ci: build the CLI release through turbo and narrow the release trigger

.github/workflows/cli-release-tag.yml

@@ -3,8 +3,12 @@ name: Tag CLI Release
 on:
   push:
     branches: [main]
+    # Only files that ship in the wheel or the binary cut a release. Negations must follow the positive pattern.
     paths:
       - 'packages/cli/**'
+      - '!packages/cli/tests/**'
+      - '!packages/cli/**.md'
+      - '!packages/cli/install.sh'
 
 permissions:
   contents: write
@@ -23,6 +27,7 @@ jobs:
         uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
         with:
           version: "0.12.15"
+          enable-cache: true
 
       - name: Bump patch version in packages/cli/pyproject.toml
         id: bump
@@ -55,26 +60,37 @@ jobs:
     with:
       tag: ${{ needs.bump.outputs.tag }}
 
+  # PyPI last: a version can never be re-uploaded, and the binaries can.
   publish-pypi:
-    needs: bump
+    needs: [bump, release]
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
         with:
           ref: ${{ needs.bump.outputs.tag }}
 
+      - name: Set up Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: 1.3.14
+
+      - name: Install Turborepo
+        run: bun install --frozen-lockfile
+
       - name: Set up uv
         uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
         with:
           version: "0.12.15"
+          enable-cache: true
 
       - name: Build sdist and wheel
-        run: uv build --package canyonos
+        run: bun run build --filter=canyonos
 
       - name: Publish to PyPI
         env:
           UV_PUBLISH_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
-        run: uv publish 'dist/canyonos-*'
+        run: uv publish --check-url https://pypi.org/simple/ 'dist/canyonos-*'
 
-# Calls cli-release.yml directly (a GITHUB_TOKEN tag push won't retrigger it); "[skip release]" is a defensive backstop against the same push looping.
+# Calls cli-release.yml directly (a GITHUB_TOKEN tag push won't retrigger it). "[skip release]" keeps the bump commit,
+# which edits packages/cli/pyproject.toml, from starting another bump.

.github/workflows/cli-release.yml

@@ -42,29 +42,27 @@ jobs:
         with:
           ref: ${{ inputs.tag || github.ref }}
 
+      - name: Set up Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: 1.3.14
+
+      - name: Install Turborepo
+        run: bun install --frozen-lockfile
+
       - name: Set up uv
         uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
         with:
           version: "0.12.15"
           enable-cache: true
 
-      # packages/cli has no env of its own: both commands target the workspace root .venv.
-      - name: Install workspace and Nuitka
-        run: |
-          uv sync --locked --package canyonos
-          uv pip install nuitka
+      # nuitka is in the non-default "release" group, so a plain uv sync skips it.
+      - name: Install the CLI and Nuitka
+        run: uv sync --locked --package canyonos --group release
 
+      # The task runs from packages/cli; arguments after "--" append to its command.
       - name: Build standalone binary
-        working-directory: packages/cli
-        run: |
-          uv run --no-sync python -m nuitka \
-            --mode=onefile \
-            --output-filename=${{ matrix.asset }} \
-            --output-dir=dist \
-            --include-data-file=canyonos/dashboard.compose.yml=canyonos/dashboard.compose.yml \
-            --include-distribution-metadata=canyonos \
-            --assume-yes-for-downloads \
-            cli.py
+        run: bun run build:binary --filter=canyonos -- --output-filename=${{ matrix.asset }}
 
       - name: Upload build artifact
         uses: actions/upload-artifact@v4

.github/workflows/core-image.yml

@@ -7,11 +7,15 @@ on:
   pull_request:
     paths:
       - 'packages/core/**'
+      - '!packages/core/tests/**'
+      - '!packages/core/**.md'
       - '.github/workflows/core-image.yml'
   push:
     branches: [main]
     paths:
       - 'packages/core/**'
+      - '!packages/core/tests/**'
+      - '!packages/core/**.md'
       - '.github/workflows/core-image.yml'
   workflow_dispatch:
 

package.json

@@ -14,7 +14,8 @@
     "check": "turbo run lint typecheck format:check",
     "format": "turbo run format",
     "test": "turbo run test",
-    "build": "turbo run build"
+    "build": "turbo run build",
+    "build:binary": "turbo run build:binary"
   },
   "devDependencies": {
     "turbo": "2.10.13"

packages/cli/pyproject.toml

@@ -31,3 +31,6 @@ canyonos = ["dashboard.compose.yml"]
 dev = [
     "pytest>=9.1.1",
 ]
+release = [
+    "nuitka==4.2.1",
+]

turbo.json

@@ -8,6 +8,23 @@
     "build": {
       "cache": true
     },
+    "canyonos#build:binary": {
+      "cache": false,
+      "command": [
+        "uv",
+        "run",
+        "--no-sync",
+        "python",
+        "-m",
+        "nuitka",
+        "--mode=onefile",
+        "--output-dir=dist",
+        "--include-data-file=canyonos/dashboard.compose.yml=canyonos/dashboard.compose.yml",
+        "--include-distribution-metadata=canyonos",
+        "--assume-yes-for-downloads",
+        "cli.py"
+      ]
+    },
     "canyonos-python#test": {
       "command": [
         "uv",