sync from remote upstream

.dockerignore

@@ -0,0 +1,23 @@
+.git
+__pycache__
+*.py[oc]
+.venv
+.env
+.envrc
+.ruff_cache
+.mypy_cache
+.pytest_cache
+.claude
+.coverage
+.DS_Store
+build
+dist
+wheels
+*.egg-info
+docs
+site
+.github
+.qdrant_code_embeddings
+CLAUDE.md
+AGENTS.md
+PROJECT.md

.env.example

@@ -60,6 +60,17 @@
 # CYPHER_MODEL=gemini-2.5-flash
 # CYPHER_API_KEY=your-google-api-key
 
+# Example 6: LiteLLM with custom provider
+# ORCHESTRATOR_PROVIDER=litellm_proxy
+# ORCHESTRATOR_MODEL=gpt-oss:120b
+# ORCHESTRATOR_ENDPOINT=http://litellm:4000/v1
+# ORCHESTRATOR_API_KEY=sk-your-litellm-key
+
+# CYPHER_PROVIDER=litellm_proxy
+# CYPHER_MODEL=openrouter/gpt-oss:120b
+# CYPHER_ENDPOINT=http://litellm:4000/v1
+# CYPHER_API_KEY=sk-your-litellm-key
+
 # Thinking budget for reasoning models (optional)
 # ORCHESTRATOR_THINKING_BUDGET=10000
 # CYPHER_THINKING_BUDGET=5000
@@ -68,9 +79,27 @@
 MEMGRAPH_HOST=localhost
 MEMGRAPH_PORT=7687
 MEMGRAPH_HTTP_PORT=7444
+# Memgraph authentication credentials
+# Leave MEMGRAPH_USERNAME empty (or omit it) if your Memgraph instance doesn't require authentication
+# If authentication is enabled, provide both username and password
+# Common defaults: username=neo4j, password=password (or your custom credentials)
+MEMGRAPH_USERNAME=
+MEMGRAPH_PASSWORD=
 LAB_PORT=3000
 MEMGRAPH_BATCH_SIZE=1000
 
+# Qdrant settings
+# Leave QDRANT_URL unset to use local file mode (only suitable below ~20k embeddings)
+# For larger codebases, run the bundled docker-compose service and point at it:
+# QDRANT_URL=http://localhost:6333
+
+# Semantic vector store backend
+# Qdrant is the default. Set Milvus to use Milvus Lite or a self-hosted endpoint.
+# CGR_VECTOR_STORE_BACKEND=qdrant
+# CGR_VECTOR_STORE_BACKEND=milvus
+# MILVUS_URI=./.milvus_code_embeddings.db
+# MILVUS_URI=http://localhost:19530
+
 # Repository settings
 TARGET_REPO_PATH=.
 

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @vitali87

.github/CODE_OF_CONDUCT.md

@@ -0,0 +1,128 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, religion, or sexual identity
+and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the
+  overall community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or
+  advances of any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email
+  address, without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for moderation
+decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official e-mail address,
+posting via an official social media account, or acting as an appointed
+representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement at
+eheva87@gmail.com.
+All complaints will be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed
+unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing
+clarity around the nature of the violation and an explanation of why the
+behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series
+of actions.
+
+**Consequence**: A warning with consequences for continued behavior. No
+interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time. This
+includes avoiding interactions in community spaces as well as external channels
+like social media. Violating these terms may lead to a temporary or
+permanent ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including
+sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. No public or
+private interaction with the people involved, including unsolicited interaction
+with those enforcing the Code of Conduct, is allowed during this period.
+Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior,  harassment of an
+individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within
+the community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.0, available at
+https://www.contributor-covenant.org/version/2/0/code_of_conduct.html.
+
+Community Impact Guidelines were inspired by [Mozilla's code of conduct
+enforcement ladder](https://github.com/mozilla/diversity).
+
+[homepage]: https://www.contributor-covenant.org
+
+For answers to common questions about this code of conduct, see the FAQ at
+https://www.contributor-covenant.org/faq. Translations are available at
+https://www.contributor-covenant.org/translations.

.github/FUNDING.yml

@@ -3,5 +3,4 @@
 github: vitali87
 buy_me_a_coffee: vitali87
 
-# Uncomment and add username when you set up Patreon:
-# patreon: YOUR_USERNAME
+patreon: vitali87

.github/ISSUE_TEMPLATE/config.yml

@@ -1,10 +1,7 @@
-blank_issues_enabled: false
+blank_issues_enabled: true
 contact_links:
-  - name: 💬 Discussions
-    url: https://github.com/vitali87/code-graph-rag/discussions
-    about: Ask questions and discuss ideas with the community
   - name: 📚 Documentation
-    url: https://github.com/vitali87/code-graph-rag#readme
+    url: https://github.com/vitali87/code-graph-rag
     about: Read the documentation and setup guides
   - name: 🎓 MCP Server Setup
     url: https://github.com/vitali87/code-graph-rag/blob/main/docs/claude-code-setup.md

.github/ISSUE_TEMPLATE/question.yml

@@ -6,7 +6,7 @@ body:
   - type: markdown
     attributes:
       value: |
-        Thank you for your question! For general discussions or open-ended questions, consider using [GitHub Discussions](https://github.com/vitali87/code-graph-rag/discussions).
+        Thank you for your question! Please keep questions concrete; for broader topics, prefer opening an [issue](https://github.com/vitali87/code-graph-rag/issues) with the `question` label.
 
   - type: textarea
     id: question

.github/SECURITY.md

@@ -0,0 +1,46 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 0.0.x   | :white_check_mark: |
+
+As the project is in early development (pre 1.0), only the latest release receives security updates. Please ensure you are running the most recent version before reporting a vulnerability.
+
+## Reporting a Vulnerability
+
+**Please do not report security vulnerabilities through public issues, pull requests, or any other public channels.**
+
+Instead, please use GitHub's private vulnerability reporting: go to the [Security tab](https://github.com/vitali87/code-graph-rag/security/advisories/new) and click **Report a vulnerability**. This keeps the details confidential between you and the maintainers until a fix is available.
+
+When reporting, please include:
+
+- A description of the vulnerability and its potential impact
+- Steps to reproduce or a proof of concept
+- The version(s) affected
+- Any suggested fix, if available
+
+## What to Expect
+
+- **Acknowledgement** within 72 hours of your report
+- **Status update** within 7 days with an initial assessment
+- **Resolution target** of 30 days for confirmed vulnerabilities, though critical issues will be prioritized for faster turnaround
+
+If the vulnerability is accepted, we will work on a fix, coordinate disclosure with you, and credit you in the release notes (unless you prefer to remain anonymous).
+
+If the vulnerability is declined, we will provide a clear explanation of why.
+
+## Scope
+
+This policy applies to the `code-graph-rag` Python package and its official repository. Third party dependencies are outside the direct scope of this policy, though we use Dependabot to monitor and update them.
+
+## Security Measures in This Project
+
+- **Dependency scanning**: Dependabot is enabled for automated dependency updates
+- **Secret scanning**: GitHub secret scanning is active on this repository
+- **Branch protection**: The `main` branch requires pull request reviews before merging
+
+## Preferred Languages
+
+We accept security reports in English.

.github/dependabot.yml

@@ -0,0 +1,16 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/pull_request_template.md

@@ -0,0 +1,38 @@
+## Summary
+
+<!-- What does this PR do? Keep it brief: 1-3 bullet points. -->
+
+-
+
+## Type of Change
+
+<!-- Check all that apply. -->
+
+- [ ] Bug fix
+- [ ] New feature
+- [ ] Performance improvement
+- [ ] Refactoring (no functional changes)
+- [ ] Documentation
+- [ ] CI/CD or tooling
+- [ ] Dependencies
+
+## Related Issues
+
+<!-- Link related issues: "Fixes #123", "Closes #456", or "Related to #789" -->
+
+## Test Plan
+
+<!-- How was this tested? Check all that apply. -->
+
+- [ ] Unit tests pass (`make test-parallel` or `uv run pytest -n auto -m "not integration"`)
+- [ ] New tests added
+- [ ] Integration tests pass (`make test-integration`, requires Docker)
+- [ ] Manual testing (describe below)
+
+## Checklist
+
+- [ ] PR title follows [Conventional Commits](https://www.conventionalcommits.org/) format
+- [ ] All pre-commit checks pass (`make pre-commit`)
+- [ ] No hardcoded strings in non-config/non-constants files
+- [ ] No `# type: ignore`, `cast()`, `Any`, or `object` type hints
+- [ ] No new comments or docstrings (code should be self-documenting)