
+                backend: sql_default
           server:
             port: 8321
             auth:

.github/workflows/integration-responses-conversations-auth-tests.yml

@@ -164,8 +164,8 @@ jobs:
                 table_name: openai_conversations
                 backend: sql_default
               prompts:
-                namespace: prompts
-                backend: kv_default
+                table_name: prompts
+                backend: sql_default
           models:
           - model_id: openai/gpt-4o
             model_type: llm

.github/workflows/record-integration-tests.yml

@@ -6,7 +6,7 @@
 # SECURITY NOTE: This workflow uses pull_request (not pull_request_target) for security.
 # Security measures:
 # 1. Runs with read-only permissions (no write access to repo or secrets exposure)
-# 2. Only ollama provider runs automatically on pull_request (no secrets)
+# 2. Only ollama variants run automatically on pull_request (no secrets needed)
 # 3. API key providers (gpt, azure, bedrock) only run via manual workflow_dispatch
 # 4. Fork PRs with API key providers are blocked (prevents secret theft)
 # 5. Recordings uploaded as artifacts; companion workflow handles commits
@@ -120,13 +120,13 @@ jobs:
           fi
 
           # Determine which providers to run
-          # Security: For pull_request, only run ollama (no secrets)
+          # Security: For pull_request, only run ollama variants (no secrets needed)
           # Manual workflow_dispatch uses input providers (defaults to API providers)
           if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
             PROVIDERS="$INPUT_PROVIDERS"
           else
             # Auto-trigger on PR: only ollama (no secrets exposed to any PR)
-            PROVIDERS="ollama"
+            PROVIDERS="ollama,ollama-reasoning"
           fi
 
           {
@@ -190,6 +190,12 @@ jobs:
         provider:
           - setup: ollama
             suite: base
+          - setup: ollama-vision
+            suite: vision
+          - setup: ollama-reasoning
+            suite: ollama-reasoning
+          - setup: ollama
+            suite: messages
           - setup: gpt
             suite: responses
           - setup: gpt
@@ -238,21 +244,26 @@ jobs:
           project_id: ${{ secrets.VERTEX_AI_PROJECT }}
           workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
 
-      # Note: Using full repo path with pinned SHA ensures actions are loaded from
-      # a trusted commit, not from PR checkout. This is critical for security.
       - name: Setup test environment
         if: steps.should_run.outputs.run == 'true'
-        uses: ogx-ai/llama-stack/.github/actions/setup-test-environment@68c0994a790e4f029007f3cce12a744d69a7d435
+        uses: ogx-ai/ogx/.github/actions/setup-test-environment@e1ba4f9f10fa45750f5b4f186a0c4ae59bc93e4d
         with:
           python-version: "3.12"
           client-version: "latest"
           setup: ${{ matrix.provider.setup }}
           suite: ${{ inputs.suite || matrix.provider.suite }}
           inference-mode: 'record-if-missing'
 
+      - name: Clear stale model list recordings
+        if: steps.should_run.outputs.run == 'true' && matrix.provider.setup == 'ollama-reasoning'
+        shell: bash
+        run: |
+          find tests/integration -path "*/recordings/models-*.json" -delete
+          echo "Cleared model list recordings so record-if-missing creates fresh ones"
+
       - name: Run and record tests
         if: steps.should_run.outputs.run == 'true'
-        uses: ogx-ai/llama-stack/.github/actions/run-and-record-tests@68c0994a790e4f029007f3cce12a744d69a7d435
+        uses: ogx-ai/ogx/.github/actions/run-and-record-tests@e1ba4f9f10fa45750f5b4f186a0c4ae59bc93e4d
         env:
           OPENAI_API_KEY: ${{ matrix.provider.setup == 'gpt' && secrets.OPENAI_API_KEY || '' }}
           AZURE_API_KEY: ${{ matrix.provider.setup == 'azure' && secrets.AZURE_API_KEY || '' }}
@@ -282,7 +293,7 @@ jobs:
         if: steps.should_run.outputs.run == 'true'
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: recordings-${{ matrix.provider.setup }}-${{ github.run_id }}-${{ github.run_attempt || '1' }}
+          name: recordings-${{ matrix.provider.setup }}-${{ matrix.provider.suite }}-${{ github.run_id }}-${{ github.run_attempt || '1' }}
           path: |
             tests/integration/recordings/
             tests/integration/*/recordings/