From ca3e0b223d52041ded93917cd696030f35613feb Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 27 Jul 2026 16:05:55 +0000 Subject: [PATCH 1/2] chore(ci): bump docker/metadata-action from 5.5.1 to 6.2.0 Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 5.5.1 to 6.2.0. - [Release notes](https://github.com/docker/metadata-action/releases) - [Commits](https://github.com/docker/metadata-action/compare/8e5442c4ef9f78752691e2d8f8d19755c6f78e81...dc802804100637a589fabce1cb79ff13a1411302) --- updated-dependencies: - dependency-name: docker/metadata-action dependency-version: 6.2.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/docker-build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml index 77c17ad7..2ee8976c 100644 --- a/.github/workflows/docker-build.yml +++ b/.github/workflows/docker-build.yml @@ -71,7 +71,7 @@ jobs: - name: Extract Container Metadata id: meta - uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1 + uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} tags: | From 520071d430f5d42cdc8cad0bba06a9b111e61967 Mon Sep 17 00:00:00 2001 From: Igor Beylin Date: Sat, 1 Aug 2026 17:29:36 -0400 Subject: [PATCH 2/2] fix: LLM key-before-import; EOF artifacts (pre-existing CI blockers) Remediation-Cycle: Quantum-L9/Cognitive.Engine.Graphs#149/cycle-1 Co-authored-by: Cursor --- artifacts/coverage_matrix.json | 2 +- artifacts/spec_checklist.json | 2 +- engine/security/P2_9_llm_schemas.py | 12 +++++++----- 3 files changed, 9 insertions(+), 7 deletions(-) diff --git a/artifacts/coverage_matrix.json b/artifacts/coverage_matrix.json index badcc07c..22f3b008 100644 --- a/artifacts/coverage_matrix.json +++ b/artifacts/coverage_matrix.json @@ -62,4 +62,4 @@ "total": 41 }, "generated_at": "2026-07-24T21:09:12.515556+00:00" -} \ No newline at end of file +} diff --git a/artifacts/spec_checklist.json b/artifacts/spec_checklist.json index ac75f641..21972630 100644 --- a/artifacts/spec_checklist.json +++ b/artifacts/spec_checklist.json @@ -1830,4 +1830,4 @@ "engine/hoprag/__init__.py:30" ] } -] \ No newline at end of file +] diff --git a/engine/security/P2_9_llm_schemas.py b/engine/security/P2_9_llm_schemas.py index b0ab9792..e8e49b17 100644 --- a/engine/security/P2_9_llm_schemas.py +++ b/engine/security/P2_9_llm_schemas.py @@ -132,11 +132,8 @@ def _ensure_client(self, model: str) -> Any: if self._client is not None: return self._client - try: - from openai import OpenAI - except ImportError as exc: - raise RuntimeError("openai package is required for LLM features. Install with: pip install openai") from exc - + # Prefer a clear missing-key error over a missing-package error when + # both are absent (CI installs requirements-ci.txt without openai). api_key = os.environ.get("OPENAI_API_KEY") if not api_key: raise RuntimeError( @@ -144,6 +141,11 @@ def _ensure_client(self, model: str) -> Any: "Set it to your OpenAI (or compatible provider) API key." ) + try: + from openai import OpenAI + except ImportError as exc: + raise RuntimeError("openai package is required for LLM features. Install with: pip install openai") from exc + kwargs: dict[str, Any] = {"api_key": api_key} base_url = os.environ.get("OPENAI_BASE_URL") if base_url: