roomkit-ui 0.3.0__tar.gz

roomkit_ui-0.3.0/.github/workflows/build.yml

@@ -0,0 +1,427 @@
+name: Build
+
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  ci:
+    name: CI
+    uses: ./.github/workflows/ci.yml
+    permissions:
+      contents: read
+
+  # Info.plist takes its version from pyproject.toml, the release and the cask
+  # from the tag: a mismatch ships an app that reports another version than
+  # the one it is released as. Release to PyPI runs the same check.
+  version:
+    name: Check the tag matches the project version
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v4
+
+      - name: Compare
+        if: startsWith(github.ref, 'refs/tags/')
+        run: |
+          project_version=$(uv version --short)
+          tag_version="${GITHUB_REF_NAME#v}"
+          if [ "$project_version" != "$tag_version" ]; then
+            echo "::error::tag $GITHUB_REF_NAME does not match pyproject version $project_version"
+            exit 1
+          fi
+
+  build:
+    needs: [ci, version]
+    strategy:
+      matrix:
+        include:
+          - os: macos-latest
+            artifact: RoomKit-UI-macOS
+          - os: ubuntu-latest
+            artifact: RoomKit-UI-Linux
+          - os: windows-latest
+            artifact: RoomKit-UI-Windows
+
+    runs-on: ${{ matrix.os }}
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: astral-sh/setup-uv@v4
+        with:
+          version: "latest"
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      # Linux: install system deps
+      - name: Install system dependencies (Linux)
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libportaudio2 libasound2-dev libgl1 librsvg2-bin
+
+      # macOS: install rsvg-convert for icon generation
+      - name: Install system dependencies (macOS)
+        if: runner.os == 'macOS'
+        run: brew install librsvg
+
+      # macOS: import Developer ID certificate for code signing
+      # Required secrets:
+      #   MACOS_CERTIFICATE_P12_BASE64 — base64-encoded .p12 certificate
+      #   MACOS_CERTIFICATE_PASSWORD   — password for the .p12 file
+      #   APPLE_ID                     — Apple ID email (notarization)
+      #   APPLE_APP_PASSWORD           — app-specific password (notarization)
+      #   APPLE_TEAM_ID                — 10-char Developer Team ID
+      - name: Import code signing certificate (macOS)
+        if: runner.os == 'macOS' && env.MACOS_CERTIFICATE_P12_BASE64 != ''
+        env:
+          MACOS_CERTIFICATE_P12_BASE64: ${{ secrets.MACOS_CERTIFICATE_P12_BASE64 }}
+          MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
+        run: |
+          CERT_FILE=$(mktemp /tmp/certificate.XXXXXX.p12)
+          echo "$MACOS_CERTIFICATE_P12_BASE64" | base64 --decode > "$CERT_FILE"
+          KEYCHAIN="build.keychain-db"
+          KEYCHAIN_PASSWORD="$(openssl rand -hex 16)"
+          security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN"
+          security set-keychain-settings -lut 21600 "$KEYCHAIN"
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN"
+          security import "$CERT_FILE" -k "$KEYCHAIN" -P "$MACOS_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
+          security set-key-partition-list -S apple-tool:,apple: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN"
+          security list-keychains -d user -s "$KEYCHAIN" $(security list-keychains -d user | tr -d '"')
+          rm -f "$CERT_FILE"
+          # Extract identity name for codesign
+          IDENTITY=$(security find-identity -v -p codesigning "$KEYCHAIN" | head -1 | sed 's/.*"\(.*\)".*/\1/')
+          echo "CODESIGN_IDENTITY=$IDENTITY" >> "$GITHUB_ENV"
+          echo "BUILD_KEYCHAIN=$KEYCHAIN" >> "$GITHUB_ENV"
+
+      # Windows: install cairo for icon generation (fallback)
+      - name: Install system dependencies (Windows)
+        if: runner.os == 'Windows'
+        run: choco install cairo -y --no-progress
+        continue-on-error: true
+
+      # `--extra all` is load-bearing: the base install is now core-only, and a
+      # bare `uv sync` would ship a bundle with no providers at all.  smart-turn
+      # is added on top (no torch); it excludes qwen3-tts and neutts (conflicting
+      # transformers pins, see [tool.uv].conflicts), which stay out with
+      # pocket-tts — the three would add several GB of torch.
+      - name: Install Python dependencies
+        run: |
+          uv sync --extra all --extra smart-turn
+          uv pip install pyinstaller Pillow cairosvg
+
+      # Generate app icons from SVG
+      - name: Generate icons
+        run: uv run python scripts/generate_icons.py
+
+      # macOS / Linux. The PyInstaller flags here, in the Windows step and in
+      # scripts/build_app.sh must match: tests/test_build_flags.py fails when
+      # they drift. --collect-binaries=aec_audio_processing is the one with no
+      # import behind it: the package loads its WebRTC library by path.
+      - name: Build (Unix)
+        if: runner.os != 'Windows'
+        run: |
+          SEP=":"
+          EXTRA_ARGS=""
+          ICON_ARG=""
+          if [ "$RUNNER_OS" = "macOS" ]; then
+            EXTRA_ARGS="--windowed"
+            if [ -f assets/icon.icns ]; then
+              ICON_ARG="--icon=assets/icon.icns"
+            fi
+          else
+            if [ -f assets/icon.png ]; then
+              ICON_ARG="--icon=assets/icon.png"
+            fi
+          fi
+          uv run pyinstaller \
+            --name "RoomKit UI" \
+            --noconfirm \
+            --clean \
+            $EXTRA_ARGS \
+            $ICON_ARG \
+            --collect-submodules=roomkit \
+            --collect-submodules=roomkit_ui \
+            --copy-metadata=roomkit-ui \
+            --copy-metadata=roomkit \
+            --hidden-import=google.genai \
+            --hidden-import=google.genai.live \
+            --hidden-import=openai \
+            --hidden-import=anthropic \
+            --hidden-import=deepgram \
+            --hidden-import=elevenlabs \
+            --hidden-import=gradium \
+            --hidden-import=websockets \
+            --hidden-import=tiktoken_ext \
+            --hidden-import=tiktoken_ext.openai_public \
+            --hidden-import=sounddevice \
+            --hidden-import=_sounddevice_data \
+            --hidden-import=certifi \
+            --hidden-import=aec_audio_processing \
+            --collect-binaries=aec_audio_processing \
+            --collect-binaries=sherpa_onnx \
+            --hidden-import=sherpa_onnx \
+            --collect-binaries=onnxruntime \
+            --hidden-import=onnxruntime \
+            --hidden-import=onnxruntime.capi._pybind_state \
+            --hidden-import=transformers.models.whisper.feature_extraction_whisper \
+            --hidden-import=transformers.feature_extraction_sequence_utils \
+            --hidden-import=transformers.audio_utils \
+            --hidden-import=pynput \
+            --hidden-import=pynput.keyboard \
+            --hidden-import=pynput.keyboard._darwin \
+            --add-data "src/roomkit_ui${SEP}roomkit_ui" \
+            src/roomkit_ui/__main__.py
+
+      # macOS: patch Info.plist, sign (proper or ad-hoc), and notarize
+      - name: Sign and patch (macOS)
+        if: runner.os == 'macOS'
+        env:
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_PASSWORD: ${{ secrets.APPLE_APP_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+        run: |
+          APP="dist/RoomKit UI.app"
+          PLIST="$APP/Contents/Info.plist"
+          /usr/libexec/PlistBuddy -c \
+            "Add :NSMicrophoneUsageDescription string 'RoomKit UI needs microphone access for voice conversations.'" \
+            "$PLIST" 2>/dev/null || true
+          /usr/libexec/PlistBuddy -c \
+            "Add :NSCameraUsageDescription string 'RoomKit UI uses your camera to take a photo you can attach to a message.'" \
+            "$PLIST" 2>/dev/null || true
+
+          # PyInstaller leaves the identifier unset and the version at 0.0.0.
+          # `build_app.sh` patched the identifier for local builds, so the
+          # released app was the one without it — and the cask's `uninstall
+          # quit:` needs a stable identifier to close a running copy before an
+          # upgrade. Must run before codesign: editing Info.plist afterwards
+          # invalidates the signature.
+          VERSION=$(uv version --short)
+          /usr/libexec/PlistBuddy -c "Set :CFBundleIdentifier com.roomkit.ui" "$PLIST" 2>/dev/null \
+            || /usr/libexec/PlistBuddy -c "Add :CFBundleIdentifier string com.roomkit.ui" "$PLIST"
+          /usr/libexec/PlistBuddy -c "Set :CFBundleShortVersionString $VERSION" "$PLIST" 2>/dev/null \
+            || /usr/libexec/PlistBuddy -c "Add :CFBundleShortVersionString string $VERSION" "$PLIST"
+          /usr/libexec/PlistBuddy -c "Set :CFBundleVersion $VERSION" "$PLIST" 2>/dev/null \
+            || /usr/libexec/PlistBuddy -c "Add :CFBundleVersion string $VERSION" "$PLIST"
+          echo "==> Bundle: com.roomkit.ui $VERSION"
+
+          if [ -n "${CODESIGN_IDENTITY:-}" ]; then
+            echo "==> Signing with: $CODESIGN_IDENTITY"
+            # Sign bundled shared libraries
+            find "$APP/Contents/Frameworks" -type f \( -name '*.so' -o -name '*.dylib' \) | while read -r lib; do
+              codesign --force --options runtime --entitlements entitlements.plist \
+                --sign "$CODESIGN_IDENTITY" "$lib"
+            done
+            # Sign main executable and app bundle
+            codesign --force --options runtime --entitlements entitlements.plist \
+              --sign "$CODESIGN_IDENTITY" "$APP/Contents/MacOS/RoomKit UI"
+            codesign --force --options runtime --entitlements entitlements.plist \
+              --sign "$CODESIGN_IDENTITY" "$APP"
+            codesign --verify --deep --strict "$APP"
+            echo "==> Signature verified"
+
+            # Notarize if credentials are available
+            if [ -n "${APPLE_ID:-}" ] && [ -n "${APPLE_PASSWORD:-}" ] && [ -n "${APPLE_TEAM_ID:-}" ]; then
+              echo "==> Notarizing..."
+              ZIP_PATH="dist/RoomKit UI-notarize.zip"
+              ditto -c -k --keepParent "$APP" "$ZIP_PATH"
+              xcrun notarytool submit "$ZIP_PATH" \
+                --apple-id "$APPLE_ID" \
+                --password "$APPLE_PASSWORD" \
+                --team-id "$APPLE_TEAM_ID" \
+                --wait
+              rm -f "$ZIP_PATH"
+              xcrun stapler staple "$APP"
+              echo "==> Notarization complete"
+            fi
+          else
+            echo "==> Ad-hoc signing (no certificate configured)"
+            codesign --force --deep --sign - "$APP"
+          fi
+
+      # Windows
+      - name: Build (Windows)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          $iconArg = ""
+          if (Test-Path "assets/icon.ico") { $iconArg = "--icon=assets/icon.ico" }
+          $args = @(
+            "--name", "RoomKit UI",
+            "--noconfirm",
+            "--clean",
+            "--windowed"
+          )
+          if ($iconArg) { $args += $iconArg }
+          $args += @(
+            "--collect-submodules=roomkit",
+            "--collect-submodules=roomkit_ui",
+            "--copy-metadata=roomkit-ui",
+            "--copy-metadata=roomkit",
+            "--hidden-import=google.genai",
+            "--hidden-import=google.genai.live",
+            "--hidden-import=openai",
+            "--hidden-import=anthropic",
+            "--hidden-import=deepgram",
+            "--hidden-import=elevenlabs",
+            "--hidden-import=gradium",
+            "--hidden-import=websockets",
+            "--hidden-import=tiktoken_ext",
+            "--hidden-import=tiktoken_ext.openai_public",
+            "--hidden-import=sounddevice",
+            "--hidden-import=_sounddevice_data",
+            "--hidden-import=certifi",
+            "--hidden-import=aec_audio_processing",
+            "--collect-binaries=aec_audio_processing",
+            "--collect-binaries=sherpa_onnx",
+            "--hidden-import=sherpa_onnx",
+            "--collect-binaries=onnxruntime",
+            "--hidden-import=onnxruntime",
+            "--hidden-import=onnxruntime.capi._pybind_state",
+            "--hidden-import=transformers.models.whisper.feature_extraction_whisper",
+            "--hidden-import=transformers.feature_extraction_sequence_utils",
+            "--hidden-import=transformers.audio_utils",
+            "--hidden-import=pynput",
+            "--hidden-import=pynput.keyboard",
+            "--hidden-import=pynput.keyboard._darwin",
+            "--add-data", "src/roomkit_ui;roomkit_ui",
+            "src/roomkit_ui/__main__.py"
+          )
+          uv run pyinstaller @args
+
+      # Package artifacts
+      - name: Archive (macOS)
+        if: runner.os == 'macOS'
+        run: |
+          DMG_PATH="dist/${{ matrix.artifact }}.dmg"
+          # hdiutil intermittently fails with "Resource busy" on GitHub
+          # runners (Spotlight/XProtect scanning the fresh .app) — retry.
+          for i in 1 2 3 4 5; do
+            if hdiutil create -volname "RoomKit UI" -srcfolder "dist/RoomKit UI.app" \
+              -ov -format UDZO "$DMG_PATH"; then
+              break
+            fi
+            if [ "$i" = "5" ]; then
+              echo "hdiutil failed after 5 attempts" >&2
+              exit 1
+            fi
+            echo "hdiutil attempt $i failed — retrying in 15s"
+            sleep 15
+          done
+          # Staple notarization ticket to DMG if signed
+          if [ -n "${CODESIGN_IDENTITY:-}" ] && [ -n "${{ secrets.APPLE_ID }}" ]; then
+            xcrun stapler staple "$DMG_PATH" || true
+          fi
+
+      - name: Archive (Linux)
+        if: runner.os == 'Linux'
+        run: |
+          cd dist
+          tar czf "${{ matrix.artifact }}.tar.gz" "RoomKit UI"
+
+      - name: Archive (Windows)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          Compress-Archive -Path "dist/RoomKit UI" -DestinationPath "dist/${{ matrix.artifact }}.zip"
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.artifact }}
+          path: |
+            dist/${{ matrix.artifact }}.dmg
+            dist/${{ matrix.artifact }}.zip
+            dist/${{ matrix.artifact }}.tar.gz
+
+      # Attach to release when triggered by a tag
+      - name: Upload to release
+        if: startsWith(github.ref, 'refs/tags/')
+        uses: softprops/action-gh-release@v2
+        with:
+          files: |
+            dist/${{ matrix.artifact }}.dmg
+            dist/${{ matrix.artifact }}.zip
+            dist/${{ matrix.artifact }}.tar.gz
+
+      # Clean up temporary keychain
+      - name: Clean up keychain (macOS)
+        if: always() && runner.os == 'macOS' && env.BUILD_KEYCHAIN != ''
+        run: security delete-keychain "$BUILD_KEYCHAIN"
+
+  # Homebrew reads casks from a repository named `homebrew-<tap>`, so the cask
+  # cannot live here. This copies it into roomkit-live/homebrew-tap with the
+  # released DMG's version and checksum, which is what makes
+  # `brew install --cask roomkit-live/tap/roomkit-ui` resolve.
+  homebrew:
+    name: Update Homebrew cask
+    needs: build
+    if: startsWith(github.ref, 'refs/tags/')
+    # macOS, for stapler: see "Require a notarized app".
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      # The same bytes the release serves: the artifact is uploaded after the
+      # notarization ticket is stapled, so its checksum matches the asset.
+      - uses: actions/download-artifact@v4
+        with:
+          name: RoomKit-UI-macOS
+          path: artifact
+
+      # Without the Apple secrets the build only signs ad hoc, and Gatekeeper
+      # refuses that app; a cask user never gets the right-click "Open" a
+      # download offers. Publish the cask only for an app carrying a stapled
+      # notarization ticket. The DMG still goes to the release page.
+      - name: Require a notarized app
+        id: notarized
+        run: |
+          MOUNT=$(mktemp -d)
+          hdiutil attach -nobrowse -readonly -mountpoint "$MOUNT" artifact/RoomKit-UI-macOS.dmg
+          if xcrun stapler validate "$MOUNT/RoomKit UI.app"; then
+            echo "ok=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "::warning::The macOS app is not notarized — cask not published."
+          fi
+          hdiutil detach "$MOUNT"
+
+      - name: Stamp the cask with this release
+        if: steps.notarized.outputs.ok == 'true'
+        run: |
+          VERSION="${GITHUB_REF_NAME#v}"
+          SHA=$(shasum -a 256 "artifact/RoomKit-UI-macOS.dmg" | cut -d' ' -f1)
+          CASK=packaging/homebrew/roomkit-ui.rb
+          sed -i '' -E "s|^  version \".*\"$|  version \"${VERSION}\"|" "$CASK"
+          sed -i '' -E "s|^  sha256 \".*\"$|  sha256 \"${SHA}\"|" "$CASK"
+          grep -E '^  (version|sha256) ' "$CASK"
+
+      - name: Push to the tap
+        if: steps.notarized.outputs.ok == 'true'
+        env:
+          TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
+        run: |
+          if [ -z "$TAP_TOKEN" ]; then
+            echo "::warning::HOMEBREW_TAP_TOKEN is not set — cask not published."
+            echo "Create roomkit-live/homebrew-tap and add the secret to enable this."
+            exit 0
+          fi
+          git clone --depth 1 \
+            "https://x-access-token:${TAP_TOKEN}@github.com/roomkit-live/homebrew-tap.git" tap
+          mkdir -p tap/Casks
+          cp packaging/homebrew/roomkit-ui.rb tap/Casks/roomkit-ui.rb
+          cd tap
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add Casks/roomkit-ui.rb
+          git diff --staged --quiet && echo "cask unchanged" && exit 0
+          git commit -m "roomkit-ui ${GITHUB_REF_NAME#v}"
+          git push

roomkit_ui-0.3.0/.github/workflows/ci.yml

@@ -0,0 +1,107 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  # Build and Release to PyPI call this first: a tag push runs neither of the
+  # triggers above, and nothing should ship from a commit these checks reject.
+  workflow_call:
+
+jobs:
+  # Lint, security scan and type check share one environment: each needs the
+  # full `uv sync --extra dev` (the locked ruff and bandit, and mypy run
+  # against roomkit's real types), so syncing once beats syncing three times.
+  checks:
+    name: Lint, security, types
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v4
+        with:
+          enable-cache: true
+
+      - name: Set up Python
+        run: uv python install 3.12
+
+      - name: Install dependencies
+        run: uv sync --extra dev
+
+      # The locked ruff, not whatever uvx resolves today: a new release adds
+      # rules and reformats code, and CI would disagree with "uv run ruff".
+      - name: Ruff check
+        run: uv run ruff check .
+
+      - name: Ruff format check
+        run: uv run ruff format --check .
+
+      - name: Bandit
+        run: uv run bandit -r src/ -c pyproject.toml
+
+      # mypy runs in the project environment. Outside it, roomkit and the
+      # backend SDKs resolve to Any (pyproject ignores their missing imports),
+      # so no call into them is checked, and numpy is not found at all.
+      - name: Mypy
+        run: uv run mypy src/
+
+  test:
+    name: Tests
+    runs-on: ubuntu-latest
+    env:
+      QT_QPA_PLATFORM: offscreen
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v4
+        with:
+          enable-cache: true
+
+      - name: Set up Python
+        run: uv python install 3.12
+
+      - name: Install Qt/audio system libraries
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libegl1 libgl1 libxkbcommon0 libdbus-1-3 libportaudio2 libpulse0
+
+      - name: Install dependencies
+        run: uv sync --extra dev
+
+      - name: Pytest
+        run: uv run pytest -v
+
+  # Every other job runs on Linux, where a Unix-only module imports fine and a
+  # release ships to Windows unexecuted. Importing the entry point is the first
+  # thing the packaged .exe does, and the cheapest place to catch that.
+  windows-import:
+    name: Windows import
+    runs-on: windows-latest
+    env:
+      QT_QPA_PLATFORM: offscreen
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v4
+        with:
+          enable-cache: true
+
+      - name: Set up Python
+        run: uv python install 3.12
+
+      # Deliberately bare: this installs the core only, so the job doubles as
+      # the check that the app still starts with every backend extra absent.
+      - name: Install dependencies
+        run: uv sync
+
+      - name: Import the app
+        run: uv run python -c "import roomkit_ui.app"
+
+      # Exercises every feature probe. A typo in features.py that raises on a
+      # missing module would take the whole app down on a core install.
+      - name: Report available features
+        run: uv run roomkit-ui --doctor

roomkit_ui-0.3.0/.github/workflows/release.yml

@@ -0,0 +1,102 @@
+name: Release to PyPI
+
+# Shares the `v*` tag with the Build workflow: one tag ships both the desktop
+# bundles and the wheel. Uses PyPI Trusted Publishing (OIDC) — no API token
+# lives in this repository's secrets.
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+    inputs:
+      repository:
+        description: "Where to publish"
+        type: choice
+        options: [testpypi, pypi]
+        default: testpypi
+
+jobs:
+  ci:
+    name: CI
+    uses: ./.github/workflows/ci.yml
+    permissions:
+      contents: read
+
+  build:
+    name: Build distributions
+    needs: ci
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v4
+
+      # A tag that disagrees with pyproject.toml publishes a version nobody
+      # can reproduce from the repository, and PyPI accepts it silently.
+      - name: Check the tag matches the project version
+        if: startsWith(github.ref, 'refs/tags/')
+        run: |
+          project_version=$(uv version --short)
+          tag_version="${GITHUB_REF_NAME#v}"
+          if [ "$project_version" != "$tag_version" ]; then
+            echo "::error::tag $GITHUB_REF_NAME does not match pyproject version $project_version"
+            exit 1
+          fi
+          echo "Publishing version $project_version"
+
+      # The wheel must resolve roomkit from PyPI. A local path source is a
+      # development convenience that would make the release unbuildable for
+      # anyone else, so refuse rather than ship it.
+      - name: Refuse a local dependency source
+        run: |
+          if grep -q '^\[tool\.uv\.sources\]' pyproject.toml; then
+            echo "::error::[tool.uv.sources] is present — remove it before releasing"
+            exit 1
+          fi
+
+      - name: Build sdist and wheel
+        run: uv build
+
+      # The libraries Qt and PortAudio load, as CI installs them: without
+      # libEGL, importing PySide6.QtGui fails before --doctor can answer.
+      - name: Install the system libraries the app loads
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libegl1 libgl1 libxkbcommon0 libdbus-1-3 libportaudio2 libpulse0
+
+      # Catches a wheel whose declared extras do not resolve — the failure mode
+      # this package is most exposed to, since every backend rides an extra.
+      - name: Install the built wheel with every extra
+        run: |
+          uv venv /tmp/verify
+          VIRTUAL_ENV=/tmp/verify uv pip install "$(ls dist/*.whl)[all]"
+          VIRTUAL_ENV=/tmp/verify QT_QPA_PLATFORM=offscreen /tmp/verify/bin/roomkit-ui --doctor
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: distributions
+          path: dist/
+
+  publish:
+    name: Publish
+    needs: build
+    runs-on: ubuntu-latest
+    # Trusted Publishing mints a short-lived token from this job's OIDC
+    # identity. The environment name must match the publisher configured on
+    # PyPI, or the upload is rejected.
+    environment: ${{ github.event.inputs.repository || 'pypi' }}
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: distributions
+          path: dist/
+
+      - name: Publish
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: >-
+            ${{ github.event.inputs.repository == 'testpypi'
+                && 'https://test.pypi.org/legacy/'
+                || 'https://upload.pypi.org/legacy/' }}

roomkit_ui-0.3.0/.gitignore

@@ -0,0 +1,15 @@
+__pycache__/
+*.pyc
+*.pyo
+.venv/
+dist/
+build/
+*.egg-info/
+.eggs/
+*.app
+*.dmg
+*.spec
+.DS_Store
+*.log
+.env
+tasks/