rastermoves 0.3.1__tar.gz

rastermoves-0.3.1/.dockerignore

@@ -0,0 +1,4 @@
+**
+!Dockerfile
+!dist/
+!dist/*.whl

rastermoves-0.3.1/.github/dependabot.yml

@@ -0,0 +1,15 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: weekly

rastermoves-0.3.1/.github/workflows/release.yml

@@ -0,0 +1,272 @@
+name: Release
+on:
+  push:
+    tags: ['v*']
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Existing version tag; leave blank only for a TestPyPI rehearsal of the selected ref
+        required: false
+        type: string
+      target:
+        description: TestPyPI only, or all configured production destinations
+        required: true
+        type: choice
+        default: testpypi
+        options: [testpypi, production]
+# One release at a time: do not cancel a partly-published distribution.
+concurrency:
+  group: rastermoves-release
+  cancel-in-progress: false
+permissions:
+  contents: read
+jobs:
+  prepare:
+    if: github.repository == 'kieransimkin/RasterMoves'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      tag: ${{ steps.metadata.outputs.tag }}
+      version: ${{ steps.metadata.outputs.version }}
+      commit: ${{ steps.metadata.outputs.commit }}
+      image: ${{ steps.metadata.outputs.image }}
+      prerelease: ${{ steps.metadata.outputs.prerelease }}
+      target: ${{ steps.route.outputs.target }}
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          ref: ${{ inputs.tag && format('refs/tags/{0}', inputs.tag) || github.ref }}
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: '3.12'
+      - name: Validate tag, source versions and exact commit
+        id: metadata
+        env:
+          RELEASE_TAG: ${{ github.event_name == 'push' && github.ref_name || inputs.tag }}
+          TARGET: ${{ inputs.target || 'production' }}
+        shell: bash
+        run: |
+          extra=()
+          if [ "$TARGET" = testpypi ] && [ -z "$RELEASE_TAG" ]; then extra+=(--allow-untagged); fi
+          python scripts/release_tools.py metadata --tag "$RELEASE_TAG" --repository "$GITHUB_REPOSITORY" \
+            --github-output "$GITHUB_OUTPUT" "${extra[@]}"
+      - id: route
+        env:
+          TARGET: ${{ inputs.target || 'production' }}
+        run: echo "target=$TARGET" >> "$GITHUB_OUTPUT"
+  checks:
+    needs: prepare
+    uses: ./.github/workflows/tests.yml
+    with:
+      ref: ${{ needs.prepare.outputs.commit }}
+  pypi:
+    needs: [prepare, checks]
+    if: needs.prepare.outputs.target == 'production'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    environment:
+      name: pypi
+      url: https://pypi.org/project/rastermoves/
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
+        with:
+          name: python-dist
+          path: dist/
+      - name: Publish wheel and source distribution using Trusted Publishing
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
+        with:
+          packages-dir: dist/
+          attestations: true
+          # Do not conceal a duplicate version or changed release by skipping it.
+          skip-existing: false
+  testpypi:
+    needs: [prepare, checks]
+    if: needs.prepare.outputs.target == 'testpypi' || vars.PUBLISH_TESTPYPI == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    environment:
+      name: testpypi
+      url: https://test.pypi.org/project/rastermoves/
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
+        with:
+          name: python-dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
+        with:
+          packages-dir: dist/
+          repository-url: https://test.pypi.org/legacy/
+          attestations: true
+          skip-existing: false
+  github-release:
+    needs: [prepare, checks]
+    if: needs.prepare.outputs.target == 'production'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: write
+    env:
+      GH_TOKEN: ${{ github.token }}
+      GH_REPO: ${{ github.repository }}
+      TAG: ${{ needs.prepare.outputs.tag }}
+      VERSION: ${{ needs.prepare.outputs.version }}
+      PRERELEASE: ${{ needs.prepare.outputs.prerelease }}
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          ref: ${{ needs.prepare.outputs.commit }}
+          persist-credentials: false
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: '3.12'
+      - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
+        with:
+          name: python-dist
+          path: dist/
+      - run: python scripts/release_tools.py dist --checksums dist/SHA256SUMS
+      - name: Attach artifacts while draft, then publish the release
+        shell: bash
+        run: |
+          # Never replace assets on an already published/immutable release.
+          if DRAFT=$(gh release view "$TAG" --json isDraft --jq .isDraft); then
+            if [ "$DRAFT" != true ]; then
+              mkdir -p "$RUNNER_TEMP/existing-release"
+              gh release download "$TAG" -D "$RUNNER_TEMP/existing-release" \
+                -p '*.whl' -p '*.tar.gz' -p 'SHA256SUMS'
+              for file in dist/*.whl dist/*.tar.gz dist/SHA256SUMS; do
+                cmp "$file" "$RUNNER_TEMP/existing-release/$(basename "$file")"
+              done
+              echo 'Published release already has the identical artifacts.'
+              exit 0
+            fi
+          else
+            gh release create "$TAG" --verify-tag --draft --title "RasterMoves $VERSION" --generate-notes
+          fi
+          gh release upload "$TAG" dist/*.whl dist/*.tar.gz dist/SHA256SUMS --clobber
+          gh release edit "$TAG" --draft=false --prerelease="$PRERELEASE"
+  ghcr:
+    needs: [prepare, checks]
+    if: needs.prepare.outputs.target == 'production'
+    runs-on: ubuntu-latest
+    timeout-minutes: 40
+    permissions:
+      contents: read
+      packages: write
+    outputs:
+      digest: ${{ steps.publish.outputs.digest }}
+    env:
+      IMAGE: ${{ needs.prepare.outputs.image }}
+      VERSION: ${{ needs.prepare.outputs.version }}
+      PRERELEASE: ${{ needs.prepare.outputs.prerelease }}
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          ref: ${{ needs.prepare.outputs.commit }}
+          persist-credentials: false
+      - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
+        with:
+          name: python-dist
+          path: dist/
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+      - name: Build CPU container from the tested wheel (not from PyPI)
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        with:
+          context: .
+          platforms: linux/amd64
+          load: true
+          push: false
+          tags: rastermoves:release-check
+          build-args: |
+            VERSION=${{ needs.prepare.outputs.version }}
+            REVISION=${{ needs.prepare.outputs.commit }}
+            SOURCE_URL=https://github.com/${{ github.repository }}
+          cache-from: type=gha,scope=rastermoves-cpu
+          cache-to: type=gha,mode=max,scope=rastermoves-cpu
+      - name: Smoke-test the image before pushing it
+        shell: bash
+        run: |
+          docker run --rm --network none rastermoves:release-check --version
+          docker run --rm --network none --entrypoint python \
+            -v "$PWD/scripts/smoke_installed.py:/tmp/smoke_installed.py:ro" \
+            rastermoves:release-check /tmp/smoke_installed.py --version "$VERSION" --runtimes
+      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+      - name: Push the exact smoke-tested image
+        id: publish
+        shell: bash
+        run: |
+          tags=("$VERSION" "$VERSION-cpu")
+          if [ "$PRERELEASE" = false ]; then tags+=(latest cpu); fi
+          for tag in "${tags[@]}"; do
+            docker tag rastermoves:release-check "$IMAGE:$tag"
+            docker push "$IMAGE:$tag"
+          done
+          REPO_DIGEST=$(docker inspect --format '{{index .RepoDigests 0}}' "$IMAGE:$VERSION")
+          DIGEST=${REPO_DIGEST##*@}
+          [[ "$DIGEST" =~ ^sha256:[a-f0-9]{64}$ ]]
+          echo "digest=$DIGEST" >> "$GITHUB_OUTPUT"
+          echo "Published $IMAGE@$DIGEST" >> "$GITHUB_STEP_SUMMARY"
+  dockerhub:
+    needs: [prepare, ghcr]
+    if: needs.prepare.outputs.target == 'production' && vars.DOCKERHUB_USERNAME != ''
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      packages: read
+    env:
+      VERSION: ${{ needs.prepare.outputs.version }}
+      PRERELEASE: ${{ needs.prepare.outputs.prerelease }}
+      SOURCE_IMAGE: ${{ needs.prepare.outputs.image }}@${{ needs.ghcr.outputs.digest }}
+      HUB_REPOSITORY: ${{ vars.DOCKERHUB_REPOSITORY || format('{0}/rastermoves', vars.DOCKERHUB_USERNAME) }}
+    steps:
+      - name: Check Docker Hub credentials and lowercase repository name
+        env:
+          HUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+        shell: bash
+        run: |
+          test -n "$HUB_TOKEN" || { echo 'Set DOCKERHUB_TOKEN or remove DOCKERHUB_USERNAME to disable the mirror.'; exit 1; }
+          [[ "$HUB_REPOSITORY" =~ ^[a-z0-9][a-z0-9_-]*/[a-z0-9][a-z0-9_.-]*$ ]]
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        with:
+          username: ${{ vars.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Mirror the GHCR digest without rebuilding
+        shell: bash
+        run: |
+          tags=(-t "docker.io/$HUB_REPOSITORY:$VERSION" -t "docker.io/$HUB_REPOSITORY:$VERSION-cpu")
+          if [ "$PRERELEASE" = false ]; then tags+=(-t "docker.io/$HUB_REPOSITORY:latest" -t "docker.io/$HUB_REPOSITORY:cpu"); fi
+          docker buildx imagetools create "${tags[@]}" "$SOURCE_IMAGE"
+  summary:
+    if: always()
+    needs: [prepare, checks, pypi, testpypi, github-release, ghcr, dockerhub]
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions: {}
+    steps:
+      - name: Show each destination's actual result
+        env:
+          JOBS: ${{ toJSON(needs) }}
+        run: |
+          python - <<'PY'
+          import json, os
+          with open(os.environ['GITHUB_STEP_SUMMARY'], 'a') as f:
+              f.write('## RasterMoves release results\n\n| Job | Result |\n|---|---|\n')
+              for name, info in json.loads(os.environ['JOBS']).items():
+                  f.write(f"| {name} | {info['result']} |\n")
+              f.write('\nSkipped optional destinations are not published. Re-run failed jobs after fixing configuration.\n')
+          PY

rastermoves-0.3.1/.github/workflows/tests.yml

@@ -0,0 +1,145 @@
+name: Tests
+on:
+  push:
+    branches: ['**']
+  pull_request:
+  workflow_dispatch:
+    inputs:
+      live_models:
+        description: Download and run real pretrained model smoke tests
+        type: boolean
+        default: false
+  workflow_call:
+    inputs:
+      ref:
+        description: Exact commit to test (release workflow supplies the tagged SHA)
+        type: string
+        default: ''
+      live_models:
+        type: boolean
+        default: false
+permissions:
+  contents: read
+jobs:
+  unit:
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest]
+        python: ['3.10', '3.11', '3.12', '3.13']
+        include:
+          - os: windows-latest
+            python: '3.12'
+          - os: macos-latest
+            python: '3.12'
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          ref: ${{ inputs.ref || github.sha }}
+          persist-credentials: false
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: ${{ matrix.python }}
+          cache: pip
+      - run: python -m pip install -e '.[dev]'
+      - run: python -m pytest -q
+  runtimes:
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          ref: ${{ inputs.ref || github.sha }}
+          persist-credentials: false
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: '3.12'
+          cache: pip
+      - run: python -m pip install torch torchvision --index-url https://download.pytorch.org/whl/cpu
+      - run: python -m pip install -e '.[torch,onnx,gdrive,dev]'
+      - run: python -m pip check
+      - run: python -m pytest -q
+        env:
+          OMP_NUM_THREADS: '2'
+          MKL_NUM_THREADS: '2'
+  refinement-runtime:
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          ref: ${{ inputs.ref || github.sha }}
+          persist-credentials: false
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: '3.12'
+          cache: pip
+      - run: python -m pip install torch torchvision --index-url https://download.pytorch.org/whl/cpu
+      - run: python -m pip install -e '.[refine,dev]'
+      - run: python -m pip check
+      - name: Exercise real SD1.5 and SDXL APIs with tiny random weights (no downloads)
+        run: python -m pytest -q tests/test_refinement_runtime.py
+        env:
+          RASTERMOVES_REQUIRE_DIFFUSERS: '1'
+          OMP_NUM_THREADS: '2'
+          MKL_NUM_THREADS: '2'
+  package:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          ref: ${{ inputs.ref || github.sha }}
+          persist-credentials: false
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: '3.12'
+          cache: pip
+      - run: python -m pip install -e '.[dev]'
+      - name: Build and validate distributable artifacts
+        shell: bash
+        run: |
+          echo "SOURCE_DATE_EPOCH=$(git show -s --format=%ct HEAD)" >> "$GITHUB_ENV"
+      - run: python -m build
+      - run: python scripts/release_tools.py dist --normalize
+      - run: python -m twine check --strict dist/*
+      - name: Smoke-test isolated wheel and source installations
+        shell: bash
+        run: |
+          VERSION=$(python -c 'import rastermoves; print(rastermoves.__version__)')
+          python -m venv "$RUNNER_TEMP/wheel-test"
+          WHEEL=$(find dist -maxdepth 1 -name '*.whl' -print -quit)
+          "$RUNNER_TEMP/wheel-test/bin/python" -m pip install "${WHEEL}[trace]"
+          cp scripts/smoke_installed.py "$RUNNER_TEMP/smoke_installed.py"
+          (cd "$RUNNER_TEMP" && ./wheel-test/bin/python smoke_installed.py --version "$VERSION" --trace)
+          python -m venv "$RUNNER_TEMP/sdist-test"
+          SDIST=$(find dist -maxdepth 1 -name '*.tar.gz' -print -quit)
+          "$RUNNER_TEMP/sdist-test/bin/python" -m pip install "${SDIST}[trace]"
+          (cd "$RUNNER_TEMP" && ./sdist-test/bin/python smoke_installed.py --version "$VERSION" --trace)
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: python-dist
+          path: dist/
+          if-no-files-found: error
+          retention-days: 14
+  live:
+    if: inputs.live_models == true
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          ref: ${{ inputs.ref || github.sha }}
+          persist-credentials: false
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: '3.12'
+      - run: python -m pip install torch torchvision --index-url https://download.pytorch.org/whl/cpu
+      - run: python -m pip install -e '.[torch,onnx,dev]'
+      - run: python -m pytest -q tests/test_live.py
+        env:
+          RASTERMOVES_LIVE: '1'
+          OMP_NUM_THREADS: '2'
+          MKL_NUM_THREADS: '2'

rastermoves-0.3.1/CHANGELOG.md

@@ -0,0 +1,86 @@
+# Changelog
+
+## 0.3.1 - 2026-10-08
+
+- Include the reviewed use-and-improve workflow, evaluation checklist and improvement-loop diagram.
+- Document mixed-runtime comparison recovery and clarify the current optional model routes.
+- No image-processing algorithm or default-model changes.
+
+## 0.3.0 — 2026-10-02
+
+- Add optional same-size SD1.5/SDXL ControlNet Tile img2img workflows, with pinned
+  Hugging Face component revisions, safe checkpoint loading and explicit offline prefetch.
+- Add `refiners`, `download-refiner`, standalone `refine`, and `upscale --refiner`.
+- Keep original upscaler plugins/defaults unchanged; the heavyweight `refine` extra
+  is separate from base, `all` and the published CPU container.
+- Use frozen-input spatial tiles, independent diffusion tile controls and coordinate-derived
+  seeds; report actual denoising steps instead of implying configured steps all execute.
+- Preserve lossless baselines, alpha and protected pixels; add outward mask feathering,
+  explicit blending and optional global RGB mean matching.
+- Add hash-verified resume, per-workflow journals, failure/interruption baseline retention,
+  output collision guards and explicit one-refiner all-model comparisons.
+- Extend stage traces with VAE encode/decode, denoising and compositing; record CUDA
+  allocator peaks when running the native CUDA refinement backend.
+- Add local refiner entry points, offline tests, optional random-weight Diffusers runtime
+  CI, opt-in pretrained smoke tests, and installed-artifact workflow smoke checks.
+- This is the first ControlNet Tile implementation, not MultiDiffusion/shared-latent
+  inference or a SeedVR2/VOSR/SUPIR restoration integration.
+
+## 0.2.1 — 2026-10-02
+
+- Add opt-in `--trace`, `--trace-file` and `--trace-interval` options for single-image,
+  batch, all-model and dry-run commands.
+- Stream Chrome JSON timelines with nested stage durations, process CPU seconds /
+  utilization, RSS/VMS and thread counters, plus system available-memory context.
+- Include per-model metrics in comparison summaries; preserve failure/interruption
+  traces, mark resumed results as reused rather than inventing new inference timings.
+- Distinguish download/cache verification, backend load, inference attempts (including
+  OOM retry markers), postprocessing, writes and cleanup.
+- Add a lazy optional `trace` dependency extra (`psutil`), also included in `all`/`dev`.
+- Never overwrite existing traces; choose numbered defaults on subsequent runs.
+- Add tracing documentation, regression tests and installed-artifact tracing smoke tests.
+- No model/plugin interface, checkpoint source, architecture or publication-credential changes.
+
+## 0.2.0 — 2026-10-02
+
+- Add `upscale --all-models -o DIRECTORY`, with `--sync-models` for the full
+  OpenModelDB catalogue and `--dry-run` to inspect the selection before downloading.
+- Process models sequentially with isolated failures, deterministic per-model
+  filenames, provenance sidecars and an incremental `summary.json`.
+- Add checksum-validated `--resume`, folder locking, explicit overwrite controls,
+  interruption recording and nonzero exit codes for incomplete comparisons.
+- Add tag-driven CI/CD for PyPI Trusted Publishing, GitHub Release assets/checksums,
+  GHCR CPU containers, optional TestPyPI rehearsals and optional Docker Hub mirroring.
+- Gate publication on Linux/Windows/macOS tests, optional-runtime tests, wheel/sdist
+  validation and isolated-install smoke checks; smoke-test containers before pushing.
+- Pin third-party Actions to verified commit SHAs and configure Dependabot updates.
+- Add version/tag guards, deterministic source archives, release documentation,
+  Dockerfile, and package/repository/author metadata.
+
+
+## 0.1.1 — 2026-10-02
+
+### RasterMoves rename
+
+- Rename the UpscaleLab distribution, executable, and Python package to `rastermoves`.
+- Identify RasterMoves as the image-upscaling component of the DanceFlow family.
+- Rename Python plugin entry-point groups to `rastermoves.models` and
+  `rastermoves.backends`; update imports, plugin documentation, and examples.
+- Rename environment variables to `RASTERMOVES_CACHE`, `RASTERMOVES_PLUGIN_PATH`,
+  `RASTERMOVES_OFFLINE`, and `RASTERMOVES_LIVE`.
+- Use RasterMoves-specific default cache/config directories, temporary output prefixes,
+  HTTP user agent, CLI help, diagnostics, and test workflow settings.
+- Include the tool name and version in JSON output provenance reports.
+- Add rename regression tests and a migration guide, including reuse of existing
+  downloaded weights without requiring another download.
+
+The eight bundled model definitions, model IDs, publisher checksums, source URLs,
+licences, supported backends, and image-processing options are unchanged. This is a
+local source/wheel release, not a publication to PyPI or GitHub. Legacy command/import
+aliases are not installed; see [MIGRATION.md](docs/MIGRATION.md).
+
+## 0.1.0 — 2026-10-02
+
+Initial implementation under the working name UpscaleLab: per-model JSON plugins,
+OpenModelDB catalogue import, automatic downloads and caching, Spandrel/PyTorch and
+ONNX adapters, tiled inference, CLI and Python API, and regression tests.

rastermoves-0.3.1/Dockerfile

@@ -0,0 +1,32 @@
+# Build a wheel first: python -m build. Release CI copies its tested wheel here.
+FROM python:3.12-slim-bookworm
+ARG VERSION=dev
+ARG REVISION=unknown
+ARG SOURCE_URL=https://github.com/kieransimkin/RasterMoves
+LABEL org.opencontainers.image.title="RasterMoves" \
+      org.opencontainers.image.description="Modular CPU image upscaling for DanceFlow" \
+      org.opencontainers.image.source="${SOURCE_URL}" \
+      org.opencontainers.image.version="${VERSION}" \
+      org.opencontainers.image.revision="${REVISION}" \
+      org.opencontainers.image.licenses="GPL-3.0-only"
+ENV PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PIP_NO_CACHE_DIR=1 \
+    RASTERMOVES_CACHE=/cache \
+    HF_HOME=/cache/huggingface \
+    OMP_NUM_THREADS=2 \
+    MKL_NUM_THREADS=2
+RUN apt-get update && apt-get install -y --no-install-recommends libgomp1 \
+    && rm -rf /var/lib/apt/lists/*
+COPY dist/*.whl /tmp/wheels/
+# Explicit CPU wheels prevent accidentally shipping multi-GB CUDA dependencies.
+RUN python -m pip install --index-url https://download.pytorch.org/whl/cpu 'torch>=2.6' 'torchvision>=0.21' \
+    && for wheel in /tmp/wheels/*.whl; do python -m pip install "${wheel}[all]"; done \
+    && python -m pip check \
+    && rm -rf /tmp/wheels \
+    && mkdir -p /cache /work \
+    && chown -R 10001:10001 /cache /work
+USER 10001:10001
+WORKDIR /work
+ENTRYPOINT ["rastermoves"]
+CMD ["--help"]