feat(ci): add CI and release automation

.github/actionlint.yaml

@@ -0,0 +1,6 @@
+self-hosted-runner:
+  labels:
+    - blacksmith-2vcpu-ubuntu-2404
+    - blacksmith-4vcpu-ubuntu-2404
+    - blacksmith-8vcpu-ubuntu-2404
+    - blacksmith-16vcpu-ubuntu-2404

.github/release-matrix.json

@@ -0,0 +1,8 @@
+{
+  "bundles": ["default", "ctranslate2", "sglang", "transformers5"],
+  "platforms": ["cuda12", "cpu"],
+  "include": [
+    { "platform": "cuda13", "bundle": "sglang-cu130" },
+    { "platform": "cuda13", "bundle": "tensorrt-llm" }
+  ]
+}

.github/workflows/ci.yml

@@ -0,0 +1,241 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  policy:
+    name: CI / Policy
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          persist-credentials: false
+      - uses: jdx/mise-action@c37c93293d6b742fc901e1406b8f764f6fb19dac # v2
+        with:
+          cache: false
+      - run: >-
+          mise exec -- uv run --frozen --project . pytest -q
+          tools/ci/tests/test_required_ci.py tools/ci/tests/test_public_tree.py
+      - run: mise exec -- python tools/ci/check_public_tree.py
+      - run: >-
+          mise exec -- actionlint
+          -ignore '^unexpected key "queue" for "concurrency" section\. expected one of "cancel-in-progress", "group"$'
+
+  bootstrap:
+    name: CI / Fresh bootstrap
+    runs-on: blacksmith-8vcpu-ubuntu-2404
+    timeout-minutes: 60
+    env:
+      UV_NO_CACHE: "1"
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          persist-credentials: false
+      - uses: jdx/mise-action@c37c93293d6b742fc901e1406b8f764f6fb19dac # v2
+        with:
+          cache: false
+          install: false
+      - run: bash tools/ci/fresh_bootstrap.bash
+
+  python:
+    name: CI / Python
+    runs-on: blacksmith-8vcpu-ubuntu-2404
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          persist-credentials: false
+      - uses: jdx/mise-action@c37c93293d6b742fc901e1406b8f764f6fb19dac # v2
+        with:
+          cache: false
+      - run: mise exec -- uv lock --check --project .
+      - run: mise run sync
+      - run: mise run lint
+      - run: mise run typecheck
+      - name: Offline public unit tests
+        env:
+          HF_HUB_OFFLINE: "1"
+          TRANSFORMERS_OFFLINE: "1"
+        run: mise run test
+      - run: mise run test-integrations -- --python-only
+      - name: Public tooling syntax and tests
+        run: |
+          mise exec -- uv run --frozen --project . --no-sync ruff format --check tools/ci
+          mise exec -- uv run --frozen --project . --no-sync ruff check --select E,F,I,UP,B tools/ci
+          mise exec -- uv run --frozen --project . --no-sync ruff check --select E9,F63,F7,F82 tools/mise_tasks
+          mise exec -- uv run --frozen --project . --no-sync pytest -q tools/ci/tests --ignore tools/ci/tests/test_required_ci.py --ignore tools/ci/tests/test_public_tree.py
+
+  typescript:
+    name: CI / TypeScript
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          persist-credentials: false
+      - uses: jdx/mise-action@c37c93293d6b742fc901e1406b8f764f6fb19dac # v2
+        with:
+          cache: false
+      - run: mise exec -- pnpm install --frozen-lockfile
+      - run: mise run ts -- build
+      - run: mise run ts -- typecheck
+      - run: mise run ts -- lint
+      - run: mise run ts -- test
+
+  rust:
+    name: CI / Rust
+    runs-on: blacksmith-8vcpu-ubuntu-2404
+    timeout-minutes: 90
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          persist-credentials: false
+      - uses: jdx/mise-action@c37c93293d6b742fc901e1406b8f764f6fb19dac # v2
+        with:
+          cache: false
+      - run: mise run sync
+      - run: mise run rust-fmt -- --check
+      - run: mise run rust-check
+      - run: mise run rust-clippy
+      - run: mise run gateway-deny
+      - name: Audit standalone Rust worker dependencies
+        run: >-
+          mise exec -- cargo-deny --locked
+          --manifest-path packages/sie_server_rust/Cargo.toml --all-features
+          --config deny.toml check
+      - run: mise exec -- cargo fmt --manifest-path packages/sie_server_rust/Cargo.toml -- --check
+      - run: mise exec -- cargo check --manifest-path packages/sie_server_rust/Cargo.toml --locked --all-targets
+      - run: mise exec -- cargo clippy --manifest-path packages/sie_server_rust/Cargo.toml --locked --all-targets -- -D warnings
+      - run: mise exec -- uv run --frozen --project . --no-sync python tools/ci/rust_tests.py
+      - name: Preserve diagnostics
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: rust-logs
+          path: .cache/ci-logs/
+          retention-days: 30
+          if-no-files-found: ignore
+
+  contracts:
+    name: CI / Contracts
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    timeout-minutes: 25
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          persist-credentials: false
+      - uses: jdx/mise-action@c37c93293d6b742fc901e1406b8f764f6fb19dac # v2
+        with:
+          cache: false
+      - run: mise run sync
+      - run: mise exec -- python tools/check_ipc_types_parity.py
+      - run: mise exec -- python tools/check_response_chunk_protocol.py
+      - run: tests/parity/run_parity.sh
+
+  helm:
+    name: CI / Helm
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    timeout-minutes: 25
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          persist-credentials: false
+      - uses: jdx/mise-action@c37c93293d6b742fc901e1406b8f764f6fb19dac # v2
+        with:
+          cache: false
+      - run: mise run helm -- dependencies
+      - run: mise run helm -- lint --set payloadStore.enabled=false
+      - run: mise run helm -- template --set payloadStore.enabled=false >/dev/null
+      - run: |
+          destination="$(mktemp -d)"
+          mise exec -- helm package deploy/helm/sie-cluster --destination "$destination"
+          git diff --exit-code -- deploy/helm/sie-cluster/Chart.lock
+
+  live-sdk:
+    name: CI / Live SDK CPU
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          persist-credentials: false
+      - uses: jdx/mise-action@c37c93293d6b742fc901e1406b8f764f6fb19dac # v2
+        with:
+          cache: false
+      - run: mise run sync
+      - run: mise exec -- pnpm install --frozen-lockfile
+      - run: mise run ts -- build
+      - run: mise exec -- uv run --frozen --project . --no-sync python tools/ci/live_sdk.py
+      - run: >-
+          mise exec -- uv run --frozen --project . --no-sync pytest -q
+          packages/sie_server/tests/fake_stack/test_sdk_surface.py
+          -m integration
+      - name: Preserve diagnostics
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: live-sdk-logs
+          path: .cache/ci-logs/
+          retention-days: 30
+          if-no-files-found: ignore
+
+  cpu-stack:
+    name: CI / CPU containers
+    runs-on: blacksmith-8vcpu-ubuntu-2404
+    timeout-minutes: 180
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          persist-credentials: false
+      - uses: jdx/mise-action@c37c93293d6b742fc901e1406b8f764f6fb19dac # v2
+        with:
+          cache: false
+      - run: mise run sync
+      - run: mise exec -- uv run --frozen --project . --no-sync python -m tools.ci.cpu_stack_smoke
+      - name: Preserve diagnostics
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: cpu-stack-logs
+          path: .cache/ci-logs/
+          retention-days: 30
+          if-no-files-found: ignore
+
+  python-distributions:
+    name: CI / Python distributions
+    uses: ./.github/workflows/release-python.yml
+    with:
+      source_ref: ${{ github.sha }}
+      build_only: true
+
+  npm-distributions:
+    name: CI / npm distributions
+    uses: ./.github/workflows/release-npm.yml
+    with:
+      source_ref: ${{ github.sha }}
+      build_only: true
+
+  required:
+    name: CI / Required
+    if: ${{ always() }}
+    needs: [policy, bootstrap, python, typescript, rust, contracts, helm, live-sdk, cpu-stack, python-distributions, npm-distributions]
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          persist-credentials: false
+      - env:
+          NEEDS: ${{ toJSON(needs) }}
+        run: python3 tools/ci/required_ci.py

.github/workflows/release-audio.yml

@@ -0,0 +1,139 @@
+name: Release native audio asset
+
+on:
+  workflow_call:
+    inputs:
+      version:
+        required: true
+        type: string
+      tag_name:
+        required: true
+        type: string
+      sha:
+        required: true
+        type: string
+      publish:
+        required: true
+        type: boolean
+
+permissions:
+  contents: read
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  build:
+    runs-on: blacksmith-8vcpu-ubuntu-2404
+    container: quay.io/pypa/manylinux_2_28_x86_64@sha256:4dc41da7df20400310c80d162a2fe2d2c2f3d9734d8dec20f6b9843711618deb
+    timeout-minutes: 30
+    outputs:
+      filename: ${{ steps.contract.outputs.filename }}
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          ref: ${{ inputs.sha }}
+          persist-credentials: false
+      - uses: jdx/mise-action@c37c93293d6b742fc901e1406b8f764f6fb19dac # v2
+        with:
+          version: 2026.7.11
+          install: false
+          cache: false
+      - name: Install pinned native build tools
+        run: |
+          mise --no-config install python@3.12.12 uv@0.5.31 zig@0.13.0 rust@1.97.0
+          test "$(mise --no-config exec python@3.12.12 uv@0.5.31 zig@0.13.0 rust@1.97.0 -- rustc --version | cut -d' ' -f2)" = 1.97.0
+          test "$(mise --no-config exec python@3.12.12 uv@0.5.31 zig@0.13.0 rust@1.97.0 -- cargo --version | cut -d' ' -f2)" = 1.97.0
+          test "$(mise --no-config exec python@3.12.12 uv@0.5.31 zig@0.13.0 rust@1.97.0 -- zig version)" = 0.13.0
+      - id: contract
+        name: Validate exact release identity and asset filename
+        env:
+          RELEASE_VERSION: ${{ inputs.version }}
+          RELEASE_TAG: ${{ inputs.tag_name }}
+          RELEASE_SHA: ${{ inputs.sha }}
+        run: |
+          set -euo pipefail
+          test "$RELEASE_TAG" = "v$RELEASE_VERSION"
+          test "$(git rev-parse HEAD)" = "$RELEASE_SHA"
+          filename="$(mise --no-config exec python@3.12.12 uv@0.5.31 zig@0.13.0 rust@1.97.0 -- python -c 'import runpy; print(runpy.run_path("packages/sie_audio_prep/build_wheel.py")["AUDIO_WHEEL_FILENAME"])')"
+          test "$filename" = "sie_audio_prep-$RELEASE_VERSION-cp312-abi3-manylinux_2_28_x86_64.whl"
+          echo "filename=$filename" >> "$GITHUB_OUTPUT"
+      - name: Build and validate exact Linux wheel
+        run: >-
+          mise --no-config exec python@3.12.12 uv@0.5.31 zig@0.13.0 rust@1.97.0 --
+          python tools/ci/build_audio_prep_release_asset.py --out dist
+      - name: Record exact tested wheel and original run provenance
+        run: >-
+          mise --no-config exec python@3.12.12 -- python -m tools.ci.release_artifact stamp
+          --directory dist --kind audio --version '${{ inputs.version }}' --tag-name '${{ inputs.tag_name }}'
+          --source-revision '${{ inputs.sha }}' --run-id '${{ github.run_id }}'
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: audio-prep-${{ inputs.version }}
+          path: dist/
+          if-no-files-found: error
+          retention-days: 30
+
+  publish:
+    needs: build
+    if: >-
+      inputs.publish == true &&
+      vars.PUBLIC_RELEASE_PUBLISHING_ENABLED == 'true' &&
+      github.event_name == 'release' &&
+      github.event.action == 'published' &&
+      github.event.release.draft == false &&
+      github.event.release.prerelease == false &&
+      github.ref_protected == true &&
+      github.ref == format('refs/tags/{0}', inputs.tag_name) &&
+      github.repository == 'superlinked/sie' &&
+      github.sha == inputs.sha
+    runs-on: blacksmith-8vcpu-ubuntu-2404
+    timeout-minutes: 15
+    environment: github-release
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          ref: ${{ inputs.sha }}
+          fetch-depth: 1
+          persist-credentials: false
+      - name: Validate trusted publication context and tag binding
+        env:
+          RELEASE_VERSION: ${{ inputs.version }}
+          RELEASE_TAG: ${{ inputs.tag_name }}
+          RELEASE_SHA: ${{ inputs.sha }}
+          PUBLIC_RELEASE_PUBLISHING_ENABLED: ${{ vars.PUBLIC_RELEASE_PUBLISHING_ENABLED }}
+          GH_TOKEN: ${{ github.token }}
+        run: >-
+          python3 tools/ci/release_guard.py publish --source-ref "$RELEASE_SHA"
+          --version "$RELEASE_VERSION" --tag-name "$RELEASE_TAG"
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          name: audio-prep-${{ inputs.version }}
+          path: artifact
+      - name: Attach and verify exact GitHub Release asset
+        env:
+          AUDIO_WHEEL_FILENAME: ${{ needs.build.outputs.filename }}
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ inputs.tag_name }}
+        run: |
+          set -euo pipefail
+          wheel="artifact/$AUDIO_WHEEL_FILENAME"
+          test -f "$wheel"
+          python3 -m tools.ci.release_artifact check --directory artifact --kind audio --version '${{ inputs.version }}' --tag-name '${{ inputs.tag_name }}' --source-revision '${{ inputs.sha }}' --run-id '${{ github.run_id }}'
+          python3 -c 'import runpy,sys; runpy.run_path("packages/sie_audio_prep/build_wheel.py")["_validate_wheel"](__import__("pathlib").Path(sys.argv[1]))' "$wheel"
+          tools/ci/upload_audio_prep_release_asset.bash "$wheel"
+
+  complete:
+    if: always() && inputs.publish
+    needs: [build, publish]
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    timeout-minutes: 5
+    steps:
+      - name: Require every release build and publisher to succeed
+        env:
+          RESULTS: ${{ toJSON(needs) }}
+        run: |
+          python3 -c 'import json,os; results=json.loads(os.environ["RESULTS"]); failed={name: job["result"] for name,job in results.items() if job["result"] != "success"}; print(failed); assert not failed'