Previous attempt added `if: needs.release.result == 'success'` to
publish-python, publish-crate, and update-homebrew, expecting that
to break the transitive skip when sign-windows fails. It didn't.
GitHub Actions rule: an `if:` expression only overrides the implicit
"skip if any ancestor failed/cancelled" behavior when it includes
one of `always()`, `failure()`, or `cancelled()`. A bare expression
that doesn't reference any of those still gets the implicit skip
gate ANDed in.
Verified against the v0.9.28 retroactive workflow_dispatch run
(26470106767): release succeeded, downstream jobs still skipped
despite the new if. Re-adding `always()` to actually take effect.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The release job runs with `if: always()` so a sign-windows failure does
not block the GitHub release. But publish-python, publish-crate, and
update-homebrew only had `needs: release`, so GitHub Actions transitively
skipped them whenever any earlier job (like sign-windows) failed.
This is why the AlexsJones/homebrew-llmfit tap has been pinned to 0.9.23
since v0.9.24 (2026-05-12): five consecutive release runs failed at
sign-windows, which silently skipped the tap update each time.
Add `if: needs.release.result == 'success'` to break the transitive
skip. Also document both Homebrew install paths in README so users on
older macOS can pick the prebuilt-binary tap over the source-build
homebrew-core formula.
Refs #581
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Fixes Node.js 20 deprecation warning: actions will be forced to Node.js 24
by default on June 2nd, 2026.
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(python): scaffold in-repo PyPI packaging
Copied hatch_build.py, src/__init__.py, src/__main__.py, and tests/ from
the external llmfit-pypi repo into llmfit-python/. Created pyproject.toml
at the repo root (adapted from llmfit-pypi) with updated author, paths, and
non-standard source mapping for the gitignore-safe llmfit-python/src/ layout.
Created .github/workflows/pypi.yml to build and publish all 8 platform wheels
on tag push, mirroring the docker.yml trigger pattern.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(python): rewrite hatch_build.py to use in-repo binaries
hatch_build.py previously downloaded release binaries from GitHub at
wheel-build time, verifying SHA256 and fetching license via the GitHub
API (~267 lines). It now expects the pre-compiled binary to already
exist at target/<rust-target>/release/ and reads version and license
directly from Cargo.toml (~174 lines, no network calls).
This enables the new CI split in release.yml: each build matrix job
uploads its binary as a binary-<target> artifact, and a dedicated
publish-python job (ubuntu-latest only) downloads all of them and runs
uv build in a loop over platform tags before publishing to PyPI in a
single step. Wheel failures no longer block binary release assets.
Also removes the now-redundant standalone pypi.yml workflow, adds
license = "MIT" to Cargo.toml workspace.package, and relocates the
Python package source into src/llmfit/ to match hatch layout.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore: add Python gitignore entries
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore: add Python code quality Makefile targets
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(python): respect LLMFIT_PYTHON_PLATFORM_TAG in editable installs
When the env var is set, look in target/{rust_target}/release/ (via the
renamed _find_binary_for_target) rather than the default host-native
paths (_find_local_binary). Also splits py_target_from_env / py_target
in initialize so the editable branch reuses the already-read value.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* ci: add Python CI workflow and tighten Rust CI path filters
- Add python-ci.yml with cross-platform pytest job (gated on llmfit-python/
or pyproject.toml changes via dorny/paths-filter) and a lint/typecheck job
that also triggers on scripts/**/*.py changes
- Exclude llmfit-python/** from Rust CI path triggers
- Replace cryptic Cargo.*o* glob with explicit Cargo.{lock,toml}
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore: remove committed .pyc file from tracking
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore: normalise ruff lint exception comment formatting
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Ruff formatted these lines into one line
* Fix import ordering
* Move pyproject.toml and uv.lock into llmfit-python/
* Correct path to tested code
* Run checks without installing llmfit itself (which fails)
* chore: bump setup-python and setup-uv to latest versions
Upgrades actions/setup-python v5 → v6 and astral-sh/setup-uv v5 → v8.1.0
to resolve Node.js 20 deprecation warnings in CI.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Disallow setting LLMFIT_PYTHON_PLATFORM_TAG on an editable build
* Improve inline comments in binary selection logic
* Move binary version check out of selection logic
* Always check that binary file exists
* Check all binaries before building wheels
* Set the execute bit that was lost by GitHub Actions
* Python CI downloads latest release binary instead of rebuilding Rust
Replaces the cargo build steps in the test job with a download of the
latest release archive from GitHub Releases, verified via SHA256.
LLMFIT_VERSION is set to the downloaded release version so the wheel
build does not conflict with an unreleased Cargo.toml bump.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* publish-python: use release file downloads instead of GHA artifacts
Removes the binary artifact upload/download mechanism. publish-python
now depends on the release job (not build) and downloads each archive
directly from GitHub Releases, verifying its checksum inline via pipe
before extracting the binary and building the wheel.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Fix typo in ci.yml comment: worfklows -> workflows
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Accept optional v prefix in binary --version output
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Simplify BinaryNotFoundError to inherit only from LlmfitError
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Add fmt-check target; use in check instead of fmt
Avoids `make check` unexpectedly modifying files on disk.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Split up checksum file to work around * in sha file on Windows
* Fix Windows zip extraction in Python CI workflow
Use unzip instead of tar to extract .zip archives on Windows, since
Git Bash's tar does not support the zip format.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Make llmfit binary version visible in CI tests
* Prevent multiline echo-on-Windows weirdness
* Consolidate CI workflows and add path-based job gating
Merges python-ci.yml into ci.yml. Adds a changes job using
dorny/paths-filter to detect whether Rust or Python files changed,
then gates fmt/clippy/check/check-python jobs accordingly via
job-level if conditions.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Tell uv where the python project is
* Remove outdated sentence about LLMFIT_VERSION from docstring
* Run Python tests with debug binary in editable mode for max reuse with cargo test
* Control the working dir to control test discovery
* Run Python build system integration test when there are no Python changes
* Update comment
* Always run cargo build on macos
* Show contents of target/ (for debugging)
* Debug production of debug builds by cargo test
* Always run cargo build to get a debug build
* Only build debug binary for subsequent pytest
* Revert "Debug production of debug builds by cargo test"
This reverts commit c88158e5ae.
* Revert "Show contents of target/ (for debugging)"
This reverts commit 947cb39988.
* Update comment with corrected description of work reuse
* Move prerequisite debug build step above uv sync step
* fix(ci): use picomatch extglob to exclude llmfit-python from rust filter
The previous config used a leading-! entry (`!llmfit-python/**`) to try
to exclude the Python directory from the rust filter. In dorny/paths-filter's
default 'some' mode, each entry is OR-ed: a leading ! is passed to picomatch
as a pattern that matches anything *not* in llmfit-python/, but the positive
`llmfit-*/**` entry already matched, so the negation had no effect and
rust-changed was always true for Python-only PRs.
Replace the two entries with a single picomatch extglob pattern
`llmfit-!(python)/**`. The !(python) extglob is evaluated against the
segment between `llmfit-` and the path separator, so llmfit-python/ never
matches while all other llmfit-* directories do.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(python): add rust_integration pytest mark for Rust-triggered CI runs
Marks test_binary_runs with @pytest.mark.rust_integration so it runs
in CI when only Rust code has changed, replacing the uv sync --no-dev
integration test step.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* ci: add SignPath code signing for Windows builds
* ci: extract exe before signing to match SignPath PE artifact config
* ci: add SignPath Authenticode signing for Windows builds
- Add sign-windows job to release workflow
- Extract exe, submit to SignPath for signing, repackage into zip
- Release job proceeds even if signing is skipped
- Add SignPath signed badge and banner to README
Interpolating a secret into a shell command line:
cargo publish --token ${{ secrets.CARGO_REGISTRY_TOKEN }}
leaves the token visible in /proc/<pid>/cmdline and `ps` output for the
lifetime of the process. GitHub Actions secret masking redacts log
output only — it cannot scrub the kernel's process table.
cargo reads the CARGO_REGISTRY_TOKEN environment variable automatically;
the cargo book explicitly recommends this over --token for exactly this
reason. GitHub-hosted runners are ephemeral, but defense-in-depth costs
nothing here.
Co-Authored-By: gregkh_clanker_t1000
Switches the Release workflow trigger from `push: tags` to the GitHub
`release: published` event, and adds a `workflow_dispatch` input for
manual backfills of an existing tag.
release-please creates tags with GITHUB_TOKEN, which by design does not
trigger downstream workflows. That's why v0.9.4 shipped with only
release notes and no binary assets (#424), while v0.9.3 (tag pushed
manually) worked. Reacting to the `release` event published by
release-please fires the workflow reliably for future releases.
The workflow_dispatch path accepts an existing tag and routes it
through checkout, packaging, asset upload, and the Homebrew tap update
so v0.9.4 can be backfilled after this lands.
Fixes#424
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- add React/Vite llmfit-web dashboard with fit explorer and theme toggle
- embed built web assets into llmfit binary and serve from / with SPA fallback
- keep existing /api/v1 contracts and add CI/release build steps for web assets
- auto-launch local dashboard for non-serve commands while preserving explicit serve mode
- Standardize SHA256 checksum file format using awk in release.yml
- Remove redundant --locked flag from cross install (pinned version is sufficient)
- Add --max-time 10 to checksum curl download in install.sh
- Log invalid URL value in OLLAMA_HOST and MLX_LM_HOST warnings
- Pin cross to crates.io v0.2.5 instead of installing from git HEAD,
preventing supply chain risk from unreviewed upstream commits
- Validate http/https scheme on OLLAMA_HOST and MLX_LM_HOST env vars
before use, falling back to localhost defaults on invalid input
- Sync tauri.conf.json version to workspace version 0.4.8
Generate a per-asset .sha256 file during the release build and publish
it alongside each tarball/zip on GitHub Releases. The installer now
downloads and verifies the checksum before extracting, aborting with a
clear error on mismatch. Supports sha256sum (Linux) and shasum (macOS);
gracefully skips the check for older releases that predate this change.
- Publish llmfit-core first (dependency)
- Wait for crates.io index to update
- Then publish llmfit (depends on llmfit-core)
Signed-off-by: Three Foxes (in a Trenchcoat) <threefoxesyes3inatrenchcoat@gmail.com>
- release.yml now excludes v*-mac tags (CLI + crate + homebrew only)
- New release-desktop.yml triggers on v*-mac tags
- Uses --bundles app to produce .app bundle without code signing
- Searches both target/ and llmfit-desktop/target/ for bundle
- Desktop releases no longer slow down normal CLI releases
Signed-off-by: Three Foxes (in a Trenchcoat) <threefoxesyes3inatrenchcoat@gmail.com>
The Tauri build runs with working-directory: llmfit-desktop but
the workspace target dir may be at the repo root or under the
subcrate. Search both locations and fail with diagnostics if
neither contains the bundle.
Signed-off-by: Three Foxes (in a Trenchcoat) <threefoxesyes3inatrenchcoat@gmail.com>
Adds build-desktop job that builds Tauri desktop app for both
aarch64-apple-darwin and x86_64-apple-darwin targets.
DMGs are uploaded alongside CLI tarballs in GitHub Releases.
Signed-off-by: Three Foxes (in a Trenchcoat) <threefoxesyes3inatrenchcoat@gmail.com>
