docs: add uvx / oci:// attach paths and project logos #3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Copyright 2026 Query Farm LLC - https://query.farm | |
| # | |
| # Build and publish the multi-arch vgi-scikit-bio image to ghcr.io. The heavy | |
| # lifting (multi-arch build → smoke → image SQL suite → push → manifest → | |
| # cosign-sign) lives in the shared reusable workflow Query-farm/vgi-actions; | |
| # this file gates on the repo's own test suite and supplies the worker-specific | |
| # inputs. | |
| # | |
| # Tag-driven: vX.Y.Z -> :X.Y.Z/:X.Y/:latest, push to main -> :edge. Decoupled | |
| # from the PyPI publish (publish.yml, release-driven). Publishing a GitHub | |
| # Release creates the tag, which fires this too. | |
| name: Publish image to ghcr.io | |
| on: | |
| push: | |
| branches: [main] | |
| tags: ['v*.*.*'] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: docker-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| # Gate every image on the full unit + vgi-extension integration suite, so a | |
| # broken worker is never imaged. | |
| ci: | |
| uses: ./.github/workflows/ci.yml | |
| publish: | |
| needs: [ci] | |
| permissions: | |
| contents: read | |
| packages: write | |
| id-token: write | |
| attestations: write | |
| uses: Query-farm/vgi-actions/.github/workflows/docker-publish.yml@v1 | |
| secrets: inherit | |
| with: | |
| image_name: vgi-scikit-bio | |
| smoke_import: "vgi_scikit_bio, skbio, numpy, scipy, pandas" | |
| http_run_args: "-e VGI_SIGNING_KEY=dev" | |
| version_check_cmd: "ci/check-version.sh" | |
| # Validate the built image's two transports against the signed vgi | |
| # extension. The worker logic over the stdio/AF_UNIX transport is already | |
| # exercised every run by the gating `ci` job (all test/sql/*, real `launch:` | |
| # transport, three OSes), so here we only prove the image's entrypoints: | |
| # - stdio: smoke ONE file (one cold container) to prove the stdio | |
| # entrypoint speaks the protocol in-image; | |
| # - HTTP: run the FULL suite against a SINGLE warm container. | |
| image_test: | | |
| echo "::group::download haybarn-unittest" | |
| REL=$(gh release view --repo Query-farm-haybarn/haybarn --json tagName --jq .tagName) | |
| gh release download "$REL" --repo Query-farm-haybarn/haybarn \ | |
| --pattern 'haybarn_unittest-linux-amd64.zip' --output hb.zip --clobber | |
| mkdir -p hb && unzip -o -q hb.zip -d hb | |
| export HAYBARN_UNITTEST="$PWD/$(find hb -name 'haybarn-unittest' -type f | head -1)" | |
| chmod +x "$HAYBARN_UNITTEST" | |
| echo "::endgroup::" | |
| echo "::group::stdio entrypoint smoke (one cold container, sequence only)" | |
| docker volume rm vgi_scikit_bio_state_ci >/dev/null 2>&1 || true | |
| TEST_PATTERN="test/sql/skbio_sequence.test" \ | |
| VGI_SCIKIT_BIO_WORKER="docker run -i --rm -v vgi_scikit_bio_state_ci:/data $CITEST_IMAGE stdio" \ | |
| ci/run-integration.sh | |
| docker volume rm vgi_scikit_bio_state_ci >/dev/null 2>&1 || true | |
| echo "::endgroup::" | |
| echo "::group::full SQL suite — HTTP transport (one warm container)" | |
| CID=$(docker run -d -p 8000:8000 -v vgi_scikit_bio_state_ci:/data -e VGI_SIGNING_KEY=dev "$CITEST_IMAGE") | |
| trap 'docker rm -f "$CID" >/dev/null 2>&1; docker volume rm vgi_scikit_bio_state_ci >/dev/null 2>&1' EXIT | |
| for _ in $(seq 1 30); do curl -fsS -o /dev/null http://localhost:8000/health && break; sleep 1; done | |
| VGI_SCIKIT_BIO_WORKER="http://localhost:8000" ci/run-integration.sh | |
| echo "::endgroup::" |