Skip to content

installation.md

Latest commit

 

History

History
166 lines (119 loc) · 5.49 KB

installation.md

File metadata and controls

166 lines (119 loc) · 5.49 KB
Raw
description Install Code-Graph-RAG and set up Memgraph for multi-language codebase analysis.

Installation

Prerequisites

  • Python 3.12+
  • Docker & Docker Compose (for Memgraph)
  • cmake (required for building pymgclient dependency)
  • ripgrep (rg) (required for shell command text searching)
  • For cloud models: Google Gemini API key, OpenAI API key, or both
  • For local models: Ollama installed and running
  • uv package manager (recommended) or pip

Installing cmake and ripgrep

=== "macOS"

```bash
brew install cmake ripgrep
```

=== "Ubuntu/Debian"

```bash
sudo apt-get update
sudo apt-get install cmake ripgrep
```

=== "CentOS/RHEL"

```bash
sudo yum install cmake
sudo dnf install ripgrep
```

ripgrep may need to be installed from EPEL or via `cargo install ripgrep`.

Install from PyPI

pip install code-graph-rag

With all Tree-sitter grammars (Python, JS, TS, Rust, Go, Java, Scala, C, C++, Lua, PHP, C#, Dart):

pip install 'code-graph-rag[treesitter-full]'

With semantic code search (UniXcoder embeddings):

pip install 'code-graph-rag[semantic]'

With both full language support and semantic search:

pip install 'code-graph-rag[treesitter-full,semantic]'

Install from Source

git clone https://github.com/vitali87/code-graph-rag.git
cd code-graph-rag

For basic Python support:

uv sync

For full multi-language support:

uv sync --extra treesitter-full

For development (including tests and pre-commit hooks):

make dev

This installs all dependencies and sets up pre-commit hooks automatically.

Verify Release Artifacts

Each GitHub release ships prebuilt binaries together with Sigstore signatures (*.sigstore.json); releases from v0.0.484 onwards also carry a SLSA build provenance attestation (multiple.intoto.jsonl). Both are produced by the build-binaries.yml GitHub Actions workflow using keyless signing, so there is no maintainer-held key to obtain: verification checks that the artifact was built by this repository's release workflow.

To verify provenance with the GitHub CLI:

gh attestation verify code-graph-rag-linux-amd64 \
  --repo vitali87/code-graph-rag \
  --signer-workflow vitali87/code-graph-rag/.github/workflows/build-binaries.yml

The --signer-workflow flag pins the attestation to the release workflow itself; --repo alone accepts an attestation signed by any workflow in the repository.

To verify a signature with cosign:

cosign verify-blob \
  --bundle code-graph-rag-linux-amd64.sigstore.json \
  --certificate-identity-regexp 'https://github\.com/vitali87/code-graph-rag/\.github/workflows/build-binaries\.yml@.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  code-graph-rag-linux-amd64

Substitute the binary name for your platform. Packages installed from PyPI are protected differently: pip and uv verify package hashes, which proves integrity in transit, and releases after v0.0.187 additionally carry a PEP 740 attestation. That is a publish attestation — proof that the file was uploaded by this project's trusted publisher — rather than build provenance, and it can be queried through PyPI's Integrity API.

Start Memgraph

cgr daemon up

This starts the packaged Memgraph + Qdrant stack and waits until it is healthy. It works the same whether you installed from PyPI or from source, since the compose file ships inside the package. Memgraph listens on port 7687 and Memgraph Lab on port 3000.

Set Up Environment Variables

cp .env.example .env
# Edit .env with your configuration

See the Configuration guide for all available options.

Verify Your Setup

cgr doctor

This checks that all required dependencies and services are available.

Key Dependencies

  • loguru: Python logging made (stupidly) simple
  • mcp: Model Context Protocol SDK
  • pydantic-ai: AI Agent Framework, the Pydantic way
  • pydantic-settings: Settings management using Pydantic
  • pymgclient: Memgraph database adapter for Python language
  • python-dotenv: Read key-value pairs from a .env file and set them as environment variables
  • tiktoken: tiktoken is a fast BPE tokeniser for use with OpenAI's models
  • toml: Python Library for Tom's Obvious, Minimal Language
  • tree-sitter-python: Python grammar for tree-sitter
  • tree-sitter: Python bindings to the Tree-sitter parsing library
  • watchdog: Filesystem events monitoring
  • typer: Typer, build great CLIs. Easy to code. Based on Python type hints.
  • rich: Render rich text, tables, progress bars, syntax highlighting, markdown and more to the terminal
  • prompt-toolkit: Library for building powerful interactive command lines in Python
  • diff-match-patch: Repackaging of Google's Diff Match and Patch libraries.
  • click: Composable command line interface toolkit
  • protobuf
  • defusedxml: XML bomb protection for Python stdlib modules
  • huggingface-hub: Client library to download and publish models, datasets and other repos on the huggingface.co hub
  • pathspec: Utility library for gitignore style pattern matching of file paths.