Make the release pipeline run and publish the missing model asset

.github/workflows/models.yml

@@ -0,0 +1,32 @@
+name: Publish models
+# Builds the SigLIP ONNX export that `metachlorian models fetch` downloads (models.py MC_RELEASE) and uploads it to the
+# models-v1 release. Run by hand from the Actions tab; re-running replaces the asset. See OPEN_QUESTIONS Q4.
+on:
+  workflow_dispatch:
+jobs:
+  siglip:
+    runs-on: ubuntu-latest
+    permissions: { contents: write }
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+      - name: Export environment (not runtime dependencies of Metachlorian)
+        run: |
+          uv venv -p 3.11 .export
+          uv pip install -p .export/bin/python --index-url https://download.pytorch.org/whl/cpu "torch==2.8.*"
+          uv pip install -p .export/bin/python "transformers>=4.45,<5" sentencepiece protobuf onnx onnxruntime numpy
+      - name: Export and check parity with PyTorch
+        run: .export/bin/python scripts/export_siglip.py google/siglip-base-patch16-256-multilingual out/siglip-base-multilingual
+      - name: Package
+        run: |
+          ls -la out/siglip-base-multilingual
+          for f in vision.onnx text.q.onnx spiece.model config.json; do test -s "out/siglip-base-multilingual/$f"; done
+          tar -C out -cjf siglip-base-multilingual.tar.bz2 siglip-base-multilingual
+          sha256sum siglip-base-multilingual.tar.bz2 | tee siglip-base-multilingual.tar.bz2.sha256
+      - name: Upload to the models-v1 release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release view models-v1 >/dev/null 2>&1 || gh release create models-v1 --latest=false --title "Model weights v1" \
+            --notes "ONNX exports that Metachlorian downloads with \`metachlorian models fetch\`. SigLIP weights by Google, Apache-2.0. Reproduce with scripts/export_siglip.py."
+          gh release upload models-v1 siglip-base-multilingual.tar.bz2 siglip-base-multilingual.tar.bz2.sha256 --clobber

.github/workflows/release.yml

@@ -9,6 +9,7 @@ jobs:
       matrix:
         os: [macos-latest, windows-latest, ubuntu-latest]
     runs-on: ${{ matrix.os }}
+    permissions: { contents: write }  # electron-builder uploads installers to a draft release
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -29,7 +30,13 @@ jobs:
     permissions: { packages: write, contents: read }
     steps:
       - uses: actions/checkout@v4
+      # Block mappings: a ${{ }} expression inside a { } flow mapping is invalid YAML and stopped every run.
       - uses: docker/login-action@v3
-        with: { registry: ghcr.io, username: ${{ github.actor }}, password: ${{ secrets.GITHUB_TOKEN }} }
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
       - uses: docker/build-push-action@v6
-        with: { push: true, tags: "ghcr.io/jeremysnr/metachlorian:latest,ghcr.io/jeremysnr/metachlorian:${{ github.ref_name }}" }
+        with:
+          push: true
+          tags: ghcr.io/jeremysnr/metachlorian:latest,ghcr.io/jeremysnr/metachlorian:${{ github.ref_name }}

Dockerfile

@@ -9,6 +9,9 @@ COPY app/ ./
 RUN npm run build
 
 FROM python:3.11-slim-bookworm
+LABEL org.opencontainers.image.source=https://github.com/JeremySNR/Metachlorian \
+      org.opencontainers.image.description="Self-hosted, shot-level video search for AI agents and editors" \
+      org.opencontainers.image.licenses=Apache-2.0
 ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 \
     METACHLORIAN_DATA=/data METACHLORIAN_MODELS=/models METACHLORIAN_APP_DIST=/opt/metachlorian/app/dist \
     METACHLORIAN_HOST=0.0.0.0 METACHLORIAN_REQUIRE_AUTH=true