feat: publish the container image and the PyPI package

[xizhuomengcontin]

Orca-Code-Review — push 2

Severity	Count	Δ vs previous push
P0	0	0
P1	0	0
P2	0	-4
P3	0	0

✅ no blocking findings

Why

The README advertises two artifacts that do not exist:

Artifact	State on main today
Container image	none — the README cell is a literal ghcr.io/... placeholder, "(image coming soon)"
PyPI package	orcarouter-lite returns 404

There is no workflow that publishes anything. ci.yml builds an image only to docker rm -f it, and nothing has ever touched PyPI; the v0.1.0 tag has zero assets.

pip install orcarouter-lite would not have produced anything usable even if it were published: there is no console script, and packages.find ships only app/ + packages/ — leaving scripts/start.py (the boot path) and design/ (the entire dashboard) out of the wheel. You would get a library with no way to start it and nothing behind /.

What

feat(packaging) — make the wheel installable and self-contained

• app/cli.py holds the boot logic and is exposed as the orcarouter-lite console script (--host/--port/--log-level/--reload/--version). scripts/start.py and app/__main__.py delegate to it, so a checkout, the container and the wheel all take one code path. The logic cannot stay in scripts/ — that directory is not part of the distribution.
• Build backend moves to hatchling for force-include, which maps the repo-root design/ tree to app/design/ inside the wheel. No file moves (nothing conflicts with open PRs) and no explicit package list to drift out of sync when a subpackage is added.
• _find_design_dir() replaces the hardcoded ../design: $ORCA_DESIGN_DIR, then app/design (wheel), then ../design (checkout and Docker image).
• PyPI metadata: readme, SPDX license + license-files, authors, keywords, classifiers, project.urls.

The Dockerfile builder had to change with it. It pre-installed dependencies via mkdir -p app packages && pip install ".", which now fails outright because readme = "README.md" is not in that build context. It reads the dependency list straight out of pyproject.toml instead — clearer about the intent (the project itself is never installed there; the runtime stage puts the source on PYTHONPATH) and the cached layer no longer breaks on a code or README edit.

ci(release) — publish the container image and the PyPI package

• push to main → ghcr.io/…:edge (amd64 only; arm64 is emulated and slow, not worth it on every merge)
• push a v* tag → :latest, :X.Y.Z, :X.Y, :sha-xxxx on amd64 + arm64, a provenance attestation, the PyPI release, and both dists attached to the GitHub release
• the pushed image is pulled back by digest and curl'd on /health before the job passes
• PyPI uses trusted publishing (OIDC) — no token to store or rotate. The tag must match the pyproject version or the job refuses to publish. The job is scoped to this repository, so a fork can rehearse a release against its own ghcr namespace instead of dying at the OIDC exchange.

ci.yml gains a package job so packaging breaks on the PR rather than at release time: build, twine check --strict, install the wheel into a clean venv, boot it, and assert / still answers with HTML. That last assertion is the point — drop the design force-include and everything still builds and boots, only the dashboard silently vanishes. design/** joins the path filters for the same reason.

Verification

Rehearsed end to end on a fork before opening this, so every step below has actually run:

	Result
docker smoke	real docker build + boot + /health ✅
package	build, twine check --strict, clean-venv install, boot, dashboard served ✅
release	pushed ghcr.io/<fork>/orcarouter-lite:edge — linux/amd64, 12 layers, non-root orca, CMD ["python","scripts/start.py"] unchanged — signed provenance, pulled the image back by digest, healthy /health; pypi job skipped as designed ✅

Locally: 312 passed, ruff clean, twine check --strict PASSED on both wheel and sdist.

Before the first tag

RELEASING.md has the detail. Two things need a human once:

1. PyPI trusted publisher — pypi.org → Publishing → pending publisher: owner Continuum-AI-Corp, repo OrcaRouter-Lite, workflow release.yml, environment pypi. Until it exists a v* tag fails at the OIDC exchange. No rush: merging this and pushing to main runs only the image job.
2. GHCR package visibility — the first push creates the package private; flip it to public in the org's package settings.

Note the existing v0.1.0 tag cannot be released via workflow_dispatch: a dispatch runs the workflow file from the ref you select, and that tag predates release.yml. Cut v0.1.1 instead.

Not included

The README is untouched here, so after merge it will still say ghcr.io/... (image coming soon), and its Railway button still points at https://railway.app/new/template — a URL with no template behind it, which lands visitors on the generic marketplace page and deploys nothing (Railway only serves one-click deploys for a published template code; the legacy ?template=<github-url> form no longer resolves). Both are doc-only changes across 12 files and can follow separately.

🤖 Generated with Claude Code

[orcacode-review]

🐳 OrcaCode Review

Found 4 issues in this PR: 🟡 4 P2.

_{Reviewed via OrcaRouter — Route Smarter. Ship Safer. Spend Less.}

[orcacode-review]

🐳 OrcaCode Review

✅ No findings — nothing to flag in this PR. Great work!

_{OrcaCode Review — Route Smarter. Ship Safer. Spend Less.
Engine-reported: 149 calls · 6.2M tokens · 96% cached}

❤️ Share · Install OrcaCode Review

Free on GitHub — the review runs on your own OrcaRouter key. If it helped, a shout-out goes a long way.

Share: X · Reddit · LinkedIn
Follow: X · Discord · LinkedIn · OrcaRouter