fix(ci): fix PyInstaller build and run PR builds (#331)

Author: zhravan

.github/workflows/release-cli.yml

@@ -6,6 +6,10 @@ on:
     paths:
       - "cli/**"
       - ".github/workflows/release-cli.yml"
+  pull_request:
+    paths:
+      - "cli/**"
+      - ".github/workflows/release-cli.yml"
   workflow_dispatch:
 
 jobs:
@@ -37,6 +41,13 @@ jobs:
         with:
           platforms: arm64
 
+      - name: Login to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Install Poetry
         uses: snok/install-poetry@v1
         with:
@@ -70,6 +81,8 @@ jobs:
 
       - name: Build CLI binary
         working-directory: cli
+        env:
+          NIXOPUS_DISABLE_DOCKER: ${{ github.event_name == 'pull_request' && '1' || '' }}
         run: |
           chmod +x build.sh
           if [ ! -d "helpers" ]; then

cli/build.sh

@@ -164,19 +164,19 @@ run_pyinstaller_build() {
                 ;;
         esac
 
-        if [[ -n "$MANYLINUX_IMAGE" ]]; then
-            log_info "Building with PyInstaller inside $MANYLINUX_IMAGE for wide glibc compatibility..."
-            docker run --rm -v "$(cd .. && pwd)":/work -w /work/cli "$MANYLINUX_IMAGE" bash -lc \
-"export PATH=/opt/python/$PYTAG/bin:\$PATH && \
-python3 -m pip install -U pip && \
+		# Use official PyInstaller image to ensure presence of libpython shared library
+		PYI_IMAGE="ghcr.io/pyinstaller/pyinstaller:py3.11"
+		log_info "Building with PyInstaller inside $PYI_IMAGE for reliable shared-lib Python..."
+		docker run --rm -v "$(cd .. && pwd)":/work -w /work/cli "$PYI_IMAGE" bash -lc \
+"python3 -m pip install -U pip && \
 python3 -m pip install 'poetry==1.8.3' && \
+poetry config virtualenvs.in-project true && \
 poetry install --with dev && \
 poetry run pyinstaller --clean --noconfirm $SPEC_FILE" || {
-                log_error "Dockerized build failed"
-                exit 1
-            }
-            return
-        fi
+				log_error "Dockerized build failed"
+				exit 1
+			}
+        return
 
         log_warning "Unsupported arch $ARCH for manylinux; building on host (may require newer glibc)"
     fi
@@ -361,4 +361,4 @@ main() {
     fi
 }
 
-main "$@"
+main "$@"