sync from remote upstream

.dockerignore

@@ -0,0 +1,23 @@
+.git
+__pycache__
+*.py[oc]
+.venv
+.env
+.envrc
+.ruff_cache
+.mypy_cache
+.pytest_cache
+.claude
+.coverage
+.DS_Store
+build
+dist
+wheels
+*.egg-info
+docs
+site
+.github
+.qdrant_code_embeddings
+CLAUDE.md
+AGENTS.md
+PROJECT.md

.env.example

@@ -60,6 +60,17 @@
 # CYPHER_MODEL=gemini-2.5-flash
 # CYPHER_API_KEY=your-google-api-key
 
+# Example 6: LiteLLM with custom provider
+# ORCHESTRATOR_PROVIDER=litellm_proxy
+# ORCHESTRATOR_MODEL=gpt-oss:120b
+# ORCHESTRATOR_ENDPOINT=http://litellm:4000/v1
+# ORCHESTRATOR_API_KEY=sk-your-litellm-key
+
+# CYPHER_PROVIDER=litellm_proxy
+# CYPHER_MODEL=openrouter/gpt-oss:120b
+# CYPHER_ENDPOINT=http://litellm:4000/v1
+# CYPHER_API_KEY=sk-your-litellm-key
+
 # Thinking budget for reasoning models (optional)
 # ORCHESTRATOR_THINKING_BUDGET=10000
 # CYPHER_THINKING_BUDGET=5000
@@ -68,9 +79,20 @@
 MEMGRAPH_HOST=localhost
 MEMGRAPH_PORT=7687
 MEMGRAPH_HTTP_PORT=7444
+# Memgraph authentication credentials
+# Leave MEMGRAPH_USERNAME empty (or omit it) if your Memgraph instance doesn't require authentication
+# If authentication is enabled, provide both username and password
+# Common defaults: username=neo4j, password=password (or your custom credentials)
+MEMGRAPH_USERNAME=
+MEMGRAPH_PASSWORD=
 LAB_PORT=3000
 MEMGRAPH_BATCH_SIZE=1000
 
+# Qdrant settings
+# Leave QDRANT_URL unset to use local file mode (only suitable below ~20k embeddings)
+# For larger codebases, run the bundled docker-compose service and point at it:
+# QDRANT_URL=http://localhost:6333
+
 # Repository settings
 TARGET_REPO_PATH=.
 

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @vitali87

.github/FUNDING.yml

@@ -3,5 +3,4 @@
 github: vitali87
 buy_me_a_coffee: vitali87
 
-# Uncomment and add username when you set up Patreon:
-# patreon: YOUR_USERNAME
+patreon: vitali87

.github/ISSUE_TEMPLATE/config.yml

@@ -1,11 +1,8 @@
-blank_issues_enabled: false
+blank_issues_enabled: true
 contact_links:
-  - name: 💬 Discussions
-    url: https://github.com/vitali87/code-graph-rag/discussions
-    about: Ask questions and discuss ideas with the community
   - name: 📚 Documentation
-    url: https://github.com/vitali87/code-graph-rag#readme
+    url: https://codeberg.org/vitali87/code-graph-rag
     about: Read the documentation and setup guides
   - name: 🎓 MCP Server Setup
-    url: https://github.com/vitali87/code-graph-rag/blob/main/docs/claude-code-setup.md
+    url: https://codeberg.org/vitali87/code-graph-rag/src/branch/main/docs/claude-code-setup.md
     about: Setup Code-Graph-RAG as an MCP server with Claude Code

.github/ISSUE_TEMPLATE/documentation.yml

@@ -31,7 +31,7 @@ body:
     attributes:
       label: URL (if applicable)
       description: Link to the documentation page
-      placeholder: "https://github.com/vitali87/code-graph-rag/blob/main/..."
+      placeholder: "https://codeberg.org/vitali87/code-graph-rag/src/branch/main/..."
 
   - type: textarea
     id: current-state

.github/ISSUE_TEMPLATE/question.yml

@@ -6,7 +6,7 @@ body:
   - type: markdown
     attributes:
       value: |
-        Thank you for your question! For general discussions or open-ended questions, consider using [GitHub Discussions](https://github.com/vitali87/code-graph-rag/discussions).
+        Thank you for your question! Please keep questions concrete; for broader topics, prefer opening an [issue](https://codeberg.org/vitali87/code-graph-rag/issues) with the `question` label.
 
   - type: textarea
     id: question

.github/dependabot.yml

@@ -0,0 +1,16 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/pull_request_template.md

@@ -0,0 +1,38 @@
+## Summary
+
+<!-- What does this PR do? Keep it brief: 1-3 bullet points. -->
+
+-
+
+## Type of Change
+
+<!-- Check all that apply. -->
+
+- [ ] Bug fix
+- [ ] New feature
+- [ ] Performance improvement
+- [ ] Refactoring (no functional changes)
+- [ ] Documentation
+- [ ] CI/CD or tooling
+- [ ] Dependencies
+
+## Related Issues
+
+<!-- Link related issues: "Fixes #123", "Closes #456", or "Related to #789" -->
+
+## Test Plan
+
+<!-- How was this tested? Check all that apply. -->
+
+- [ ] Unit tests pass (`make test-parallel` or `uv run pytest -n auto -m "not integration"`)
+- [ ] New tests added
+- [ ] Integration tests pass (`make test-integration`, requires Docker)
+- [ ] Manual testing (describe below)
+
+## Checklist
+
+- [ ] PR title follows [Conventional Commits](https://www.conventionalcommits.org/) format
+- [ ] All pre-commit checks pass (`make pre-commit`)
+- [ ] No hardcoded strings in non-config/non-constants files
+- [ ] No `# type: ignore`, `cast()`, `Any`, or `object` type hints
+- [ ] No new comments or docstrings (code should be self-documenting)

.github/workflows/build-binaries.yml

@@ -8,10 +8,14 @@ on:
   release:
     types: [created]
 
+permissions: read-all
+
 jobs:
   build:
     name: Build ${{ matrix.platform }}-${{ matrix.arch }}
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: write
     timeout-minutes: 30
     strategy:
       fail-fast: false
@@ -32,18 +36,18 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
           submodules: recursive
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.12"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@e4db8464a088ece1b920f60402e813ea4de65b8f # v4
         with:
           enable-cache: true
           cache-dependency-glob: "uv.lock"
@@ -66,7 +70,7 @@ jobs:
           fi
 
       - name: Upload binary artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: code-graph-rag-${{ matrix.platform }}-${{ matrix.arch }}
           path: dist/code-graph-rag-*
@@ -75,7 +79,39 @@ jobs:
 
       - name: Upload to release
         if: startsWith(github.ref, 'refs/tags/v')
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2
         with:
           files: dist/code-graph-rag-*
           fail_on_unmatched_files: true
+
+  sign-release:
+    name: Sign Release Artifacts
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
+    steps:
+      - name: Install cosign
+        uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
+
+      - name: Download all artifacts
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          path: artifacts
+          merge-multiple: true
+
+      - name: Sign artifacts
+        shell: bash
+        run: |
+          for f in artifacts/*; do
+            [ -f "$f" ] || continue
+            cosign sign-blob --yes --bundle "${f}.sigstore.json" "$f"
+          done
+
+      - name: Upload signatures to release
+        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2
+        with:
+          files: artifacts/*.sigstore.json
+          fail_on_unmatched_files: false