freesolo-flash-dev 1.4.24__tar.gz → 1.4.25__tar.gz

{freesolo_flash_dev-1.4.24 → freesolo_flash_dev-1.4.25}/.github/workflows/publish-image.yml

@@ -104,8 +104,11 @@ jobs:
           context: .
           file: ./Dockerfile
           push: true
+          # INSTALL_NEBIUS=true adds the pinned Nebius CLI that the optional Spot provider drives;
+          # it stays inert until an operator mounts a Nebius profile and sets FLASH_NEBIUS_*.
           build-args: |
             INSTALL_INFISICAL=true
+            INSTALL_NEBIUS=true
           tags: ${{ steps.tags.outputs.tags }}
           cache-from: type=gha
           cache-to: type=gha,mode=min

{freesolo_flash_dev-1.4.24 → freesolo_flash_dev-1.4.25}/Dockerfile

@@ -65,7 +65,40 @@ RUN if [ "${INSTALL_INFISICAL}" = "true" ]; then \
         infisical --version; \
     fi
 
-# Source changes reuse the operating-system and optional Infisical layers.
+# Optional Nebius CLI, required only by the Nebius Spot provider (`[gpu] spot = true`): Flash
+# drives Nebius through `nebius ... --no-browser` and treats the provider as unconfigured when the
+# binary is absent (flash/providers/nebius/config.py). OFF by default, like Infisical, so a plain
+# `docker build .` stays vendor-free; Freesolo's published images turn it on
+# (.github/workflows/publish-image.yml passes INSTALL_NEBIUS=true). The binary alone grants
+# nothing: the operator still mounts an authenticated service-account profile at /root/.nebius
+# and sets FLASH_NEBIUS_* (see SELF_HOSTING.md).
+#
+# Pinned by version AND sha256 rather than piping the vendor's install.sh into a shell. Nebius
+# publishes the binaries at artifacts.nebius.cloud/cli/release/<version>/linux/<arch>/nebius
+# without a checksums file, so the digests below were taken from those exact release binaries.
+# Bump NEBIUS_CLI_VERSION and both digests together; a mismatch fails the build.
+ARG INSTALL_NEBIUS=false
+ARG NEBIUS_CLI_VERSION=0.12.302
+ARG NEBIUS_CLI_SHA256_AMD64=44315ff3fec500bcf3e7836f738ab456dcdf2b796c79b531ded6ca8f40622f56
+ARG NEBIUS_CLI_SHA256_ARM64=0d4781905d777b3a4fc295158d0f382691e453cc7828c02dca2212cf331712b9
+RUN if [ "${INSTALL_NEBIUS}" = "true" ]; then \
+        set -eu; \
+        case "$(dpkg --print-architecture)" in \
+            amd64) arch="x86_64"; sha="${NEBIUS_CLI_SHA256_AMD64}" ;; \
+            arm64) arch="arm64"; sha="${NEBIUS_CLI_SHA256_ARM64}" ;; \
+            *) echo "no pinned nebius CLI build for this architecture" >&2; exit 1 ;; \
+        esac; \
+        bin="/tmp/nebius"; \
+        curl -fsSL -o "${bin}" \
+            "https://artifacts.nebius.cloud/cli/release/${NEBIUS_CLI_VERSION}/linux/${arch}/nebius"; \
+        # Verify BEFORE installing: a mismatch must fail the build, never install.
+        echo "${sha}  ${bin}" | sha256sum -c -; \
+        install -m 0755 "${bin}" /usr/local/bin/nebius; \
+        rm -f "${bin}"; \
+        test "$(nebius version)" = "${NEBIUS_CLI_VERSION}"; \
+    fi
+
+# Source changes reuse the operating-system and optional Infisical and Nebius layers.
 COPY . .
 RUN pip install --no-cache-dir ".[server]"
 

{freesolo_flash_dev-1.4.24 → freesolo_flash_dev-1.4.25}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: freesolo-flash-dev
-Version: 1.4.24
+Version: 1.4.25
 Summary: Flash — managed LoRA post-training (SFT/GRPO) for Freesolo environments, driven by the `flash` CLI
 Project-URL: Homepage, https://github.com/freesolo-co/flash
 Project-URL: Repository, https://github.com/freesolo-co/flash

{freesolo_flash_dev-1.4.24 → freesolo_flash_dev-1.4.25}/SELF_HOSTING.md

@@ -40,7 +40,12 @@ checkpoint whose upload was still in progress. Portal is not used.
 On the control-plane host:
 
 1. Install and authenticate the current Nebius CLI with access to the intended
-   USD-billed project, compute resources and billing pricing policies.
+   USD-billed project, compute resources and billing pricing policies. Freesolo's
+   published control-plane images already contain a pinned CLI (`INSTALL_NEBIUS=true`;
+   a plain `docker build .` omits it). Flash calls it non-interactively with
+   `--no-browser`, so give the container a service-account profile, not a browser
+   login: for example, mount a root-only directory holding `config.yaml` and the
+   authorized-key PEM at `/root/.nebius`.
 2. Set `FLASH_NEBIUS_PROJECT_ID`, `FLASH_NEBIUS_REGION`,
    `FLASH_NEBIUS_SUBNET_ID`, and `FLASH_NEBIUS_IMAGE_ID`. The region must match
    the project and subnet. The configured GPU host image must have Docker,

{freesolo_flash_dev-1.4.24 → freesolo_flash_dev-1.4.25}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "freesolo-flash-dev"
-version = "1.4.24"
+version = "1.4.25"
 description ="Flash — managed LoRA post-training (SFT/GRPO) for Freesolo environments, driven by the `flash` CLI"
 # The training and serving stack is validated on Python 3.11 and 3.12.
 requires-python = ">=3.11,<3.13"
@@ -210,7 +210,7 @@ artifacts = ["flash/py.typed"]
 # auto-published by .github/workflows/publish-dev.yml: a push to `dev` whose version isn't yet on
 # PyPI publishes it; pushes that don't change it find it already published and no-op. So cutting a
 # dev-channel release = bump this (and [project].version) and merge to `dev`.
-version = "1.4.24"
+version = "1.4.25"
 
 [tool.pytest.ini_options]
 pythonpath = ["."]

{freesolo_flash_dev-1.4.24 → freesolo_flash_dev-1.4.25}/uv.lock

@@ -1297,7 +1297,7 @@ wheels = [
 
 [[package]]
 name = "freesolo-flash"
-version = "1.4.24"
+version = "1.4.25"
 source = { editable = "." }
 
 [package.optional-dependencies]