onde-cli 0.2.0__tar.gz → 0.3.0__tar.gz

onde_cli-0.3.0/.agents/skills/git/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: git
+description: Git workflow rules for this repository.
+allowed-tools: Read, Write, Edit, Glob, Grep, AskUserQuestion
+user-invocable: true
+---
+
+# Git skill
+
+## Core rule
+
+- Use `--no-ff`. Important.
+
+## What this means in practice
+
+- Do not fast-forward merge feature branches, release branches, or hotfix branches.
+- Prefer explicit merge commits so the branch history stays visible.
+- If release prep happens on a branch, merge it into `main` with `--no-ff` before tagging.
+- Tag the merge commit that contains the final release state.
+
+## Release guidance
+
+For releases, prefer a flow like this:
+
+```bash
+git checkout main
+git merge --no-ff <release-branch> -m "Merge release prep for vX.Y.Z"
+git tag vX.Y.Z
+git push origin main
+git push origin vX.Y.Z
+```
+
+If the work is already on `main`, make a normal commit and tag that commit. Do not rewrite history just to avoid a merge commit.
+
+## Avoid
+
+- `git merge --ff`
+- `git pull --ff-only` as a default recommendation for this repo's merge policy
+- Tagging a branch tip that has not been merged into `main` when the intended release source of truth is `main`
+
+## Why
+
+The repo wants explicit history. Release commits should be easy to find, easy to audit, and clearly connected to the branch that introduced them.

{onde_cli-0.2.0 → onde_cli-0.3.0}/.github/workflows/ci.yml

@@ -2,8 +2,6 @@ name: CI
 
 on:
   push:
-    branches:
-      - main
   pull_request:
   workflow_dispatch:
 
@@ -58,6 +56,7 @@ jobs:
           ONDE_APP_SECRET: ${{ secrets.ONDE_APP_SECRET }}
           GRESIQ_API_KEY: ${{ secrets.GRESIQ_API_KEY }}
           GRESIQ_API_SECRET: ${{ secrets.GRESIQ_API_SECRET }}
+          HF_TOKEN: ${{ secrets.HF_TOKEN }}
 
   test:
     name: Test
@@ -82,6 +81,7 @@ jobs:
           ONDE_APP_SECRET: ${{ secrets.ONDE_APP_SECRET }}
           GRESIQ_API_KEY: ${{ secrets.GRESIQ_API_KEY }}
           GRESIQ_API_SECRET: ${{ secrets.GRESIQ_API_SECRET }}
+          HF_TOKEN: ${{ secrets.HF_TOKEN }}
 
   check:
     name: Cargo check
@@ -106,10 +106,11 @@ jobs:
           ONDE_APP_SECRET: ${{ secrets.ONDE_APP_SECRET }}
           GRESIQ_API_KEY: ${{ secrets.GRESIQ_API_KEY }}
           GRESIQ_API_SECRET: ${{ secrets.GRESIQ_API_SECRET }}
+          HF_TOKEN: ${{ secrets.HF_TOKEN }}
 
   build:
     name: Build (aarch64-apple-darwin)
-    runs-on: macos-latest
+    runs-on: macos-26
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -129,6 +130,7 @@ jobs:
           ONDE_APP_SECRET: ${{ secrets.ONDE_APP_SECRET }}
           GRESIQ_API_KEY: ${{ secrets.GRESIQ_API_KEY }}
           GRESIQ_API_SECRET: ${{ secrets.GRESIQ_API_SECRET }}
+          HF_TOKEN: ${{ secrets.HF_TOKEN }}
 
   ci:
     name: CI status

{onde_cli-0.2.0 → onde_cli-0.3.0}/.github/workflows/release-crates.yml

@@ -19,6 +19,7 @@ env:
   ONDE_APP_SECRET: ${{ secrets.ONDE_APP_SECRET }}
   GRESIQ_API_KEY: ${{ secrets.GRESIQ_API_KEY }}
   GRESIQ_API_SECRET: ${{ secrets.GRESIQ_API_SECRET }}
+  HF_TOKEN: ${{ secrets.HF_TOKEN }}
 
 jobs:
   verify:
@@ -101,20 +102,3 @@ jobs:
         env:
           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
         run: cargo publish --locked
-
-  github-release:
-    name: Create GitHub release
-    runs-on: ubuntu-latest
-    needs:
-      - verify
-      - publish
-    if: github.event_name == 'push'
-    permissions:
-      contents: write
-    steps:
-      - name: Create release
-        uses: softprops/action-gh-release@v2
-        with:
-          tag_name: v${{ needs.verify.outputs.version }}
-          generate_release_notes: true
-          name: onde-cli v${{ needs.verify.outputs.version }}

{onde_cli-0.2.0 → onde_cli-0.3.0}/.github/workflows/release-github.yml

@@ -21,6 +21,7 @@ env:
   ONDE_APP_SECRET: ${{ secrets.ONDE_APP_SECRET }}
   GRESIQ_API_KEY: ${{ secrets.GRESIQ_API_KEY }}
   GRESIQ_API_SECRET: ${{ secrets.GRESIQ_API_SECRET }}
+  HF_TOKEN: ${{ secrets.HF_TOKEN }}
 
 jobs:
   build:
@@ -44,10 +45,10 @@ jobs:
             runner: windows-latest
             target: aarch64-pc-windows-msvc
           - name: macos-amd64
-            runner: macos-15-intel
+            runner: macos-26-intel
             target: x86_64-apple-darwin
           - name: macos-arm64
-            runner: macos-latest
+            runner: macos-26
             target: aarch64-apple-darwin
 
     steps:

onde_cli-0.3.0/.github/workflows/release-npm.yml

@@ -0,0 +1,225 @@
+name: NPM Release
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Release tag (e.g. v0.2.0)"
+        required: true
+
+permissions:
+  id-token: write
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+  ONDE_APP_ID: ${{ secrets.ONDE_APP_ID }}
+  ONDE_APP_SECRET: ${{ secrets.ONDE_APP_SECRET }}
+  GRESIQ_API_KEY: ${{ secrets.GRESIQ_API_KEY }}
+  GRESIQ_API_SECRET: ${{ secrets.GRESIQ_API_SECRET }}
+  HF_TOKEN: ${{ secrets.HF_TOKEN }}
+
+jobs:
+  publish-npm-binaries:
+    name: Publish NPM platform packages
+    runs-on: ${{ matrix.build.OS }}
+    strategy:
+      fail-fast: false
+      matrix:
+        build:
+          - {
+              NAME: linux-x64-glibc,
+              OS: ubuntu-latest,
+              TARGET: x86_64-unknown-linux-gnu,
+            }
+          - {
+              NAME: linux-arm64-glibc,
+              OS: ubuntu-24.04-arm,
+              TARGET: aarch64-unknown-linux-gnu,
+            }
+          - {
+              NAME: win32-x64-msvc,
+              OS: windows-2022,
+              TARGET: x86_64-pc-windows-msvc,
+            }
+          - {
+              NAME: win32-arm64-msvc,
+              OS: windows-2022,
+              TARGET: aarch64-pc-windows-msvc,
+            }
+          - {
+              NAME: darwin-x64,
+              OS: macos-26-intel,
+              TARGET: x86_64-apple-darwin,
+            }
+          - {
+              NAME: darwin-arm64,
+              OS: macos-26,
+              TARGET: aarch64-apple-darwin,
+            }
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.inputs.tag || github.ref }}
+
+      - name: Set the release version
+        shell: bash
+        run: |
+          if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
+            release_version="${GITHUB_REF_NAME#v}"
+          else
+            release_version="${{ github.event.inputs.tag }}"
+            release_version="${release_version#v}"
+          fi
+          echo "RELEASE_VERSION=${release_version}" >> "$GITHUB_ENV"
+
+      - name: Read Rust toolchain
+        shell: bash
+        run: |
+          rust_toolchain="$(sed -n 's/^channel = "\(.*\)"/\1/p' rust-toolchain.toml | head -n 1)"
+          if [ -z "$rust_toolchain" ]; then
+            echo "Failed to read Rust toolchain from rust-toolchain.toml" >&2
+            exit 1
+          fi
+          echo "RUST_TOOLCHAIN=${rust_toolchain}" >> "$GITHUB_ENV"
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
+        with:
+          toolchain: ${{ env.RUST_TOOLCHAIN }}
+
+      - name: Install Rust target
+        shell: bash
+        run: |
+          rustup target add ${{ matrix.build.TARGET }} --toolchain ${{ env.RUST_TOOLCHAIN }}
+          rustup target list --installed
+
+      - name: Setup Rust cache
+        uses: Swatinem/rust-cache@v2
+        with:
+          key: npm-${{ matrix.build.TARGET }}
+
+      - name: Build binary
+        shell: bash
+        run: cargo build --locked --release --target ${{ matrix.build.TARGET }}
+
+      - name: Install Node
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: .nvmrc
+          registry-url: "https://registry.npmjs.org"
+
+      - name: Publish platform package to NPM
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        shell: bash
+        run: |
+          cd npm
+
+          # Binary name from Cargo.toml
+          cargo_bin="onde"
+
+          # Prefix used for optional dependency package names
+          node_pkg_prefix="cli"
+
+          # Derive OS and architecture from the build matrix name
+          # Matrix name format: <os>-<arch>[-<extra>]
+          node_os=$(echo "${{ matrix.build.NAME }}" | cut -d '-' -f1)
+          export node_os
+          node_arch=$(echo "${{ matrix.build.NAME }}" | cut -d '-' -f2)
+          export node_arch
+
+          # Set the version
+          export node_version="${{ env.RELEASE_VERSION }}"
+
+          # Build the platform package name; normalise win32 → windows
+          if [ "${{ matrix.build.OS }}" = "windows-2022" ]; then
+            export node_pkg="${node_pkg_prefix}-windows-${node_arch}"
+          else
+            export node_pkg="${node_pkg_prefix}-${node_os}-${node_arch}"
+          fi
+
+          # Create the package directory
+          mkdir -p "${node_pkg}/bin"
+
+          # Generate package.json + README for this platform slice
+          node ./scripts/render-platform-package.cjs \
+            "${node_pkg}" \
+            "${node_version}" \
+            "${node_os}" \
+            "${node_arch}"
+
+          # Windows binaries carry a .exe extension
+          if [ "${{ matrix.build.OS }}" = "windows-2022" ]; then
+            cargo_bin="${cargo_bin}.exe"
+          fi
+
+          cp "../target/${{ matrix.build.TARGET }}/release/${cargo_bin}" "${node_pkg}/bin"
+
+          cd "${node_pkg}"
+
+          npm_package_name="@ondeinference/${node_pkg}"
+          if npm view "${npm_package_name}@${node_version}" version >/dev/null 2>&1; then
+            echo "${npm_package_name}@${node_version} already exists on npm, skipping publish"
+            exit 0
+          fi
+
+          npm publish --access public --provenance
+
+  publish-npm-base:
+    name: Publish base NPM package (@ondeinference/cli)
+    needs: publish-npm-binaries
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.inputs.tag || github.ref }}
+
+      - name: Set the release version
+        shell: bash
+        run: |
+          if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
+            release_version="${GITHUB_REF_NAME#v}"
+          else
+            release_version="${{ github.event.inputs.tag }}"
+            release_version="${release_version#v}"
+          fi
+          echo "RELEASE_VERSION=${release_version}" >> "$GITHUB_ENV"
+
+      - name: Install Node
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: .nvmrc
+          registry-url: "https://registry.npmjs.org"
+
+      - name: Publish base package to NPM
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        shell: bash
+        run: |
+          cd npm/onde-cli
+
+          # Rewrite package.json with the correct release version and
+          # matching optionalDependency versions
+          node ../scripts/render-main-package.cjs \
+            "./package.json" \
+            "${{ env.RELEASE_VERSION }}"
+
+          npm_package_name="@ondeinference/cli"
+          npm_package_version="${{ env.RELEASE_VERSION }}"
+
+          if npm view "${npm_package_name}@${npm_package_version}" version >/dev/null 2>&1; then
+            echo "${npm_package_name}@${npm_package_version} already exists on npm, skipping publish"
+            exit 0
+          fi
+
+          npm install
+          npm run build
+          npm publish --access public --provenance

{onde_cli-0.2.0 → onde_cli-0.3.0}/.github/workflows/release-pypi.yml

@@ -20,6 +20,7 @@ env:
   ONDE_APP_SECRET: ${{ secrets.ONDE_APP_SECRET }}
   GRESIQ_API_KEY: ${{ secrets.GRESIQ_API_KEY }}
   GRESIQ_API_SECRET: ${{ secrets.GRESIQ_API_SECRET }}
+  HF_TOKEN: ${{ secrets.HF_TOKEN }}
 
 jobs:
   build-wheels:
@@ -51,10 +52,10 @@ jobs:
               OS: windows-2022,
               TARGET: aarch64-pc-windows-msvc,
             }
-          - { NAME: darwin-x64, OS: macos-latest, TARGET: x86_64-apple-darwin }
+          - { NAME: darwin-x64, OS: macos-26-intel, TARGET: x86_64-apple-darwin }
           - {
               NAME: darwin-arm64,
-              OS: macos-latest,
+              OS: macos-26,
               TARGET: aarch64-apple-darwin,
             }
     steps:
@@ -103,7 +104,7 @@ jobs:
           working-directory: pypi
           args: --release --locked --compatibility pypi --out dist
           before-script-linux: yum install -y perl-core
-          docker-options: -e ONDE_APP_ID -e ONDE_APP_SECRET -e GRESIQ_API_KEY -e GRESIQ_API_SECRET
+          docker-options: -e ONDE_APP_ID -e ONDE_APP_SECRET -e GRESIQ_API_KEY -e GRESIQ_API_SECRET -e HF_TOKEN
 
       - name: Upload wheel artifact
         uses: actions/upload-artifact@v4

onde_cli-0.3.0/.nvmrc

@@ -0,0 +1 @@
+20