ci: vendor validation scripts and remove remote action pins

[hyperpolymath]

Automated PR to fix CI after deleted actions.

---

Summary by Gitar

• Server features:
  • Added /api/explain endpoint for analyzing query plans on semantic and raw SQL queries
  • Integrated index creation via Skein.create_index! for semantic index columns
• Beam updates:
  • Added test coverage threshold and test/dev dependencies in mix.exs

_{This will update automatically on new commits.}

[gitar-bot]

Gitar has auto-approved this PR (configure)

[gitar-bot]

Code Review ✅ Approved 3 resolved / 3 findings

Integrates explain capabilities for main and semantic index alongside CI workflow hardening. No issues found.

Auto-approved: No blocking issues found.
Please see Auto-approve Docs for details on setting custom approval criteria.

✅ 3 resolved

✅ Security: New /api/explain?sql= runs arbitrary user SQL plans

📄 server/serve.jl:810-824 📄 server/serve.jl:1017
The new unauthenticated GET /api/explain endpoint feeds arbitrary user-supplied SQL into explain_query_plan(db.conn, ...). EXPLAIN QUERY PLAN is read-only (mutations don't execute) and is_select_only guards obvious DML prefixes, but WITH-prefixed statements pass the filter and the endpoint still discloses main-DB schema/index details (table names, index usage) to any caller. If the server has no auth layer, confirm this information disclosure is acceptable, or gate the raw-sql branch behind the same trust boundary as other admin/debug endpoints.

✅ Bug: count_knots qualified at 1050 but left unqualified at 994

📄 server/serve.jl:1050 📄 server/serve.jl:994
The diff changes count_knots(db) to Skein.count_knots(db) at line 1050 but the /health handler at line 994 still calls count_knots(db) unqualified. If the qualification was required because count_knots is no longer brought into scope by using Skein, the health check will throw a UndefVarError at runtime. Qualify line 994 as Skein.count_knots too (or leave both unqualified) so the calls are consistent.

✅ Bug: Index creation now relies on Skein.create_index! idempotency

📄 server/serve.jl:104-110
The removed code used CREATE INDEX IF NOT EXISTS, which is safe to re-run on every startup. The replacement Skein.create_index!(conn, table, col) will run on each SemanticIndexDB construction; if that helper does not emit IF NOT EXISTS, the second server start (or any pre-existing index) will raise a duplicate-index error and abort startup. Verify Skein.create_index! is idempotent, or wrap it defensively.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}