From 20dc65cb12b90fd3b04c5a457fe3e091d8e85d8e Mon Sep 17 00:00:00 2001
From: Brian Shirai <brixen@gmail.com>
Date: Thu, 22 Jan 2026 14:05:05 -0800
Subject: [PATCH 1/3] Use shared org CI workflow.

---
 .github/workflows/ci.yml | 50 +++++-----------------------------------
 1 file changed, 6 insertions(+), 44 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0aeae4d..830e45a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,12 +1,10 @@
 name: CI
 
 on:
-  push:
-    branches:
-      - "**"
   pull_request:
+  push:
     branches:
-      - "**"
+      - master
 
 permissions:
   contents: read
@@ -16,43 +14,7 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  test:
-    name: Test (${{ matrix.os }})
-    runs-on: ${{ matrix.os }}
-
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, macos-latest]
-
-    env:
-      BUILD_TYPE: Release
-      BUILD_DIR: build
-      GENERATOR: Ninja
-      CCACHE_DIR: ~/.ccache
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Install dependencies
-        run: |
-          ./scripts/deps.sh
-
-      - name: Restore ccache
-        uses: actions/cache@v4
-        with:
-          path: ~/.ccache
-          key: ccache-${{ runner.os }}-${{ github.ref_name }}-${{ github.sha }}
-          restore-keys: |
-            ccache-${{ runner.os }}-${{ github.ref_name }}-
-            ccache-${{ runner.os }}-
-
-      - name: Show ccache stats (before)
-        run: ccache -s || true
-
-      - name: Build + Test
-        run: make test
-
-      - name: Show ccache stats (after)
-        run: ccache -s || true
+  build:
+    uses: vivarium-ai/certifiable-github/.github/workflows/ci.yml@master
+    with:
+      build-target: certifiable-inference

From 081bb6172d69f6628fd6ec6b2a34bfdd9660820a Mon Sep 17 00:00:00 2001
From: Brian Shirai <brixen@gmail.com>
Date: Thu, 22 Jan 2026 14:05:17 -0800
Subject: [PATCH 2/3] Rework Makefile and scripts.

---
 Makefile                                      | 33 +++++++++-----
 certifiable-build/scripts/build.sh            | 18 ++++++++
 certifiable-build/scripts/clean.sh            | 22 ++++++++++
 certifiable-build/scripts/config.sh           | 44 +++++++++++++++++++
 certifiable-build/scripts/install.sh          | 20 +++++++++
 certifiable-build/scripts/package.sh          | 24 ++++++++++
 certifiable-build/scripts/release.sh          | 18 ++++++++
 .../scripts/setup.sh                          |  4 +-
 certifiable-build/scripts/test.sh             | 18 ++++++++
 9 files changed, 189 insertions(+), 12 deletions(-)
 create mode 100755 certifiable-build/scripts/build.sh
 create mode 100755 certifiable-build/scripts/clean.sh
 create mode 100755 certifiable-build/scripts/config.sh
 create mode 100755 certifiable-build/scripts/install.sh
 create mode 100755 certifiable-build/scripts/package.sh
 create mode 100755 certifiable-build/scripts/release.sh
 rename scripts/deps.sh => certifiable-build/scripts/setup.sh (94%)
 create mode 100755 certifiable-build/scripts/test.sh

diff --git a/Makefile b/Makefile
index c3508ff..e91cbeb 100644
--- a/Makefile
+++ b/Makefile
@@ -12,6 +12,7 @@ export REVISION
 BUILD_DIR ?= build
 BUILD_TYPE ?= Release
 GENERATOR ?= Ninja
+PREFIX ?= /usr/local
 
 CMAKE ?= cmake
 CTEST ?= ctest
@@ -19,6 +20,15 @@ CTEST ?= ctest
 # ccache (enabled by default if available)
 CCACHE ?= ccache
 CCACHE_DIR ?= $(HOME)/.ccache
+
+# Export for scripts
+export BUILD_DIR
+export BUILD_TYPE
+export GENERATOR
+export PREFIX
+export CMAKE
+export CTEST
+export CCACHE
 export CCACHE_DIR
 
 CMAKE_CACHE_ARGS := \
@@ -26,35 +36,38 @@ CMAKE_CACHE_ARGS := \
 	-DCMAKE_C_COMPILER_LAUNCHER=$(CCACHE) \
 	-DCMAKE_CXX_COMPILER_LAUNCHER=$(CCACHE)
 
-.PHONY: all help deps config build test install release clean
+.PHONY: all help setup config build test install package release clean
 
 all: test
 
 ##@ Dependencies
-deps: ## Install project dependencies
-	./scripts/deps.sh
+setup: ## Setup project
+	./certifiable-build/scripts/setup.sh
 
 ##@ Development
 config: ## Configure the build
-	$(CMAKE) -S . -B $(BUILD_DIR) -G "$(GENERATOR)" $(CMAKE_CACHE_ARGS)
+	./certifiable-build/scripts/config.sh
 
 build: config ## Build the project
-	$(CMAKE) --build $(BUILD_DIR) --parallel
+	./certifiable-build/scripts/build.sh
 
 ##@ Testing
 test: build ## Run tests
-	$(CTEST) --test-dir $(BUILD_DIR) --output-on-failure
+	./certifiable-build/scripts/test.sh
 
 ##@ Project Management
 install: build ## Install the project
-	$(CMAKE) --install $(BUILD_DIR)
+	./certifiable-build/scripts/install.sh
+
+package: ## Build release artifacts
+	./certifiable-build/scripts/package.sh
 
-release: ## Build release artifacts
-	@echo "Building release..."
+release: ## Publish release artifacts
+	./certifiable-build/scripts/release.sh
 
 ##@ Maintenance
 clean: ## Remove all build artifacts
-	rm -rf $(EXES) $(DIST) $(BUILD_DIR)
+	./certifiable-build/scripts/clean.sh
 
 ##@ Documentation
 help: ## Display this help
diff --git a/certifiable-build/scripts/build.sh b/certifiable-build/scripts/build.sh
new file mode 100755
index 0000000..c3e9e6f
--- /dev/null
+++ b/certifiable-build/scripts/build.sh
@@ -0,0 +1,18 @@
+#!/bin/sh
+set -eu
+
+usage() {
+  cat <<EOF
+Usage: $(basename "$0") [BUILD_DIR]
+  BUILD_DIR: Build directory (env: BUILD_DIR, default: build)
+EOF
+  exit 1
+}
+
+BUILD_DIR="${1:-${BUILD_DIR:-build}}"
+CMAKE="${CMAKE:-cmake}"
+
+[ -d "$BUILD_DIR" ] || { echo "Build directory not found. Run config first."; exit 1; }
+
+echo "Building..."
+$CMAKE --build "$BUILD_DIR" --parallel
diff --git a/certifiable-build/scripts/clean.sh b/certifiable-build/scripts/clean.sh
new file mode 100755
index 0000000..79c8337
--- /dev/null
+++ b/certifiable-build/scripts/clean.sh
@@ -0,0 +1,22 @@
+#!/bin/sh
+set -eu
+
+usage() {
+  cat <<EOF
+Usage: $(basename "$0") [BUILD_DIR] [EXES] [DIST]
+  BUILD_DIR: Build directory (env: BUILD_DIR, default: build)
+  EXES:      Executables directory (env: EXES, optional)
+  DIST:      Distribution directory (env: DIST, optional)
+EOF
+  exit 1
+}
+
+BUILD_DIR="${1:-${BUILD_DIR:-build}}"
+EXES="${2:-${EXES:-}}"
+DIST="${3:-${DIST:-}}"
+
+echo "Cleaning build artifacts..."
+rm -rf "$BUILD_DIR"
+[ -n "$EXES" ] && rm -rf "$EXES"
+[ -n "$DIST" ] && rm -rf "$DIST"
+echo "Clean complete."
diff --git a/certifiable-build/scripts/config.sh b/certifiable-build/scripts/config.sh
new file mode 100755
index 0000000..f03efe0
--- /dev/null
+++ b/certifiable-build/scripts/config.sh
@@ -0,0 +1,44 @@
+#!/bin/sh
+set -eu
+
+usage() {
+  cat <<EOF
+Usage: $(basename "$0") [BUILD_DIR] [BUILD_TYPE] [GENERATOR] [CCACHE]
+
+Positional args override env vars.
+
+  BUILD_DIR:   Build directory (env: BUILD_DIR, default: build)
+  BUILD_TYPE:  Build type (env: BUILD_TYPE, default: Release)
+  GENERATOR:   CMake generator (env: GENERATOR, default: Ninja if available else Unix Makefiles)
+  CCACHE:      Compiler cache command (env: CCACHE, default: ccache; set to "" or "false" to disable)
+  PREFIX:      Install prefix (env: PREFIX, default: /usr/local)
+EOF
+}
+
+case "${1:-}" in
+  -h|--help)
+    usage
+    exit 0
+    ;;
+esac
+
+BUILD_DIR="${1:-${BUILD_DIR:-build}}"
+BUILD_TYPE="${2:-${BUILD_TYPE:-Release}}"
+GENERATOR="${3:-${GENERATOR:-Ninja}}"
+CCACHE="${4:-${CCACHE:-ccache}}"
+PREFIX="${PREFIX:-/usr/local}"
+CMAKE="${CMAKE:-cmake}"
+
+# Allow disabling ccache via CCACHE="" or CCACHE=false
+CCACHE_ARGS=""
+if [ -n "$CCACHE" ] && [ "$CCACHE" != "false" ] && command -v "$CCACHE" >/dev/null 2>&1; then
+  CCACHE_ARGS="-DCMAKE_C_COMPILER_LAUNCHER=$CCACHE -DCMAKE_CXX_COMPILER_LAUNCHER=$CCACHE"
+fi
+
+echo "Configuring: BUILD_DIR=$BUILD_DIR BUILD_TYPE=$BUILD_TYPE GENERATOR=$GENERATOR PREFIX=$PREFIX"
+
+# shellcheck disable=SC2086
+"$CMAKE" -S . -B "$BUILD_DIR" -G "$GENERATOR" \
+  -DCMAKE_BUILD_TYPE="$BUILD_TYPE" \
+  -DCMAKE_INSTALL_PREFIX="$PREFIX" \
+  $CCACHE_ARGS
diff --git a/certifiable-build/scripts/install.sh b/certifiable-build/scripts/install.sh
new file mode 100755
index 0000000..844e790
--- /dev/null
+++ b/certifiable-build/scripts/install.sh
@@ -0,0 +1,20 @@
+#!/bin/sh
+set -eu
+
+usage() {
+  cat <<EOF
+Usage: $(basename "$0") [BUILD_DIR] [PREFIX]
+  BUILD_DIR: Build directory (env: BUILD_DIR, default: build)
+  PREFIX:    Install prefix (env: PREFIX, default: /usr/local)
+EOF
+  exit 1
+}
+
+BUILD_DIR="${1:-${BUILD_DIR:-build}}"
+PREFIX="${2:-${PREFIX:-/usr/local}}"
+CMAKE="${CMAKE:-cmake}"
+
+[ -d "$BUILD_DIR" ] || { echo "Build directory not found. Run build first."; exit 1; }
+
+echo "Installing to $PREFIX..."
+$CMAKE --install "$BUILD_DIR" --prefix "$PREFIX"
diff --git a/certifiable-build/scripts/package.sh b/certifiable-build/scripts/package.sh
new file mode 100755
index 0000000..663df56
--- /dev/null
+++ b/certifiable-build/scripts/package.sh
@@ -0,0 +1,24 @@
+#!/bin/sh
+set -eu
+
+usage() {
+  cat <<EOF
+Usage: $(basename "$0") [BUILD_DIR] [VERSION] [REVISION]
+  BUILD_DIR: Build directory (env: BUILD_DIR, default: build)
+  VERSION:   Package version (env: VERSION, required)
+  REVISION:  Package revision (env: REVISION, required)
+EOF
+  exit 1
+}
+
+BUILD_DIR="${1:-${BUILD_DIR:-build}}"
+VERSION="${2:-${VERSION:-}}"
+REVISION="${3:-${REVISION:-}}"
+
+[ -z "$VERSION" ] && usage
+[ -z "$REVISION" ] && usage
+[ -d "$BUILD_DIR" ] || { echo "Build directory not found. Run build first."; exit 1; }
+
+echo "Creating package $VERSION-$REVISION..."
+# Add packaging logic here
+echo "Package created."
diff --git a/certifiable-build/scripts/release.sh b/certifiable-build/scripts/release.sh
new file mode 100755
index 0000000..7b8c8a0
--- /dev/null
+++ b/certifiable-build/scripts/release.sh
@@ -0,0 +1,18 @@
+#!/bin/sh
+set -eu
+
+usage() {
+  cat <<EOF
+Usage: $(basename "$0") [VERSION]
+  VERSION: Release version (env: VERSION, required)
+EOF
+  exit 1
+}
+
+VERSION="${1:-${VERSION:-}}"
+
+[ -z "$VERSION" ] && usage
+
+echo "Publishing release $VERSION..."
+# Add release logic here
+echo "Release published."
diff --git a/scripts/deps.sh b/certifiable-build/scripts/setup.sh
similarity index 94%
rename from scripts/deps.sh
rename to certifiable-build/scripts/setup.sh
index 46d8674..12fbe7b 100755
--- a/scripts/deps.sh
+++ b/certifiable-build/scripts/setup.sh
@@ -1,5 +1,5 @@
-#!/usr/bin/env bash
-set -euo pipefail
+#!/bin/sh
+set -eu
 
 echo "Resolving system dependencies…"
 
diff --git a/certifiable-build/scripts/test.sh b/certifiable-build/scripts/test.sh
new file mode 100755
index 0000000..7b590ee
--- /dev/null
+++ b/certifiable-build/scripts/test.sh
@@ -0,0 +1,18 @@
+#!/bin/sh
+set -eu
+
+usage() {
+  cat <<EOF
+Usage: $(basename "$0") [BUILD_DIR]
+  BUILD_DIR: Build directory (env: BUILD_DIR, default: build)
+EOF
+  exit 1
+}
+
+BUILD_DIR="${1:-${BUILD_DIR:-build}}"
+CTEST="${CTEST:-ctest}"
+
+[ -d "$BUILD_DIR" ] || { echo "Build directory not found. Run build first."; exit 1; }
+
+echo "Running tests..."
+$CTEST --test-dir "$BUILD_DIR" --output-on-failure

From 060852b507ae58df5dd8f99d0359f7dac2ce7436 Mon Sep 17 00:00:00 2001
From: Brian Shirai <brixen@gmail.com>
Date: Thu, 22 Jan 2026 18:52:56 -0800
Subject: [PATCH 3/3] Always run CI on branches.

---
 .github/workflows/ci.yml | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 830e45a..bf10d90 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,10 +1,8 @@
 name: CI
 
 on:
-  pull_request:
   push:
-    branches:
-      - master
+  pull_request:
 
 permissions:
   contents: read