c2pa-ml 0.1.0

C2PA manifest embedding for AI/ML model container formats: GGUF, SafeTensors, and ONNX
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160

name: Release

# Cut a release by pushing a version tag that matches the crate version:
#   git tag v0.1.0 && git push origin v0.1.0
#
# Publishing is gated on two repository secrets; each job is skipped cleanly if
# its secret is absent, so a tag can drive a partial release:
#   CARGO_REGISTRY_TOKEN  — crates.io API token
#   NPM_TOKEN             — npmjs.com automation token (publishes `c2pa-ml`)
#
# PyPI publishing uses Trusted Publishing (OIDC), not a secret: register a
# pending publisher on PyPI for project `c2pa-ml`, owner `writerslogic`,
# repository `c2pa-ml`, workflow `release.yml`, environment `pypi`.

on:
  push:
    tags: ['v*.*.*']

permissions:
  contents: write

env:
  CARGO_TERM_COLOR: always

jobs:
  verify:
    name: Verify
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy
          targets: wasm32-unknown-unknown
      - uses: actions/setup-python@v5
        with:
          python-version: '3.x'
      - name: Tag matches crate version
        run: |
          tag_version="${GITHUB_REF_NAME#v}"
          if ! grep -q "^version = \"${tag_version}\"$" Cargo.toml; then
            echo "::error::tag ${tag_version} does not match the version in Cargo.toml"
            exit 1
          fi
      - run: cargo fmt --all -- --check
      - run: cargo clippy --features python -- -D warnings
      - run: cargo clippy --target wasm32-unknown-unknown -- -D warnings
      - run: cargo test

  crates-io:
    name: Publish to crates.io
    needs: verify
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
      - name: cargo publish
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
        run: |
          if [ -z "$CARGO_REGISTRY_TOKEN" ]; then
            echo "::warning::CARGO_REGISTRY_TOKEN not set; skipping crates.io publish"
            exit 0
          fi
          cargo publish

  npm:
    name: Publish to npm
    needs: verify
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: wasm32-unknown-unknown
      - uses: jetli/wasm-pack-action@v0.4.0
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          registry-url: https://registry.npmjs.org
      - name: Build and publish
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: |
          if [ -z "$NODE_AUTH_TOKEN" ]; then
            echo "::warning::NPM_TOKEN not set; skipping npm publish"
            exit 0
          fi
          wasm-pack build --target bundler --out-dir pkg
          npm publish pkg --access public

  wheels:
    name: Build wheels (${{ matrix.platform.os }} ${{ matrix.platform.target }})
    needs: verify
    runs-on: ${{ matrix.platform.os }}
    strategy:
      fail-fast: false
      matrix:
        platform:
          - { os: ubuntu-latest, target: x86_64 }
          - { os: ubuntu-latest, target: aarch64 }
          - { os: macos-latest, target: aarch64 }
          - { os: macos-13, target: x86_64 }
          - { os: windows-latest, target: x64 }
    steps:
      - uses: actions/checkout@v7
      - uses: PyO3/maturin-action@v1
        with:
          target: ${{ matrix.platform.target }}
          args: --release --out dist --features python
          manylinux: auto
      - uses: actions/upload-artifact@v4
        with:
          name: wheels-${{ matrix.platform.os }}-${{ matrix.platform.target }}
          path: dist

  sdist:
    name: Build sdist
    needs: verify
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: PyO3/maturin-action@v1
        with:
          command: sdist
          args: --out dist
      - uses: actions/upload-artifact@v4
        with:
          name: wheels-sdist
          path: dist

  pypi:
    name: Publish to PyPI
    needs: [wheels, sdist]
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      id-token: write # Trusted Publishing (OIDC); no PyPI token needed
    steps:
      - uses: actions/download-artifact@v4
        with:
          pattern: wheels-*
          merge-multiple: true
          path: dist
      - uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: dist

  github-release:
    name: GitHub release
    needs: verify
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - name: Create release
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release create "$GITHUB_REF_NAME" --title "$GITHUB_REF_NAME" --generate-notes