fix(ci): add wrapper venv for python cli as release version (#333)

Author: zhravan

.github/workflows/release-cli.yml

@@ -17,36 +17,15 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       version: ${{ steps.version.outputs.VERSION }}
-    strategy:
-      matrix:
-        include:
-          - arch: x86_64
-            python-arch: x64
-          - arch: aarch64
-            python-arch: x64
 
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
-
+      # dev builds run on host, prod uses PyInstaller on host
       - name: Set up Python
         uses: actions/setup-python@v4
         with:
           python-version: "3.11"
-          architecture: ${{ matrix.python-arch }}
-
-      - name: Set up QEMU for cross-compilation
-        if: matrix.arch == 'aarch64'
-        uses: docker/setup-qemu-action@v3
-        with:
-          platforms: arm64
-
-      - name: Login to GHCR
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Install Poetry
         uses: snok/install-poetry@v1
@@ -79,16 +58,22 @@ jobs:
           sudo apt-get install -y ruby ruby-dev rubygems build-essential
           sudo gem install --no-document fpm
 
-      - name: Build CLI binary
+      - name: Build CLI binary (PRs use dev mode / pushes build production)
         working-directory: cli
         env:
-          NIXOPUS_DISABLE_DOCKER: ${{ github.event_name == 'pull_request' && '1' || '' }}
+          NIXOPUS_DISABLE_DOCKER: "1"
         run: |
           chmod +x build.sh
           if [ ! -d "helpers" ]; then
             ln -s ../helpers helpers
           fi
-          ./build.sh --no-test --no-cleanup
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            echo "Running dev-mode build (no PyInstaller)"
+            ./build.sh --dev --no-test --no-cleanup
+          else
+            echo "Running production build (PyInstaller)"
+          ./build.sh --no-test --no-cleanup --no-archive
+          fi
 
       - name: Prepare binary for packaging
         working-directory: cli
@@ -110,8 +95,14 @@ jobs:
 
       - name: Set architecture variables
         run: |
-          echo "ARCH=${{ matrix.arch }}" >> $GITHUB_ENV
-          echo "PKG_ARCH=${{ matrix.arch == 'aarch64' && 'arm64' || 'amd64' }}" >> $GITHUB_ENV
+          ARCH=$(uname -m)
+          case "$ARCH" in
+            x86_64) PKG_ARCH=amd64 ;;
+            aarch64|arm64) PKG_ARCH=arm64 ;;
+            *) PKG_ARCH=$ARCH ;;
+          esac
+          echo "ARCH=$ARCH" >> $GITHUB_ENV
+          echo "PKG_ARCH=$PKG_ARCH" >> $GITHUB_ENV
 
       - name: Create DEB package
         working-directory: cli
@@ -175,7 +166,7 @@ jobs:
       - name: Upload artifacts
         uses: actions/upload-artifact@v4
         with:
-          name: nixopus-packages-${{ matrix.arch }}
+          name: nixopus-packages-${{ env.ARCH }}
           path: |
             cli/*.deb
             cli/*.rpm

cli/build.sh

@@ -140,47 +140,17 @@ EOF
 }
 
 run_pyinstaller_build() {
+    # Skip PyInstaller when in dev mode or explicitly disabled
+    if [[ "$dev_mode" == true || "$skip_pyinstaller" == true ]]; then
+        log_warning "Skipping PyInstaller build (dev mode or skip requested)"
+        return
+    fi
     # Ensure spec file exists even if manually deleted
     if [[ ! -f "$SPEC_FILE" ]]; then
         log_warning "Spec file missing; regenerating..."
         create_spec_file
     fi
 
-    OS=$(uname -s | tr '[:upper:]' '[:lower:]')
-    ARCH=$(uname -m)
-
-    if [[ "$OS" == "linux" ]] && command -v docker &> /dev/null && [[ -z "$NIXOPUS_DISABLE_DOCKER" ]]; then
-        case $ARCH in
-            x86_64)
-                MANYLINUX_IMAGE="quay.io/pypa/manylinux2014_x86_64"
-                PYTAG="cp311-cp311"
-                ;;
-            aarch64|arm64)
-                MANYLINUX_IMAGE="quay.io/pypa/manylinux2014_aarch64"
-                PYTAG="cp311-cp311"
-                ;;
-            *)
-                MANYLINUX_IMAGE=""
-                ;;
-        esac
-
-		# Use official PyInstaller image to ensure presence of libpython shared library
-		PYI_IMAGE="ghcr.io/pyinstaller/pyinstaller:py3.11"
-		log_info "Building with PyInstaller inside $PYI_IMAGE for reliable shared-lib Python..."
-		docker run --rm -v "$(cd .. && pwd)":/work -w /work/cli "$PYI_IMAGE" bash -lc \
-"python3 -m pip install -U pip && \
-python3 -m pip install 'poetry==1.8.3' && \
-poetry config virtualenvs.in-project true && \
-poetry install --with dev && \
-poetry run pyinstaller --clean --noconfirm $SPEC_FILE" || {
-				log_error "Dockerized build failed"
-				exit 1
-			}
-        return
-
-        log_warning "Unsupported arch $ARCH for manylinux; building on host (may require newer glibc)"
-    fi
-
     log_info "Building with PyInstaller on host..."
     poetry run pyinstaller --clean --noconfirm $SPEC_FILE
 }
@@ -208,36 +178,73 @@ build_binary() {
 
     BINARY_DIR_NAME="${APP_NAME}_${OS}_${ARCH}"
 
-    
-    if [[ -d "$BUILD_DIR/$APP_NAME" ]]; then        
+    mkdir -p "$BUILD_DIR"
+
+    # If PyInstaller produced the default folder, rename to OS/ARCH-specific name
+    if [[ -d "$BUILD_DIR/$APP_NAME" ]]; then
         mv "$BUILD_DIR/$APP_NAME" "$BUILD_DIR/$BINARY_DIR_NAME"
+    else
+        log_warning "No PyInstaller output directory found; proceeding with dev-mode wrapper only"
+    fi
 
-        
-        cat > "$BUILD_DIR/$APP_NAME" << EOF
+    # Always (re)create the wrapper launcher
+    cat > "$BUILD_DIR/$APP_NAME" << 'EOF'
 #!/bin/bash
+
 # Nixopus CLI wrapper
-SCRIPT_DIR="\$(cd "\$(dirname "\${BASH_SOURCE[0]}")" && pwd)"
-exec "\$SCRIPT_DIR/$BINARY_DIR_NAME/$APP_NAME" "\$@"
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+# Detect OS/ARCH for bundled binary name
+OS="$(uname -s | tr '[:upper:]' '[:lower:]')"
+ARCH="$(uname -m)"
+case "$ARCH" in
+    x86_64) ARCH="amd64" ;;
+    aarch64|arm64) ARCH="arm64" ;;
+esac
+
+APP_NAME="nixopus"
+BINARY_DIR_NAME="${APP_NAME}_${OS}_${ARCH}"
+BUNDLED_BIN="${SCRIPT_DIR}/${BINARY_DIR_NAME}/${APP_NAME}"
+
+# If PyInstaller bundled binary exists, prefer it
+if [[ -x "$BUNDLED_BIN" ]]; then
+    exec "$BUNDLED_BIN" "$@"
+fi
+
+# Dev-mode fallback: use an isolated venv next to this wrapper
+PROJECT_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
+VENV_DIR="${SCRIPT_DIR}/.venv"
+PYTHON_BIN="${PYTHON_BIN:-python3}"
+
+if [[ ! -d "$VENV_DIR" ]]; then
+    echo "[INFO] Creating local virtualenv at $VENV_DIR"
+    "$PYTHON_BIN" -m venv "$VENV_DIR"
+    "$VENV_DIR/bin/python" -m pip install -U pip wheel
+    # Install the CLI project in editable mode to use local sources
+    "$VENV_DIR/bin/python" -m pip install -e "$PROJECT_DIR"
+fi
+
+exec "$VENV_DIR/bin/python" -m app.main "$@"
 EOF
-        chmod +x "$BUILD_DIR/$APP_NAME"
+    chmod +x "$BUILD_DIR/$APP_NAME"
 
+    if [[ -d "$BUILD_DIR/$BINARY_DIR_NAME" ]]; then
         log_success "Binary directory built: $BUILD_DIR/$BINARY_DIR_NAME/"
-        log_success "Wrapper script created: $BUILD_DIR/$APP_NAME"
-    else
-        log_error "Build failed - directory $BUILD_DIR/$APP_NAME not found"
-        exit 1
     fi
+    log_success "Wrapper script created: $BUILD_DIR/$APP_NAME"
 }
 
 test_binary() {
-    
+
     log_info "Testing binary..."
 
     WRAPPER_PATH="$BUILD_DIR/$APP_NAME"
-    
+
     if [[ -f "$WRAPPER_PATH" ]]; then
         chmod +x "$WRAPPER_PATH"
-        
+
         if "$WRAPPER_PATH" --version; then
             log_success "Binary test passed"
         else
@@ -267,11 +274,19 @@ create_release_archive() {
     cd $BUILD_DIR
 
 
+    # Collect files that actually exist
+    FILES_TO_INCLUDE=("$APP_NAME")
+    if [[ -d "$BINARY_DIR_NAME" ]]; then
+        FILES_TO_INCLUDE+=("$BINARY_DIR_NAME")
+    else
+        log_warning "Bundled binary directory $BINARY_DIR_NAME not found; archiving wrapper only"
+    fi
+
     if [[ "$OS" == "darwin" || "$OS" == "linux" ]]; then
-        tar -czf "${ARCHIVE_NAME}.tar.gz" "$BINARY_DIR_NAME" "$APP_NAME"
+        tar -czf "${ARCHIVE_NAME}.tar.gz" "${FILES_TO_INCLUDE[@]}"
         log_success "Archive created: $BUILD_DIR/${ARCHIVE_NAME}.tar.gz"
     elif [[ "$OS" == "mingw"* || "$OS" == "cygwin"* || "$OS" == "msys"* ]]; then
-        zip -r "${ARCHIVE_NAME}.zip" "$BINARY_DIR_NAME" "$APP_NAME"
+        zip -r "${ARCHIVE_NAME}.zip" "${FILES_TO_INCLUDE[@]}"
         log_success "Archive created: $BUILD_DIR/${ARCHIVE_NAME}.zip"
     fi
 
@@ -292,6 +307,8 @@ show_usage() {
     echo "  --no-test     Skip binary testing"
     echo "  --no-archive  Skip creating release archive"
     echo "  --no-cleanup  Skip cleanup of temporary files"
+    echo "  --dev         Development mode (skip PyInstaller, wrapper uses local .venv)"
+    echo "  --skip-pyinstaller  Skip PyInstaller build explicitly"
     echo "  --help        Show this help message"
     echo ""
     echo "Example:"
@@ -304,6 +321,8 @@ main() {
     local skip_test=false
     local skip_archive=false
     local skip_cleanup=false
+    skip_pyinstaller=false
+    dev_mode=false
 
     while [[ $# -gt 0 ]]; do
         case $1 in
@@ -319,6 +338,15 @@ main() {
                 skip_cleanup=true
                 shift
                 ;;
+            --skip-pyinstaller)
+                skip_pyinstaller=true
+                shift
+                ;;
+            --dev)
+                dev_mode=true
+                skip_pyinstaller=true
+                shift
+                ;;
             --help)
                 show_usage
                 exit 0