refactor: split packages and add release machinery

.env.example

@@ -0,0 +1 @@
+packages/deploy/src/lumilake_deploy/assets/.env.example

.github/PULL_REQUEST_TEMPLATE.md

@@ -19,8 +19,8 @@ Scope (optional): deploy, server, cli, runtime, docker, ...
 
 <!-- List modified files or groups of files with a brief explanation. -->
 <!--
-- `src/lumilake/cli/commands/deploy.py` — added `--since` flag to `deploy logs`
-- `src/lumilake/deploy/docker_client.py` — thread `since` through to docker-py
+- `packages/cli/src/lumilake_cli/commands/deploy.py` — added `--since` flag to `deploy logs`
+- `packages/deploy/src/lumilake_deploy/docker_client.py` — thread `since` through to docker-py
 - `tests/cli/test_deploy_impl.py` — cover the new flag
 -->
 

.github/workflows/check-pr-title.yml

@@ -22,6 +22,7 @@ jobs:
       - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
         with:
           version: "0.11.8"
+          python-version: "3.12"
       - name: Validate PR title
         env:
           PR_TITLE: ${{ github.event.pull_request.title }}

.github/workflows/env-examples.yml

@@ -33,9 +33,10 @@ jobs:
         uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
         with:
           version: "0.11.8"
+          python-version: "3.12"
 
       - name: Install dependencies
-        run: uv sync --frozen
+        run: uv sync --frozen --extra deploy
 
       - name: Verify env example files
         run: uv run scripts/dev/check_env_examples.py

.github/workflows/image-publish.yml

@@ -0,0 +1,176 @@
+name: Image Publish
+
+on:
+  push:
+    branches:
+      - main
+    tags:
+      - 'v*'
+    paths-ignore:
+      - '**.md'
+      - 'docs/**'
+  pull_request:
+    paths-ignore:
+      - '**.md'
+      - 'docs/**'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: mlsys-io/lumilake_server
+
+jobs:
+  build-pr:
+    name: Build image
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+        with:
+          persist-credentials: false
+
+      - name: Set up Buildx
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435  # v3.11.1
+
+      - name: Compute image tags
+        id: tags
+        env:
+          SHA: ${{ github.sha }}
+        run: |
+          set -eu
+          short_sha="${SHA::7}"
+          echo "tags=${REGISTRY}/${IMAGE_NAME}:pr-${short_sha}" >> "$GITHUB_OUTPUT"
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
+        with:
+          version: "0.11.8"
+          python-version: "3.12"
+          # No uv cache restore in a publishing workflow (cache-poisoning).
+          enable-cache: false
+
+      - name: Sync server requirements from uv.lock
+        run: uv run --frozen scripts/dev/sync_requirements.py --write
+
+      - name: Verify lockfile sync was a no-op
+        run: |
+          if ! git diff --quiet src/lumilake_server/requirements.txt; then
+            echo "src/lumilake_server/requirements.txt drifted from uv.lock." >&2
+            echo "Run: uv run scripts/dev/sync_requirements.py --write" >&2
+            git --no-pager diff src/lumilake_server/requirements.txt
+            exit 1
+          fi
+
+      - name: Build image
+        id: build
+        uses: docker/build-push-action@1dc73863535b631f98b2378be8619f83b136f4a0  # v6.17.0
+        with:
+          context: .
+          file: ./Dockerfile
+          push: false
+          tags: ${{ steps.tags.outputs.tags }}
+          provenance: false
+          build-args: |
+            BUILD_VERSION=${{ github.ref_name }}
+            BUILD_REF=${{ github.sha }}
+            BUILD_CREATED=${{ github.event.repository.updated_at }}
+
+  build-and-push:
+    name: Build and push multi-arch image
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write  # docker/login-action + build-push-action push to GHCR
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+        with:
+          persist-credentials: false
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392  # v3.6.0
+
+      - name: Set up Buildx
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435  # v3.11.1
+
+      - name: Log in to GHCR
+        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1  # v3.5.0
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Compute image tags
+        id: tags
+        env:
+          REF_NAME: ${{ github.ref_name }}
+          REF_TYPE: ${{ github.ref_type }}
+          SHA: ${{ github.sha }}
+        run: |
+          set -eu
+          short_sha="${SHA::7}"
+          tags=("${REGISTRY}/${IMAGE_NAME}:${short_sha}")
+          # :latest is owned by release-images.yml (gated on env approval).
+          if [[ "${REF_TYPE}" == "tag" && "${REF_NAME}" == v* ]]; then
+            tags+=("${REGISTRY}/${IMAGE_NAME}:${REF_NAME}")
+          elif [[ "${REF_NAME}" == "main" ]]; then
+            tags+=("${REGISTRY}/${IMAGE_NAME}:dev")
+          fi
+          ( IFS=,; echo "tags=${tags[*]}" ) >> "$GITHUB_OUTPUT"
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
+        with:
+          version: "0.11.8"
+          python-version: "3.12"
+          # No uv cache restore in a publishing workflow (cache-poisoning).
+          enable-cache: false
+
+      - name: Sync server requirements from uv.lock
+        run: uv run --frozen scripts/dev/sync_requirements.py --write
+
+      - name: Verify lockfile sync was a no-op
+        run: |
+          if ! git diff --quiet src/lumilake_server/requirements.txt; then
+            echo "src/lumilake_server/requirements.txt drifted from uv.lock." >&2
+            echo "Run: uv run scripts/dev/sync_requirements.py --write" >&2
+            git --no-pager diff src/lumilake_server/requirements.txt
+            exit 1
+          fi
+
+      - name: Build and push
+        id: build
+        uses: docker/build-push-action@1dc73863535b631f98b2378be8619f83b136f4a0  # v6.17.0
+        with:
+          context: .
+          file: ./Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.tags.outputs.tags }}
+          provenance: false
+          build-args: |
+            BUILD_VERSION=${{ github.ref_name }}
+            BUILD_REF=${{ github.sha }}
+            BUILD_CREATED=${{ github.event.repository.updated_at }}
+
+      - name: Smoke-test pushed image
+        env:
+          SHA: ${{ github.sha }}
+        run: |
+          set -eu
+          short_sha="${SHA:0:7}"
+          image="${REGISTRY}/${IMAGE_NAME}:${short_sha}"
+          # Plain imports only — routes/jobs.py module-load init needs S3/DB.
+          docker pull "$image"
+          docker run --rm --entrypoint /usr/bin/tini "$image" -- \
+            python -c "import lumilake, lumilake_hook, lumilake_server; print('image-smoke-ok')"

.github/workflows/lint-typecheck.yml

@@ -26,10 +26,12 @@ jobs:
       - name: Set up uv
         uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
         with:
+          version: "0.11.8"
           python-version: "3.12"
 
       - name: Install dependencies
-        run: uv sync --all-groups
+        # --all-extras: mypy needs every workspace wheel for cross-imports.
+        run: uv sync --frozen --all-extras --all-groups
 
       - name: Run pre-commit hooks
         run: uv run pre-commit run --all-files --show-diff-on-failure

.github/workflows/package-build.yml

@@ -21,7 +21,7 @@ concurrency:
 
 jobs:
   package-build:
-    name: Build and smoke-test package
+    name: Build and smoke-test packages
     runs-on: self-hosted
     steps:
       - name: Checkout
@@ -33,12 +33,16 @@ jobs:
         uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
         with:
           version: "0.11.8"
+          python-version: "3.12"
 
       - name: Install build environment
-        run: uv sync --all-groups --all-extras --frozen
+        run: uv sync --all-packages --all-extras --all-groups --frozen
 
       - name: Build distributions
-        run: uv build --out-dir dist
+        run: uv build --all-packages --out-dir dist
 
       - name: Verify distributions
         run: uv run scripts/ci/check_package_build.py --dist dist
+
+      - name: Check distribution metadata
+        run: uvx twine==6.2.0 check dist/*