cognitive-fabric 0.1.0__tar.gz

cognitive_fabric-0.1.0/.dockerignore

@@ -0,0 +1,69 @@
+# Docker matches these against the path relative to the context root, so a bare
+# name covers only the root -- `__pycache__` does not match `src/x/__pycache__`.
+# Depth-capable patterns therefore carry `**/`. Patterns that are meaningfully
+# root-only (.git, .venv, data) stay anchored.
+
+# Git
+.git
+.gitignore
+
+# Python
+**/__pycache__
+**/*.py[cod]
+**/*$py.class
+**/*.so
+.Python
+.venv
+venv
+ENV
+env
+
+# IDE
+**/.vscode
+**/.idea
+**/*.swp
+**/*.swo
+
+# Testing
+**/.pytest_cache
+**/.coverage
+**/htmlcov
+**/.tox
+**/.nox
+
+# Type-checker and linter caches (61 MB of .mypy_cache here)
+**/.mypy_cache
+**/.ruff_cache
+**/.cache
+
+# Build
+build
+dist
+**/*.egg-info
+**/*.egg
+
+# Documentation
+docs/_build
+
+# Local data
+data/
+**/*.db
+**/*.kuzu
+**/*.wal
+.kuzumem/
+.fabric_data/
+
+# Misc
+**/.DS_Store
+**/*.log
+
+# Secrets. .gitignore already covers `.env`, but this file did not -- and
+# .dockerignore is what governs the build context, not .gitignore. An
+# untracked .env is exactly what a broad COPY would pick up. Nested too, which
+# is why this is `**/` rather than a bare name.
+**/.env
+**/.env.*
+**/*.pem
+**/*.key
+**/*.p12
+**/id_rsa*

cognitive_fabric-0.1.0/.env.example

@@ -0,0 +1,47 @@
+# Cognitive-Fabric Configuration
+#
+# Every model id in this file is an example. No model is compiled into the
+# package: a model id is a vendor, a price and a capability envelope chosen at
+# install time, and it goes stale only when the provider retires the name. A
+# provider is usable once you name a model for it, and the server says which
+# setting is missing when you have not.
+
+# Logging
+COGNITIVE_FABRIC_LOG_LEVEL=INFO
+COGNITIVE_FABRIC_LOG_JSON=true
+
+# Database (required: the server has no default path)
+# COGNITIVE_FABRIC_DB_PATH=/path/to/custom/db
+
+# LLM Provider (openai or anthropic)
+COGNITIVE_FABRIC_LLM_PROVIDER=openai
+
+# OpenAI Configuration
+OPENAI_API_KEY=sk-your-api-key-here
+# Required. Must be a model the provider still lists -- it is checked against
+# https://api.openai.com/v1/models before the first call.
+COGNITIVE_FABRIC_OPENAI_MODEL=<a model id from https://platform.openai.com/docs/models>
+
+# Anthropic Configuration (alternative)
+# ANTHROPIC_API_KEY=sk-ant-your-api-key-here
+# COGNITIVE_FABRIC_ANTHROPIC_MODEL=<a model id from https://docs.anthropic.com/en/docs/about-claude/models>
+
+# Embeddings for the semantic layer. There is no default cloud embedding model:
+# an embedding model fixes both the price per million tokens and the width of
+# every vector already in the table, and vectors from two models are not
+# comparable. The local backends keep their own defaults.
+#
+#   fastembed              local, ONNX, no torch   (default)
+#   sentence-transformers  local, needs torch
+#   openai                 cloud, model required
+# COGNITIVE_FABRIC_FABRIC_EMBEDDING_PROVIDER=fastembed
+# COGNITIVE_FABRIC_FABRIC_EMBEDDING_MODEL=<required when the provider is openai>
+
+# Memory Optimizer
+COGNITIVE_FABRIC_OPTIMIZER_DEFAULT_STRATEGY=conservative
+COGNITIVE_FABRIC_OPTIMIZER_ENABLE_MCP_SAMPLING=true
+COGNITIVE_FABRIC_OPTIMIZER_SNAPSHOT_FAILURE_POLICY=warn
+
+# Cognitive Fabric (semantic layer)
+# Where the LanceDB vector store is stored (defaults to ./.fabric_data)
+# COGNITIVE_FABRIC_FABRIC_DATA_DIR=/path/to/fabric_data

cognitive_fabric-0.1.0/.github/dependabot.yml

@@ -0,0 +1,76 @@
+# Dependabot is configured rather than switched off.
+#
+# Left at the default, this opens a PR per dependency per week, which in practice
+# is a queue nobody can merge. This repository holds two dependencies deliberately
+# (kuzu, mcp) and caps two more (the cloud SDKs), so an ungrouped config would
+# spend most of its PRs proposing to lift exactly the pins that are there on
+# purpose. One grouped PR per ecosystem per month is a size a person can review in
+# one sitting.
+#
+# The `ignore` entries below restate decisions already written into
+# pyproject.toml. If a pin is lifted there, lift it here too -- otherwise this file
+# goes on suppressing updates nobody still means to suppress. Note that Dependabot
+# reads this file only from the default branch, so changes here take effect at the
+# next merge to `main`, not at the push.
+#
+# There are deliberately no `labels:` entries: requesting a label that does not
+# exist in the repository gives you a PR that carries a "could not be found"
+# warning and no labels at all. Create them first if you want them.
+
+version: 2
+
+updates:
+  # ------------------------------------------------------------------ Python deps
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    commit-message:
+      prefix: "deps"
+    groups:
+      pip:
+        patterns: ["*"]
+    ignore:
+      # Pinned exactly in pyproject.toml. kuzu is archived upstream -- 0.11.3 is the
+      # final release -- and its file format is not stable before 1.0, so a bump can
+      # leave an existing graph unreadable. Lifting this pin needs a migration step,
+      # not a dependency bump.
+      - dependency-name: "kuzu"
+
+      # Capped below 2 in pyproject.toml: the 2.x SDK removed the low-level Server
+      # list_tools/call_tool decorators that the server is built on.
+      - dependency-name: "mcp"
+        versions: [">= 2.0.0"]
+
+      # The two cloud SDKs in the `[cloud]` extra are deliberately *not* ignored,
+      # though they are capped in pyproject.toml. An ignore would suppress the one
+      # PR that would show you a break: an SDK major rewrote the request types under
+      # its callers once already, and the failure arrived as a runtime TypeError on a
+      # user's machine. A major bump now opens a PR proposing to lift the cap, and
+      # the live-provider smoke workflow (Actions -> Live provider smoke -> Run
+      # workflow) is what says whether the new SDK still accepts the request this
+      # package builds. A green install proves nothing about the request shape.
+
+  # ----------------------------------------------------------------- GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    commit-message:
+      prefix: "ci"
+    groups:
+      github-actions:
+        patterns: ["*"]
+
+  # ------------------------------------------------------------------ Docker images
+  # The Dockerfile's base image is the only docker dependency here; nothing is held,
+  # so this is a plain grouped update.
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    commit-message:
+      prefix: "docker"
+    groups:
+      docker:
+        patterns: ["*"]

cognitive_fabric-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,285 @@
+# Continuous Integration - Run tests and linting
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+      - master
+  # Deliberately no branch filter. With `branches: [main, master]` here, a pull
+  # request whose base is any other branch -- which is how a change is stacked on
+  # another unmerged change -- got no CI at all, and "no checks reported" in the
+  # PR list reads much like "checks passed". Every pull request runs CI.
+  pull_request:
+
+jobs:
+  # The workflow files are the one thing here with no other gate, and release.yml
+  # is the part that runs rarely and matters most -- so a mistake in it is found
+  # at release time, by everyone. actionlint reads the workflows themselves:
+  # expression syntax, job-graph references, and the shell and Python inside each
+  # `run:` block, through shellcheck and pyflakes, both of which the pinned image
+  # below ships. Run against this tree it reported two SC2086 findings in
+  # release.yml (`>> $GITHUB_OUTPUT` unquoted); both are fixed.
+  actionlint:
+    name: Lint workflows
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Run actionlint
+        uses: docker://rhysd/actionlint:1.7.12
+        with:
+          args: -color
+
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install dependencies
+        run: pip install -e '.[dev]'
+
+      # `scripts/` is included, not just `src/` and `tests/`. The smoke script is
+      # not part of the package but it is part of this repository, and code no
+      # gate reads is code that rots. This used to name that one file because
+      # scripts/start_server.py did not pass -- it imported `kuzumempy.main`,
+      # which does not exist; the tool-surface freeze fixed it to
+      # `cognitive_fabric.main`. Its remaining E402 is a deliberate path insert,
+      # marked as such.
+      - name: Run Ruff linter
+        run: ruff check src tests scripts
+
+      # mypy is deliberately not a gate here yet. It is configured
+      # (`strict = true` in pyproject.toml) but the tree does not satisfy it:
+      # 199 errors across 39 files as of this commit. A job that fails on every
+      # run says less than no job at all, so wire this in once the tree is
+      # clean — the configuration is already in place and only the step is
+      # missing. The command will be `mypy src`.
+
+  test:
+    name: Test (py${{ matrix.python-version }}, ${{ matrix.profile.name }})
+    runs-on: ubuntu-latest
+    needs: lint
+    strategy:
+      # Report every combination, rather than cancelling the others when one
+      # fails.
+      fail-fast: false
+      matrix:
+        # Every version the package installs on, and nothing beyond them. 3.14 is
+        # excluded by `requires-python`, because kuzu 0.11.3 ships no cp314 wheels
+        # for macOS or Windows; the comment there has the detail.
+        python-version: ['3.11', '3.12', '3.13']
+        # Two installs, because the failure worth catching here is not a red
+        # test -- it is a green run in which the optional half never ran. The
+        # vector-store suite is `pytest.importorskip("lancedb")` at module level,
+        # so under the minimal install it collapses to a single module skip and
+        # its four tests do not exist; the full install is where they run. The
+        # minimal install is where the *degraded* path -- semantic search
+        # reporting itself unavailable rather than raising -- is the only thing
+        # that can run, and so must. That pairing has to hold on both Python
+        # versions, because a green minimal run is exactly what a broken install
+        # of the full one looks like.
+        profile:
+          - name: minimal
+            extras: dev
+          - name: full
+            extras: dev,cloud,semantic
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      # Every extra is installed somewhere here. An extra that does not resolve
+      # is a broken install for every user who asks for it, and nothing else in
+      # CI would notice. `cloud` is in the full profile only; no test imports
+      # either SDK (the LLM tests use duck-typed fakes), so it is installed to
+      # prove it installs, not to cover a hidden skip.
+      #
+      # `full` downloads fastembed's ONNX model on the first vector-store test,
+      # which is the price of the four tests actually running rather than
+      # skipping. It happens once per job.
+      - name: Install dependencies
+        run: pip install -e '.[${{ matrix.profile.extras }}]'
+
+      # `-rs` is not decoration. Without it a module-level skip leaves no line at
+      # all in the `-v` output, so "the vector-store tests skipped" and "the
+      # vector-store tests were never mentioned" read identically -- which is the
+      # whole defect this job pair exists for. The short summary is what names the
+      # reason, and the check below reads it.
+      - name: Run tests
+        env:
+          PROFILE: ${{ matrix.profile.name }}
+        run: |
+          set +e
+          pytest tests/unit/ tests/integration/ tests/e2e/ -v --tb=short -rs \
+            > /tmp/pytest.log 2>&1
+          PYTEST_RC=$?
+          set -e
+          cat /tmp/pytest.log
+          export PYTEST_RC
+          python3 - <<'PY'
+          import os
+          import pathlib
+          import re
+          import sys
+
+          rc = int(os.environ["PYTEST_RC"])
+          log = pathlib.Path("/tmp/pytest.log").read_text()
+
+          # A red run is its own message, and it is printed above.
+          if rc != 0:
+              sys.exit(rc)
+
+          profile = os.environ["PROFILE"]
+
+          # One line per test that actually ran, so this counts tests executed --
+          # not tests collected, and not "no failures".
+          ran = re.findall(
+              r"^tests/integration/test_vector_store\.py::\S+ PASSED", log, re.M
+          )
+          degraded = (
+              "TestTheDegradedSemanticPath::"
+              "test_semantic_search_reports_itself_unavailable PASSED"
+          )
+
+          if profile == "full":
+              # `full` installs the [semantic] extra, so the four tests are the
+              # point of the profile; anything fewer means part of them skipped.
+              if len(ran) != 4:
+                  sys.exit(
+                      f"the full profile installs [semantic], so all four "
+                      f"vector-store tests must run; {len(ran)} did: {ran}"
+                  )
+              print(f"full profile: {len(ran)}/4 vector-store tests ran")
+          else:
+              # `minimal` has no [semantic] extra: the module must have skipped,
+              # and the degraded path must have been asserted. A profile that
+              # merely skipped things has proved nothing.
+              if ran:
+                  sys.exit(
+                      f"the minimal profile does not install [semantic], so "
+                      f"test_vector_store.py must not run, but {len(ran)} of its "
+                      f"tests did: {ran}"
+                  )
+              if "SKIPPED [1] tests/integration/test_vector_store.py:" not in log:
+                  sys.exit(
+                      "the vector-store module did not report itself skipped, so "
+                      "nothing here says the missing extra is what is missing"
+                  )
+              if degraded not in log:
+                  sys.exit(
+                      "semantic search was never asserted to degrade, in the one "
+                      "profile where it is unavailable"
+                  )
+              print("minimal profile: vector store skipped; degraded path asserted")
+          PY
+
+  docker:
+    # Builds the image but never publishes it. CF ships a Dockerfile and a
+    # docker-compose.yml, and until this job existed nothing had ever built
+    # either -- so a broken image would have been found by whoever tried it
+    # first, after release, rather than here.
+    name: Docker (production image)
+    runs-on: ubuntu-latest
+    needs: lint
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Build the production image
+        run: docker build --file Dockerfile --tag cognitive-fabric:ci .
+
+      - name: Handshake over stdio
+        # Initialise, then let stdin close. This does need the database path the
+        # Dockerfile sets: the server builds its MemoryService during startup and
+        # exits without one, so it cannot answer `initialize` pathless. No key
+        # and no network are needed, which is still the point of checking here.
+        #
+        # stdout carries the JSON-RPC stream, so anything the server logs has to
+        # go to stderr. It does -- PrintLoggerFactory(file=sys.stderr) in
+        # utils/logger.py -- and the assertion below fails rather than skips if
+        # that ever stops being true.
+        run: |
+          printf '%s\n' \
+            '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"ci-handshake","version":"0"}}}' \
+            | timeout 300 docker run -i --rm cognitive-fabric:ci \
+                > /tmp/handshake.jsonl 2> /tmp/handshake.err \
+            || echo "docker run exit: $?"
+          echo "--- container stderr (tail) ---"
+          tail -20 /tmp/handshake.err || true
+
+      - name: Assert the handshake
+        run: |
+          python3 - <<'PY'
+          import json, pathlib, sys
+
+          # Both pinned deliberately: the version this repo publishes, and the
+          # name a client sees. Without an explicit `version=` the MCP SDK falls
+          # back to the *mcp package's* version, which is how the handshake once
+          # advertised 1.30.0 for a 0.1.0 server.
+          EXPECTED_VERSION = "0.1.0"
+          EXPECTED_NAME = "cognitive-fabric"
+
+          raw = pathlib.Path("/tmp/handshake.jsonl").read_text()
+
+          # stdout carries the JSON-RPC stream and nothing else. A stray log line
+          # here corrupts the protocol, so it fails rather than being skipped.
+          messages = []
+          for n, line in enumerate(raw.splitlines(), 1):
+              if not line.strip():
+                  continue
+              try:
+                  messages.append(json.loads(line))
+              except json.JSONDecodeError as e:
+                  sys.exit(f"stdout line {n} is not JSON: {line[:160]!r} ({e})")
+
+          infos = [
+              m["result"]["serverInfo"]
+              for m in messages
+              if isinstance(m.get("result"), dict) and "serverInfo" in m["result"]
+          ]
+          if not infos:
+              sys.exit(f"no serverInfo in {len(messages)} message(s): {messages!r}")
+
+          info = infos[0]
+          if info.get("name") != EXPECTED_NAME:
+              sys.exit(f"serverInfo.name is {info.get('name')!r}, expected {EXPECTED_NAME!r}")
+          if info.get("version") != EXPECTED_VERSION:
+              sys.exit(
+                  f"serverInfo.version is {info.get('version')!r}, "
+                  f"expected {EXPECTED_VERSION!r}"
+              )
+
+          print(f"stdout: {len(messages)} JSON-RPC message(s), 0 stray lines")
+          print(f"serverInfo: {info}")
+          PY
+
+  test-summary:
+    name: Test Summary
+    runs-on: ubuntu-latest
+    needs: test
+    if: always()
+
+    steps:
+      - name: Check test results
+        run: |
+          if [ "${{ needs.test.result }}" == "success" ]; then
+            echo "All tests passed!"
+          else
+            echo "Some tests failed"
+            exit 1
+          fi

cognitive_fabric-0.1.0/.github/workflows/live-provider-smoke.yml

@@ -0,0 +1,73 @@
+# One real call per cloud provider, weekly and on demand.
+#
+# This is the only job in this repository that talks to a provider for real.
+# Everything else runs offline, and the tests that cover request shape use fakes
+# -- deliberately, because that is what makes them fast and deterministic, and
+# also what makes them unable to answer the one question only a live call can:
+# does the model the operator configured still exist, and does the provider still
+# accept the request this package builds for it? Vendors retire model ids on
+# their own schedule, and no amount of local testing notices.
+#
+# So it is deliberately not in the push and PR gate. It needs secrets, it spends a
+# fraction of a cent, and it fails for reasons that have nothing to do with the
+# commit under test -- a red X on every PR would train people to ignore it. It
+# runs on `main` only, weekly and by hand, and its failures are a signal about the
+# world rather than about a diff.
+#
+#   Models  come from repository *variables*  (Settings -> Secrets and variables
+#           -> Actions -> Variables): OPENAI_MODEL, ANTHROPIC_MODEL. A model id is
+#           not a credential, and being able to read it in the settings page is
+#           what makes a failure diagnosable.
+#   Keys    come from repository *secrets* (OPENAI_API_KEY, ANTHROPIC_API_KEY).
+#
+# A provider with no key or no model is reported as skipped, and the job stays
+# green -- but a run where *nothing* was configured fails, because a smoke test
+# that passes by testing nothing is worse than one that never ran.
+name: Live provider smoke
+
+on:
+  # Manual: Actions -> Live provider smoke -> Run workflow.
+  workflow_dispatch:
+  schedule:
+    # Mondays at 07:19 UTC. Off the hour on purpose: the top of the hour is when
+    # most of the world's scheduled jobs fire, and GitHub queues behind them.
+    - cron: '19 7 * * 1'
+
+# Read-only: this job runs provider SDKs against a checked-out tree and writes
+# nothing back.
+permissions:
+  contents: read
+
+jobs:
+  smoke:
+    name: One call per provider
+    runs-on: ubuntu-latest
+    # `main` only, including for a manual dispatch, which can otherwise be
+    # started from any branch. The point is to check what users have: a branch may
+    # name a model that is not the released default, and a green run there would
+    # say nothing about the published package. Scheduled runs are already pinned
+    # to the default branch.
+    if: github.ref == 'refs/heads/main'
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      # `.[cloud]`: the two provider SDKs live in an extra, not in the core
+      # dependencies, so a local-first install does not download them. This job
+      # is the one that speaks to a provider for real, so it is the one that has
+      # to ask for them.
+      - name: Install dependencies
+        run: pip install -e '.[cloud]'
+
+      - name: One tiny call per provider
+        env:
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+          OPENAI_MODEL: ${{ vars.OPENAI_MODEL }}
+          ANTHROPIC_MODEL: ${{ vars.ANTHROPIC_MODEL }}
+        run: python scripts/live_provider_smoke.py

cognitive_fabric-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,140 @@
+# Release workflow - Publish to PyPI on release
+#
+# Mirrors docugraph's, with three things that are CF's rather than docugraph's:
+# the project name, the Dockerfile at the repository root (docugraph's lives in
+# docker/), and no `target:` on the image build -- CF's Dockerfile has a single
+# stage, so naming one would fail.
+#
+# This runs when a *GitHub Release* is published, or on manual dispatch. Pushing
+# a bare `git tag v0.1.0` does NOT trigger it: draft a release from the tag, or
+# use the manual run below.
+name: Release
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version to release (e.g., 0.1.0)'
+        required: true
+
+jobs:
+  build:
+    name: Build Distribution
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v4
+
+      - name: Install build dependencies
+        run: |
+          uv pip install --system build twine
+
+      - name: Build package
+        run: python -m build
+
+      - name: Check distribution
+        run: twine check dist/*
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish-pypi:
+    name: Publish to PyPI
+    runs-on: ubuntu-latest
+    needs: build
+    environment:
+      name: pypi
+      url: https://pypi.org/project/cognitive-fabric/
+
+    permissions:
+      id-token: write  # Required for trusted publishing
+
+    steps:
+      - name: Download artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        # Uses trusted publishing - no API token needed
+        # Configure at: https://pypi.org/manage/project/cognitive-fabric/settings/publishing/
+
+  publish-docker:
+    name: Publish Release Docker Image
+    runs-on: ubuntu-latest
+    # Not `needs: build`. `publish-pypi` is gated on the `pypi` environment's
+    # required reviewers, so waiting on it means nothing reaches the registry
+    # before the release has been approved. Running straight off `build` would
+    # put an image on ghcr.io for a version that may never be published.
+    needs: [build, publish-pypi]
+    permissions:
+      contents: read
+      packages: write
+
+    env:
+      REGISTRY: ghcr.io
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      # ghcr.io requires a lowercase repository path, and `github.repository`
+      # keeps the owner's case. Expressions have no lowercase function, so it
+      # is done in the shell.
+      - name: Resolve image name
+        id: image
+        run: echo "name=${REGISTRY}/${GITHUB_REPOSITORY,,}" >> "$GITHUB_OUTPUT"
+
+      # linux/amd64 only. Building arm64 means running it under emulation, which
+      # needs a QEMU step registered with binfmt -- the step that used to sit
+      # here. It is a post-release item: add both back once an arm64 image has
+      # been built and verified by hand. kuzu 0.11.3 does publish manylinux
+      # aarch64 wheels for cp311, so that build would install from a wheel
+      # rather than compiling the extension.
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract version
+        id: version
+        run: |
+          if [ "${{ github.event_name }}" == "release" ]; then
+            echo "version=${{ github.event.release.tag_name }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "version=v${{ github.event.inputs.version }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: ./Dockerfile
+          push: true
+          tags: |
+            ${{ steps.image.outputs.name }}:${{ steps.version.outputs.version }}
+            ${{ steps.image.outputs.name }}:latest
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          platforms: linux/amd64