feat(hub): add self-hosted multi-user Hub with local and Docker runtimes (#7112)

Author: rayrayraykk

.github/workflows/release-verify.yml

@@ -173,6 +173,29 @@ jobs:
         with:
           ref: ${{ inputs.ref }}
 
+      - name: Verify managed runtime boundary version
+        shell: bash
+        run: |
+          python - <<'PY'
+          import re
+          from pathlib import Path
+
+          version_source = Path("src/qwenpaw/__version__.py").read_text()
+          dockerfile = Path("deploy/Dockerfile").read_text()
+          version = re.search(r'__version__ = "([^"]+)"', version_source)
+          boundary = re.search(
+              r'ARG QWENPAW_MANAGED_RUNTIME_BOUNDARY_VERSION="([^"]+)"',
+              dockerfile,
+          )
+          if version is None or boundary is None:
+              raise SystemExit("Unable to read runtime boundary versions")
+          if version.group(1) != boundary.group(1):
+              raise SystemExit(
+                  f"Runtime boundary version mismatch: "
+                  f"{boundary.group(1)} != {version.group(1)}",
+              )
+          PY
+
       - name: Log in to Aliyun ACR (when credentials available)
         if: env.ACR_USERNAME != ''
         uses: docker/login-action@v3

.github/workflows/tests.yml

@@ -8,6 +8,7 @@ on:
       - 'tests/**'
       - 'pyproject.toml'
       - 'setup.py'
+      - 'deploy/Dockerfile'
       - '.github/workflows/tests.yml'
   pull_request:
     branches: [main, master, dev, develop]
@@ -16,6 +17,7 @@ on:
       - 'tests/**'
       - 'pyproject.toml'
       - 'setup.py'
+      - 'deploy/Dockerfile'
       - '.github/workflows/tests.yml'
   workflow_dispatch:
     inputs:
@@ -77,6 +79,40 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Install Linux isolation dependency
+        if: |
+          runner.os == 'Linux' &&
+          matrix.python-version == '3.11'
+        shell: bash
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y bubblewrap
+          if sysctl kernel.apparmor_restrict_unprivileged_userns \
+            >/dev/null 2>&1; then
+            sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+          fi
+
+      - name: Set up Node.js (for console build)
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+          cache-dependency-path: console/package-lock.json
+
+      - name: Build console frontend
+        shell: bash
+        env:
+          NODE_OPTIONS: "--max-old-space-size=8192"
+        run: |
+          cd console && npm ci && npm run build
+
+      - name: Copy console build into package
+        shell: bash
+        run: |
+          rm -rf src/qwenpaw/console/*
+          mkdir -p src/qwenpaw/console
+          cp -R console/dist/* src/qwenpaw/console/
+
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v5
         with:
@@ -86,14 +122,8 @@ jobs:
       - name: Install dependencies
         shell: bash
         run: |
-          # Slim install for the unit tier: unit tests neither serve the
-          # console frontend nor require the optional heavy extras
-          # (whisper/torch, codex, qoder). Optional-dependency tests are
-          # guarded with pytest.importorskip and still run in the nightly
-          # full sweep, which keeps the full extra. Keeping this job lean
-          # cuts the Windows matrix entry from tens of minutes to a few.
           python -m pip install --upgrade pip
-          pip install -e ".[dev,test]"
+          pip install -e ".[dev,test,full]"
 
       - name: Run unit tests
         shell: bash
@@ -112,6 +142,15 @@ jobs:
             pytest tests/unit -v
           fi
 
+      - name: Run Hub Local runtime E2E
+        if: matrix.python-version == '3.11'
+        shell: bash
+        env:
+          QWENPAW_LOCAL_RUNTIME_E2E: '1'
+        run: |
+          python -m pip install --no-deps --force-reinstall .
+          pytest tests/e2e/test_hub_local_runtime.py -v
+
       - name: Upload unit coverage data
         if: |
           matrix.os == 'ubuntu-latest' &&

console/index.html

@@ -8,9 +8,60 @@
       content="width=device-width, initial-scale=1.0, viewport-fit=cover"
     />
     <title>QwenPaw Console</title>
+    <style>
+      .qwenpaw-boot {
+        align-items: center;
+        background: #f7f7f5;
+        color: #1f1f1f;
+        display: flex;
+        font-family:
+          Inter,
+          ui-sans-serif,
+          -apple-system,
+          BlinkMacSystemFont,
+          "Segoe UI",
+          sans-serif;
+        inset: 0;
+        justify-content: center;
+        position: fixed;
+      }
+      .qwenpaw-boot__content {
+        align-items: center;
+        display: flex;
+        flex-direction: column;
+        gap: 18px;
+      }
+      .qwenpaw-boot__logo {
+        height: 68px;
+        object-fit: contain;
+        width: 68px;
+      }
+      .qwenpaw-boot__label {
+        color: #70706c;
+        font-size: 13px;
+        letter-spacing: 0.08em;
+        text-transform: uppercase;
+      }
+      @media (prefers-color-scheme: dark) {
+        .qwenpaw-boot {
+          background: #141414;
+          color: #f4f4f1;
+        }
+        .qwenpaw-boot__label {
+          color: #a6a6a0;
+        }
+      }
+    </style>
   </head>
   <body>
-    <div id="root"></div>
+    <div id="root">
+      <div class="qwenpaw-boot" role="status" aria-live="polite">
+        <div class="qwenpaw-boot__content">
+          <img class="qwenpaw-boot__logo" src="/qwenpaw.png" alt="QwenPaw" />
+          <span class="qwenpaw-boot__label">Loading Console</span>
+        </div>
+      </div>
+    </div>
     <script type="module" src="/src/main.tsx"></script>
   </body>
 </html>