Sync fork to upstream v0.6.0

.codeql-config.yml

@@ -0,0 +1,10 @@
+paths:
+  - api
+  - ui
+paths-ignore:
+  - .venv
+  - "**/node_modules"
+  - "**/__pycache__"
+  - examples
+  - docs
+  - "**/tests/**"

.github/workflows/ci.yml

@@ -6,14 +6,14 @@ on:
     branches: [ "master", "pre-release" ]
 jobs:
   test:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     strategy:
       matrix:
         python-version: ["3.10"]
       fail-fast: false
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     # Match Dockerfile dependencies
     - name: Install Dependencies
@@ -34,9 +34,6 @@ jobs:
       with:
         python-version: ${{ matrix.python-version }}
         enable-cache: true
-    - name: Install dependencies
-      run: |
-        uv pip install -e .[test,cpu]
     - name: Run Tests
       run: |
-        uv run pytest api/tests/ --asyncio-mode=auto --cov=api --cov-report=term-missing
+        uv run --extra test --extra cpu pytest api/tests/ --asyncio-mode=auto --cov=api --cov-report=term-missing

.github/workflows/release.yml

@@ -14,26 +14,38 @@ on:
         required: true
         type: string
 
+concurrency:
+  group: release-${{ github.event_name == 'workflow_dispatch' && inputs.branch_name || github.ref_name }}
+  cancel-in-progress: false
+
 jobs:
   prepare-release:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       version: ${{ steps.get-version.outputs.version }}
       version_tag: ${{ steps.get-version.outputs.version_tag }}
+      source_ref: ${{ steps.resolve-ref.outputs.source_ref }}
     steps:
+      - name: Resolve source ref
+        id: resolve-ref
+        run: |
+          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
+            echo "source_ref=${{ inputs.branch_name }}" >> $GITHUB_OUTPUT
+          else
+            echo "source_ref=${{ github.ref_name }}" >> $GITHUB_OUTPUT
+          fi
+
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
+        with:
+          ref: ${{ steps.resolve-ref.outputs.source_ref }}
+          fetch-depth: 0
 
       - name: Get version from VERSION file
         id: get-version
         run: |
           VERSION_PLAIN=$(cat VERSION)
-
-          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
-            BRANCH_NAME="${{ inputs.branch_name }}"
-          else
-            BRANCH_NAME="${{ github.ref_name }}"
-          fi
+          BRANCH_NAME="${{ steps.resolve-ref.outputs.source_ref }}"
 
           if [[ "$BRANCH_NAME" == "release" ]]; then
             echo "version=${VERSION_PLAIN}" >> $GITHUB_OUTPUT
@@ -44,6 +56,15 @@ jobs:
             echo "version_tag=v${VERSION_PLAIN}-${SAFE_BRANCH}" >> $GITHUB_OUTPUT
           fi
 
+      - name: Check tag does not exist
+        run: |
+          TAG_NAME="${{ steps.get-version.outputs.version_tag }}"
+          git fetch --tags
+          if git rev-parse "$TAG_NAME" >/dev/null 2>&1; then
+            echo "::error::Tag $TAG_NAME already exists. Please increment the version in the VERSION file."
+            exit 1
+          fi
+
   build-images:
     needs: prepare-release
     permissions:
@@ -60,10 +81,13 @@ jobs:
         include:
           - build_target: "cpu"
             platform: "linux/amd64"
-            runs_on: "ubuntu-latest"
+            runs_on: "ubuntu-24.04"
           - build_target: "gpu"
             platform: "linux/amd64"
-            runs_on: "ubuntu-latest"
+            runs_on: "ubuntu-24.04"
+          - build_target: "gpu-cu128"
+            platform: "linux/amd64"
+            runs_on: "ubuntu-24.04"
           - build_target: "cpu"
             platform: "linux/arm64"
             runs_on: "ubuntu-24.04-arm"
@@ -72,25 +96,13 @@ jobs:
             runs_on: "ubuntu-24.04-arm"
           - build_target: "rocm"
             platform: "linux/amd64"
-            runs_on: "ubuntu-latest"
+            runs_on: "ubuntu-24.04"
     runs-on: ${{ matrix.runs_on }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
-          fetch-depth: 0 # Needed to check for existing tags
-
-      - name: Check if tag already exists
-        run: |
-          TAG_NAME="${{ needs.prepare-release.outputs.version_tag }}"
-          echo "Checking for existing tag: $TAG_NAME"
-          git fetch --tags
-          if git rev-parse "$TAG_NAME" >/dev/null 2>&1; then
-            echo "::error::Tag $TAG_NAME already exists. Please increment the version in the VERSION file."
-            exit 1
-          else
-            echo "Tag $TAG_NAME does not exist. Proceeding with release."
-          fi
+          ref: ${{ needs.prepare-release.outputs.source_ref }}
 
       - name: Free disk space
         run: |
@@ -103,14 +115,14 @@ jobs:
           df -h
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3 # Use v3
+        uses: docker/setup-buildx-action@v4
         with:
           driver-opts: |
-            image=moby/buildkit:latest
+            image=moby/buildkit:v0.21.1
             network=host
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3 # Use v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -127,11 +139,18 @@ jobs:
           TARGET="${BUILD_TARGET}-$(echo ${PLATFORM} | cut -d'/' -f2)"
           echo "Using bake target: $TARGET"
 
-          docker buildx bake $TARGET --push --progress=plain
+          # Bake reads REVISION/CREATED as HCL variables; both populate
+          # org.opencontainers.image.* labels and annotations on the per-arch push.
+          export REVISION="${GITHUB_SHA}"
+          export CREATED="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+
+          docker buildx bake $TARGET --push --progress=plain \
+            --set "*.cache-from=type=gha,scope=${TARGET}" \
+            --set "*.cache-to=type=gha,mode=max,scope=${TARGET}"
 
   create-manifests:
     needs: [prepare-release, build-images]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       packages: write
     env:
@@ -140,10 +159,10 @@ jobs:
       REPO: ${{ vars.REPO || 'kokoro-fastapi' }}
     strategy:
       matrix:
-        build_target: ["cpu", "gpu", "rocm"]
+        build_target: ["cpu", "gpu", "gpu-cu128", "rocm"]
     steps:
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -157,34 +176,118 @@ jobs:
           OWNER="${{ env.OWNER }}"
           REPO="${{ env.REPO }}"
 
-          docker buildx imagetools create -t \
-            ${REGISTRY}/${OWNER}/${REPO}-${TARGET}:${VERSION_TAG} \
-            ${REGISTRY}/${OWNER}/${REPO}-${TARGET}:${VERSION_TAG}-amd64 \
-            ${REGISTRY}/${OWNER}/${REPO}-${TARGET}:${VERSION_TAG}-arm64
+          # Resolve the package name, manifest tag(s), and source images per target.
+          #
+          # Tag layout per target:
+          #  - cpu:        :VERSION + :latest                         (multi-arch)
+          #  - gpu:        :VERSION + :VERSION-cu126 + :latest + :latest-cu126
+          #                  (the -cu126 aliases make the wheel variant explicit so
+          #                  Maxwell/Pascal users can pin it across future default flips)
+          #  - gpu-cu128:  :VERSION-cu128 + :latest-cu128             (amd64 only)
+          #  - rocm:       :VERSION + :latest                         (amd64 only)
+          #
+          # MANIFEST_TAGS / LATEST_TAGS are space-separated lists; all entries point at
+          # the same SOURCES so the underlying blobs are deduplicated by digest.
+          #
+          # TITLE / DESCRIPTION are attached as index-level OCI annotations.
+          # GHCR reads org.opencontainers.image.description from the index manifest
+          # for multi-arch packages, so the per-arch labels set by bake are not
+          # enough on their own.
+          case "$TARGET" in
+            gpu-cu128)
+              PACKAGE="${REPO}-gpu"
+              MANIFEST_TAGS="${VERSION_TAG}-cu128"
+              LATEST_TAGS="latest-cu128"
+              SOURCES=("${REGISTRY}/${OWNER}/${PACKAGE}:${VERSION_TAG}-cu128-amd64")
+              TITLE="Kokoro-FastAPI (GPU, cu128 / Blackwell)"
+              DESCRIPTION="Kokoro TTS served via FastAPI. NVIDIA GPU build with CUDA 12.8 + cu128 torch wheels for RTX 50-series (Blackwell, sm_120). amd64 only."
+              ;;
+            gpu)
+              PACKAGE="${REPO}-gpu"
+              MANIFEST_TAGS="${VERSION_TAG} ${VERSION_TAG}-cu126"
+              LATEST_TAGS="latest latest-cu126"
+              # Per-arch sources carry their wheel variant (cu126 amd64, cu129 arm64);
+              # both feed the same multi-arch manifest tags above.
+              SOURCES=(
+                "${REGISTRY}/${OWNER}/${PACKAGE}:${VERSION_TAG}-cu126-amd64"
+                "${REGISTRY}/${OWNER}/${PACKAGE}:${VERSION_TAG}-cu129-arm64"
+              )
+              TITLE="Kokoro-FastAPI (GPU)"
+              DESCRIPTION="Kokoro TTS served via FastAPI. NVIDIA GPU build, multi-arch (CUDA 12.6 + cu126 wheels on amd64, CUDA 12.9 + cu129 wheels on arm64). See the -cu128 tag for Blackwell."
+              ;;
+            rocm)
+              PACKAGE="${REPO}-rocm"
+              MANIFEST_TAGS="${VERSION_TAG}"
+              LATEST_TAGS="latest"
+              SOURCES=("${REGISTRY}/${OWNER}/${PACKAGE}:${VERSION_TAG}-amd64")
+              TITLE="Kokoro-FastAPI (ROCm)"
+              DESCRIPTION="Kokoro TTS served via FastAPI. AMD ROCm build. amd64 only."
+              ;;
+            *)
+              PACKAGE="${REPO}-${TARGET}"
+              MANIFEST_TAGS="${VERSION_TAG}"
+              LATEST_TAGS="latest"
+              SOURCES=(
+                "${REGISTRY}/${OWNER}/${PACKAGE}:${VERSION_TAG}-amd64"
+                "${REGISTRY}/${OWNER}/${PACKAGE}:${VERSION_TAG}-arm64"
+              )
+              TITLE="Kokoro-FastAPI (CPU)"
+              DESCRIPTION="Kokoro TTS served via FastAPI. CPU build, multi-arch (amd64 + arm64)."
+              ;;
+          esac
+
+          # Common index annotations. `index:` is required so these land on the
+          # index manifest itself, not on per-platform descriptors inside it.
+          SOURCE_URL="https://github.com/${OWNER}/Kokoro-FastAPI"
+          CREATED="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+          REVISION="${GITHUB_SHA}"
+          ANNOTATIONS=(
+            --annotation "index:org.opencontainers.image.title=${TITLE}"
+            --annotation "index:org.opencontainers.image.description=${DESCRIPTION}"
+            --annotation "index:org.opencontainers.image.source=${SOURCE_URL}"
+            --annotation "index:org.opencontainers.image.url=${SOURCE_URL}"
+            --annotation "index:org.opencontainers.image.licenses=Apache-2.0"
+            --annotation "index:org.opencontainers.image.version=${VERSION_TAG}"
+            --annotation "index:org.opencontainers.image.revision=${REVISION}"
+            --annotation "index:org.opencontainers.image.created=${CREATED}"
+          )
+
+          for TAG in $MANIFEST_TAGS; do
+            docker buildx imagetools create \
+              "${ANNOTATIONS[@]}" \
+              -t ${REGISTRY}/${OWNER}/${PACKAGE}:${TAG} \
+              "${SOURCES[@]}"
+          done
 
+          # Publish the rolling tag(s) only for clean release tags (no branch suffix).
           if [[ "$VERSION_TAG" != *"-"* ]]; then
-            docker buildx imagetools create -t \
-              ${REGISTRY}/${OWNER}/${REPO}-${TARGET}:latest \
-              ${REGISTRY}/${OWNER}/${REPO}-${TARGET}:${VERSION_TAG}-amd64 \
-              ${REGISTRY}/${OWNER}/${REPO}-${TARGET}:${VERSION_TAG}-arm64
+            for TAG in $LATEST_TAGS; do
+              docker buildx imagetools create \
+                "${ANNOTATIONS[@]}" \
+                -t ${REGISTRY}/${OWNER}/${PACKAGE}:${TAG} \
+                "${SOURCES[@]}"
+            done
           fi
 
   create-release:
     needs: [prepare-release, create-manifests]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       contents: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v2
         with:
           tag_name: ${{ needs.prepare-release.outputs.version_tag }}
+          target_commitish: ${{ needs.prepare-release.outputs.source_ref }}
           name: Release ${{ needs.prepare-release.outputs.version_tag }}
+          body: |
+            Curated summary: [CHANGELOG.md](https://github.com/${{ github.repository }}/blob/${{ needs.prepare-release.outputs.version_tag }}/CHANGELOG.md)
           generate_release_notes: true
           draft: false
           prerelease: false

.github/workflows/test_build.yml

@@ -15,6 +15,7 @@ on:
           - all
           - cpu
           - gpu
+          - gpu-cu128
           - rocm
       platform:
         description: 'Platform (ignored for rocm)'
@@ -36,19 +37,20 @@ concurrency:
 
 jobs:
   setup:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:
       - name: Build matrix
         id: set-matrix
         run: |
           ALL_TARGETS='[
-            {"build_target":"cpu","platform":"amd64","runs_on":"ubuntu-latest"},
+            {"build_target":"cpu","platform":"amd64","runs_on":"ubuntu-24.04"},
             {"build_target":"cpu","platform":"arm64","runs_on":"ubuntu-24.04-arm"},
-            {"build_target":"gpu","platform":"amd64","runs_on":"ubuntu-latest"},
+            {"build_target":"gpu","platform":"amd64","runs_on":"ubuntu-24.04"},
             {"build_target":"gpu","platform":"arm64","runs_on":"ubuntu-24.04-arm"},
-            {"build_target":"rocm","platform":"amd64","runs_on":"ubuntu-latest"}
+            {"build_target":"gpu-cu128","platform":"amd64","runs_on":"ubuntu-24.04"},
+            {"build_target":"rocm","platform":"amd64","runs_on":"ubuntu-24.04"}
           ]'
 
           FILTERED=$(echo "$ALL_TARGETS" | jq -c \
@@ -77,7 +79,7 @@ jobs:
     runs-on: ${{ matrix.runs_on }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           ref: ${{ inputs.branch_name }}
 
@@ -86,15 +88,19 @@ jobs:
           sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           driver-opts: image=moby/buildkit:v0.21.1
 
       - name: Build image
         run: |
           TARGET="${{ matrix.build_target }}-${{ matrix.platform }}"
+          CACHE_ARGS=(
+            --set "*.cache-from=type=gha,scope=${TARGET}"
+            --set "*.cache-to=type=gha,mode=max,scope=${TARGET}"
+          )
           if [[ "${{ inputs.dry_run }}" == "true" ]]; then
-            docker buildx bake "$TARGET" --print
+            docker buildx bake "$TARGET" --print "${CACHE_ARGS[@]}"
           else
-            docker buildx bake "$TARGET" --progress=plain
+            docker buildx bake "$TARGET" --progress=plain "${CACHE_ARGS[@]}"
           fi