Fix/pagi 125 release review findings

.github/workflows/ci.yaml

@@ -64,6 +64,7 @@ jobs:
           GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
         run: |
+          set -o pipefail
           go test -timeout=20m -race -v -json -coverprofile=coverage-${{ steps.go-version.outputs.version }}.out ./... | tee test-results-${{ steps.go-version.outputs.version }}.ndjson
       - name: Upload test results
         uses: actions/upload-artifact@v4
@@ -80,7 +81,6 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
-      pull-requests: write
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5

.github/workflows/examples.yaml

@@ -44,5 +44,4 @@ jobs:
         run: |
           cd examples/${{ matrix.example }}
           echo "Building ${{ matrix.example }}"
-          go mod tidy
-          go build -o /dev/null .
+          go build -mod=readonly -o /dev/null .

.github/workflows/publish-docs.yaml

@@ -13,7 +13,6 @@ permissions:
   contents: read
   pages: write
   id-token: write
-  pull-requests: write
 
 # Allow only one concurrent deployment
 concurrency:
@@ -74,19 +73,3 @@ jobs:
           artifact_name: github-pages
           preview: ${{ github.ref != 'refs/heads/main-vxcontrol' }}
 
-      - name: Comment PR
-        if: |
-          github.event_name == 'pull_request' &&
-          (github.ref == 'refs/heads/docs-test' ||
-           startsWith(github.ref, 'refs/heads/docs/'))
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const url = '${{ steps.deployment.outputs.page_url }}';
-            const message = `📚 Documentation preview available at: ${url}`;
-            github.rest.issues.createComment({
-              issue_number: context.issue.number,
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              body: message
-            });

.golangci.yaml

@@ -36,14 +36,6 @@ linters:
     gosec:
       excludes:
         - G115
-        # G703/G704: gosec's taint-analysis engine flags any function parameter
-        # of a matching type (e.g. a file path or URL string) as tainted based
-        # solely on its type, not on whether it actually originates from
-        # untrusted input. This produces widespread false positives in library
-        # code where callers pass in paths/URLs directly (see
-        # https://github.com/securego/gosec/issues/1500).
-        - G703
-        - G704
     exhaustive:
       default-signifies-exhaustive: true
   exclusions:
@@ -53,6 +45,24 @@ linters:
       - common-false-positives
       - legacy
       - std-error-handling
+    rules:
+      # The stub is a proxy: forwarding the request it received is its purpose.
+      - path: httputil/transport_test\.go
+        linters:
+          - gosec
+        text: G704
+      # url.Parse taints the helper, but what reaches os.Open is the name
+      # os.CreateTemp chose, which the URL cannot influence.
+      - path: documentloaders/whisper\.go
+        linters:
+          - gosec
+        text: G703
+      # Fetching the endpoint its caller configured is what this client does;
+      # a url.URL parameter is a taint source by declaration.
+      - path: vectorstores/qdrant/rest\.go
+        linters:
+          - gosec
+        text: G704
     paths:
       - internal
       - vectorstores/bedrockknowledgebases

Makefile

@@ -108,7 +108,7 @@ clean-lint-cache:
 .PHONY: build-examples
 build-examples:
 	for example in $(shell find ./examples -mindepth 1 -maxdepth 1 -type d); do \
-		(cd $$example; echo Build $$example; go mod tidy; go build -o /dev/null) || exit 1; done
+		(cd $$example; echo Build $$example; go build -mod=readonly -o /dev/null) || exit 1; done
 
 .PHONY: update-examples
 update-examples:

agents/conversational_test.go

@@ -2,10 +2,7 @@ package agents
 
 import (
 	"context"
-	"os"
-	"path/filepath"
 	"regexp"
-	"strings"
 	"testing"
 
 	"github.com/vxcontrol/langchaingo/chains"
@@ -18,24 +15,13 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-// hasExistingRecording checks if a httprr recording exists for this test
-func hasExistingRecording(t *testing.T) bool {
-	testName := strings.ReplaceAll(t.Name(), "/", "_")
-	testName = strings.ReplaceAll(testName, " ", "_")
-	recordingPath := filepath.Join("testdata", testName+".httprr")
-	_, err := os.Stat(recordingPath)
-	return err == nil
-}
-
 func TestConversationalWithMemory(t *testing.T) {
-	t.Parallel()
-
-	// Skip if no recording available and no credentials
-	if !hasExistingRecording(t) {
-		t.Skip("No httprr recording available. Hint: Re-run tests with -httprecord=. to record new HTTP interactions")
-	}
+	httprr.SkipIfNoCredentialsAndRecordingMissing(t, "OPENAI_API_KEY")
 
 	rr := httprr.OpenForTest(t, httputil.DefaultTransport)
+	if !rr.Recording() {
+		t.Parallel()
+	}
 	// Configure OpenAI client with httprr
 	opts := []openai.Option{
 		openai.WithModel("gpt-4o"),
@@ -58,22 +44,10 @@ func TestConversationalWithMemory(t *testing.T) {
 
 	ctx := context.Background()
 	_, err = chains.Run(ctx, executor, "Hi! my name is Bob and the year I was born is 1987")
-	if err != nil {
-		// Check if this is a recording mismatch error
-		if strings.Contains(err.Error(), "cached HTTP response not found") {
-			t.Skip("Recording format has changed or is incompatible. Hint: Re-run tests with -httprecord=. to record new HTTP interactions")
-		}
-		require.NoError(t, err)
-	}
+	require.NoError(t, err)
 
 	res, err := chains.Run(t.Context(), executor, "What is the year I was born times 34")
-	if err != nil {
-		// Check if this is a recording mismatch error
-		if strings.Contains(err.Error(), "cached HTTP response not found") {
-			t.Skip("Recording format has changed or is incompatible. Hint: Re-run tests with -httprecord=. to record new HTTP interactions")
-		}
-		require.NoError(t, err)
-	}
+	require.NoError(t, err)
 	expectedRe := "67,?558"
 	if !regexp.MustCompile(expectedRe).MatchString(res) {
 		t.Errorf("result does not contain the crrect answer '67558', got: %s", res)

agents/executor_test.go

@@ -79,15 +79,14 @@ func TestExecutorWithErrorHandler(t *testing.T) {
 }
 
 func TestExecutorWithMRKLAgent(t *testing.T) {
-	t.Parallel()
 	ctx := t.Context()
 
-	// Skip if no recording available and no credentials
-	if !hasExistingRecording(t) {
-		t.Skip("No httprr recording available. Hint: Re-run tests with -httprecord=. to record new HTTP interactions")
-	}
+	httprr.SkipIfNoCredentialsAndRecordingMissing(t, "OPENAI_API_KEY")
 
 	rr := httprr.OpenForTest(t, http.DefaultTransport)
+	if !rr.Recording() {
+		t.Parallel()
+	}
 
 	// Configure OpenAI client with httprr
 	opts := []openai.Option{
@@ -118,29 +117,22 @@ func TestExecutorWithMRKLAgent(t *testing.T) {
 	require.NoError(t, err)
 
 	result, err := chains.Run(ctx, a, "What is 5 plus 3? Please calculate this.") //nolint:lll
-	if err != nil {
-		// Check if this is a recording mismatch error
-		if strings.Contains(err.Error(), "cached HTTP response not found") {
-			t.Skip("Recording format has changed or is incompatible. Hint: Re-run tests with -httprecord=. to record new HTTP interactions")
-		}
-		require.NoError(t, err)
-	}
+	require.NoError(t, err)
 
 	t.Logf("MRKL Agent response: %s", result)
 	// Simple calculation: 5 + 3 = 8
 	require.True(t, strings.Contains(result, "8"), "expected calculation result 8 in response")
 }
 
 func TestExecutorWithOpenAIFunctionAgent(t *testing.T) {
-	t.Parallel()
 	ctx := t.Context()
 
-	// Skip if no recording available and no credentials
-	if !hasExistingRecording(t) {
-		t.Skip("No httprr recording available. Hint: Re-run tests with -httprecord=. to record new HTTP interactions")
-	}
+	httprr.SkipIfNoCredentialsAndRecordingMissing(t, "OPENAI_API_KEY")
 
 	rr := httprr.OpenForTest(t, http.DefaultTransport)
+	if !rr.Recording() {
+		t.Parallel()
+	}
 
 	// Configure OpenAI client with httprr
 	opts := []openai.Option{
@@ -178,13 +170,7 @@ func TestExecutorWithOpenAIFunctionAgent(t *testing.T) {
 	require.NoError(t, err)
 
 	result, err := chains.Run(ctx, e, "when was the Go programming language tagged version 1.0?") //nolint:lll
-	if err != nil {
-		// Check if this is a recording mismatch error
-		if strings.Contains(err.Error(), "cached HTTP response not found") {
-			t.Skip("Recording format has changed or is incompatible. Hint: Re-run tests with -httprecord=. to record new HTTP interactions")
-		}
-		require.NoError(t, err)
-	}
+	require.NoError(t, err)
 
 	t.Logf("Result: %s", result)
 

agents/openai_functions_agent_test.go

@@ -2,8 +2,6 @@ package agents_test
 
 import (
 	"net/http"
-	"os"
-	"path/filepath"
 	"strings"
 	"testing"
 
@@ -18,25 +16,15 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-// hasExistingRecording checks if a httprr recording exists for this test
-func hasExistingRecording(t *testing.T) bool {
-	testName := strings.ReplaceAll(t.Name(), "/", "_")
-	testName = strings.ReplaceAll(testName, " ", "_")
-	recordingPath := filepath.Join("testdata", testName+".httprr")
-	_, err := os.Stat(recordingPath)
-	return err == nil
-}
-
 func TestOpenAIFunctionsAgentWithHTTPRR(t *testing.T) {
-	t.Parallel()
 	ctx := t.Context()
 
-	// Skip if no recording available and no credentials
-	if !hasExistingRecording(t) {
-		t.Skip("No httprr recording available. Hint: Re-run tests with -httprecord=. to record new HTTP interactions")
-	}
+	httprr.SkipIfNoCredentialsAndRecordingMissing(t, "OPENAI_API_KEY")
 
 	rr := httprr.OpenForTest(t, http.DefaultTransport)
+	if !rr.Recording() {
+		t.Parallel()
+	}
 
 	// Configure OpenAI client with httprr
 	opts := []openai.Option{
@@ -68,10 +56,6 @@ func TestOpenAIFunctionsAgentWithHTTPRR(t *testing.T) {
 	// Run a simple calculation
 	result, err := chains.Run(ctx, executor, "What is 15 multiplied by 4?")
 	if err != nil {
-		// Check if this is a recording mismatch error
-		if strings.Contains(err.Error(), "cached HTTP response not found") {
-			t.Skip("Recording format has changed or is incompatible. Hint: Re-run tests with -httprecord=. to record new HTTP interactions")
-		}
 		t.Fatal(err)
 	}
 
@@ -84,15 +68,14 @@ func TestOpenAIFunctionsAgentWithHTTPRR(t *testing.T) {
 }
 
 func TestOpenAIFunctionsAgentComplexCalculation(t *testing.T) {
-	t.Parallel()
 	ctx := t.Context()
 
-	// Skip if no recording available and no credentials
-	if !hasExistingRecording(t) {
-		t.Skip("No httprr recording available. Hint: Re-run tests with -httprecord=. to record new HTTP interactions")
-	}
+	httprr.SkipIfNoCredentialsAndRecordingMissing(t, "OPENAI_API_KEY")
 
 	rr := httprr.OpenForTest(t, http.DefaultTransport)
+	if !rr.Recording() {
+		t.Parallel()
+	}
 
 	// Configure OpenAI client with httprr
 	opts := []openai.Option{
@@ -128,10 +111,6 @@ func TestOpenAIFunctionsAgentComplexCalculation(t *testing.T) {
 	// Run a more complex calculation
 	result, err := chains.Run(ctx, executor, "If I have 3 groups of 7 items, and I add 9 more items, how many items do I have in total?")
 	if err != nil {
-		// Check if this is a recording mismatch error
-		if strings.Contains(err.Error(), "cached HTTP response not found") {
-			t.Skip("Recording format has changed or is incompatible. Hint: Re-run tests with -httprecord=. to record new HTTP interactions")
-		}
 		t.Fatalf("failed to run agent: %v", err)
 	}
 	t.Logf("Agent response: %s", result)