feat(redis): implement redis keys reset

.env.example

@@ -16,3 +16,4 @@ RABBITMQ_HOST=rabbitmq
 REDIS_PORT=6379
 REDIS_USER=redis
 REDIS_PASSWORD=changeme
+

.github/.env.ci.example

@@ -1,12 +1,5 @@
-# Application configuration
+COMPOSE_NAME=opengatellm-ci
 CONFIG_FILE=api/tests/integ/config.test.yml
-COMPOSE_FILE=.github/compose.ci.yml
-
-# Dependencies
 POSTGRES_PORT=15432
 REDIS_PORT=16379
-RABBITMQ_PORT=25672
-RABBITMQ_UI_PORT=15672
-
-# Secrets (to complete)
-# ALBERT_API_KEY=
+ALBERT_API_KEY=

.github/.trivyignore

@@ -22,6 +22,14 @@ CVE-2026-42496 exp:2026-09-01
 # Reported in perl-base from base image. Re-evaluate after 2026-09-01.
 CVE-2026-8376 exp:2026-09-01
 
+# Perl regex trie overflow (incorrect matches with >65535 alternation branches) — no upstream Debian fix yet
+# Reported in perl-base from base image. Upstream fix is in Perl 5.43.10 only. Re-evaluate after 2026-09-01.
+CVE-2026-13221 exp:2026-09-01
+
+# Perl Storable signed integer overflow on crafted SX_HOOK — no upstream Debian fix yet
+# Reported in perl-base from base image. Fixed upstream in Storable 3.41. Re-evaluate after 2026-09-01.
+CVE-2026-57433 exp:2026-09-01
+
 # libssh2 Out-of-Bounds Write via Unchecked — no upstream Debian fix yet
 # Reported in libssh2-1t64 from base image. Re-evaluate after 2026-09-01.
 CVE-2026-55200 exp:2026-09-01

.github/badges/coverage.json

@@ -1 +1 @@
-{"schemaVersion":1,"label":"coverage","message":"55.48%","color":"red"}
+{"schemaVersion": 1, "label": "coverage", "message": "59.81%", "color": "red"}

.github/workflows/build.yml

@@ -15,11 +15,11 @@ on:
 jobs:
   prepare:
     name: Prepare build
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      github.event_name == 'release' ||
+      github.actor != 'github-actions[bot]'
     runs-on: ubuntu-latest
-    # Builds triggered by a PR commit wait here for a manual approval from the GitHub Actions UI
-    # (configure required reviewers on the "build-approval" environment in repo settings).
-    # Builds triggered by push/release/workflow_dispatch use the unprotected "build-auto" environment
-    # and therefore run immediately, exactly like before.
     environment: ${{ github.event_name == 'pull_request' && 'build-approval' || 'build-auto' }}
     outputs:
       image_tag: ${{ steps.set_tag.outputs.tag }}
@@ -49,17 +49,12 @@ jobs:
     env:
       API_IMAGE_NAME: ghcr.io/etalab-ia/opengatellm/api
       IMAGE_TAG: ${{ needs.prepare.outputs.image_tag }}
-    outputs:
-      commit_title: ${{ steps.get_head_commit_title.outputs.title }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
           ref: ${{ github.head_ref || github.ref_name }}
 
-      - id: get_head_commit_title
-        run: echo "title=$(git log --format=%B -n 1 HEAD | head -n 1)" >> $GITHUB_OUTPUT
-
       - name: Log in to GitHub Container Registry
         uses: docker/login-action@v3
         with:
@@ -206,20 +201,3 @@ jobs:
     with:
       image-name: ghcr.io/etalab-ia/opengatellm/playground
       image-tag: ${{ needs.prepare.outputs.image_tag }}
-
-  deploy-dev:
-    # Only chain automatically into the deploy workflow for the pre-existing, auto-triggered flow
-    # (push to main). Builds approved manually from a PR are not deployed automatically.
-    if: github.event_name == 'push'
-    name: Deploy to dev
-    needs:
-      - build-opengatellm-api
-      - trivy-scan-api
-      - build-opengatellm-playground
-      - trivy-scan-playground
-      - build-albert-playground
-    uses: ./.github/workflows/deploy.yml
-    with:
-      commit_title: ${{ needs.build-opengatellm-api.outputs.commit_title }}
-    secrets:
-      GITLAB_CI_TOKEN: ${{ secrets.GITLAB_CI_TOKEN }}

.github/workflows/deploy.yml

@@ -1,20 +1,10 @@
 name: Deploy
 
 on:
-  workflow_call:
-    inputs:
-      commit_title:
-        description: "Title of the commit that triggered the build, used for the GitLab pipeline name"
-        required: true
-        type: string
-      environment:
-        description: "Deployment environment"
-        required: false
-        type: string
-        default: dev
-    secrets:
-      GITLAB_CI_TOKEN:
-        required: true
+  workflow_run:
+    workflows: ["Build and scan images"]
+    types:
+      - completed
   workflow_dispatch:
     inputs:
       commit_title:
@@ -30,14 +20,35 @@ on:
 
 jobs:
   deploy-dev:
-    name: Deploy from ${{ github.ref_name }}/${{ github.sha }}
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      (
+        github.event.workflow_run.conclusion == 'success' &&
+        github.event.workflow_run.event == 'push' &&
+        github.event.workflow_run.actor.login != 'github-actions[bot]'
+      )
+    name: Deploy from ${{ github.event.workflow_run.head_branch || github.ref_name }}/${{ github.event.workflow_run.head_sha || github.sha }}
     runs-on: ubuntu-latest
     steps:
+      - name: Get commit title
+        id: commit_title
+        env:
+          HEAD_COMMIT_MESSAGE: ${{ github.event.workflow_run.head_commit.message }}
+          EVENT_NAME: ${{ github.event_name }}
+          COMMIT_TITLE_INPUT: ${{ inputs.commit_title }}
+        run: |
+          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
+            TITLE="$COMMIT_TITLE_INPUT"
+          else
+            TITLE="$(echo "$HEAD_COMMIT_MESSAGE" | head -n 1)"
+          fi
+          echo "title=$TITLE" >> "$GITHUB_OUTPUT"
+
       - name: Trigger dev deployment
         env:
           GITLAB_CI_TOKEN: ${{ secrets.GITLAB_CI_TOKEN }}
-          PIPELINE_NAME: ${{ github.event.repository.name }} - ${{ inputs.commit_title }}
-          DEPLOYMENT_ENVIRONMENT: ${{ inputs.environment }}
+          PIPELINE_NAME: ${{ github.event.repository.name }} - ${{ steps.commit_title.outputs.title }}
+          DEPLOYMENT_ENVIRONMENT: ${{ inputs.environment || 'dev' }}
         run: |
           RESPONSE="$(curl --request POST \
             --form token="$GITLAB_CI_TOKEN" \

.github/workflows/release_updates.yml

@@ -18,22 +18,14 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
+      - uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
+
       - name: Checkout du code
         uses: actions/checkout@v4
         with:
-          ref: main
+          ref: ${{ github.event_name == 'pull_request' && github.sha || 'main' }}
           fetch-depth: 0
 
-      - name: Configure Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: '3.12'
-
-      - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          pip install ".[api,playground,dev]"
-
       - name: Update project version
         run: |
           git fetch --tags --force
@@ -43,34 +35,36 @@ jobs:
             exit 0
           fi
           sed -i -E "s/^[[:space:]]*version[[:space:]]*=.*/version = \"${latest_version}\"/" pyproject.toml
-          sed -i -E "s|(image:[[:space:]]*ghcr.io/etalab-ia/opengatellm/api:).*|\\1${latest_version}|" compose.example.yml
-          sed -i -E "s|(image:[[:space:]]*ghcr.io/etalab-ia/opengatellm/playground:).*|\\1${latest_version}|" compose.example.yml
           sed -i -E "s/^[[:space:]]*swagger_version:[[:space:]]*.*/  swagger_version: ${latest_version}/" config.example.yml
           sed -i -E "s/(badge:[[:space:]]*)'[^']*'/\1'v${latest_version}'/" docs/astro.config.mjs
-
+      
       - name: Generate documentation
+        env:
+          DOCS_DIR: ${{ github.workspace }}/docs
+          CONFIG_FILE: ${{ github.workspace }}/config.example.yml
         run: |
+          uv venv
+          uv pip install -p .venv/bin/python ".[api,playground,dev]"
+          . .venv/bin/activate
           PYTHONPATH=. python ./scripts/docs/generate_configuration_documentation.py --output ./docs/src/content/docs/configuration/configuration_file.mdx
-          make quickstart
-          api_health=unknown
-          for _ in $(seq 1 30); do
-            api_container_id="$(docker compose --env-file .env --file compose.example.yml ps -q api)"
-            if [ -n "$api_container_id" ]; then
-              api_health="$(docker inspect --format='{{if .State.Health}}{{.State.Health.Status}}{{else}}none{{end}}' "$api_container_id")"
-              if [ "$api_health" = "healthy" ]; then
-                break
-              fi
-            fi
-            sleep 2
-          done
-          if [ "$api_health" != "healthy" ]; then
-            echo "API container is not healthy (status: $api_health)"
-            docker compose --env-file .env --file compose.yml logs --no-color api
+          if ! docker compose --file ./compose.example.yml up --detach --wait; then
+            echo "Services did not become healthy." >&2
+            echo "::group::Docker Compose status"
+            docker compose --file ./compose.example.yml ps || true
+            echo "::endgroup::"
+
+            echo "::group::Docker Compose logs (all services)"
+            docker compose --file ./compose.example.yml logs --no-color || true
+            echo "::endgroup::"
+
+            echo "::group::API health probe"
+            curl -sv "http://localhost:8000/health" || true
+            echo "::endgroup::"
             exit 1
           fi
           curl -fSL --retry 8 --retry-all-errors --retry-delay 2 http://localhost:8000/openapi.json -o ./docs/openapi.json
           docker pull redocly/cli
-          docker run --rm -v ${{ github.workspace }}/docs:/spec redocly/cli build-docs /spec/openapi.json --output /spec/redoc-static.html
+          docker run --rm -v "$DOCS_DIR:/spec" redocly/cli build-docs /spec/openapi.json --output /spec/redoc-static.html
 
       - name: Create pull request for release updates
         uses: peter-evans/create-pull-request@v6