feat(cli): add mohub CLI generated from the API manifest

.github/workflows/cli.yml

@@ -0,0 +1,52 @@
+name: CLI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  test:
+    name: Rust CLI
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+      - uses: voidzero-dev/setup-vp@250f29ce396baf5e8f24498e17c0dfdebabc26eb # v1
+        with:
+          version: 0.1.24
+          node-version-file: '.node-version'
+          sfw: true
+          cache: true
+          run-install: |
+            - args: ['--frozen-lockfile']
+      - name: Install Rust
+        working-directory: apps/cli
+        run: rustup show
+      - name: Check generated manifest and versions
+        run: |
+          pnpm --filter @marimo-hub/api test cliManifest.spec
+          pnpm cli:version-check
+      - name: Validate distribution plan
+        working-directory: apps/cli
+        run: |
+          curl --proto '=https' --tlsv1.2 -LsSf \
+            https://github.com/axodotdev/cargo-dist/releases/download/v0.32.0/cargo-dist-installer.sh | sh
+          dist plan --allow-dirty
+      - name: Format
+        working-directory: apps/cli
+        run: cargo fmt --all -- --check
+      - name: Clippy
+        working-directory: apps/cli
+        run: cargo clippy --all-targets --locked -- -D warnings
+      - name: Test
+        working-directory: apps/cli
+        run: cargo test --locked

.github/workflows/release.yml

@@ -2,10 +2,10 @@ name: Release
 
 # Triggered by a semver tag, normally pushed by release-tag.yml when a
 # "release: X.Y.Z" PR is merged (see development_docs/releasing.md).
-# This publishes the container image and the Helm chart to GHCR, with the
-# chart version, chart appVersion, and image tag all pinned to the git tag,
-# plus a GitHub release with a changelog generated from the commits since the
-# previous tag. An end-user upgrades with:
+# This publishes the container image and Helm chart to GHCR, builds native CLI
+# archives and binary wheels, and creates a GitHub release with checksums,
+# provenance, an SBOM, and a changelog generated from commits since the prior
+# tag. The chart version, appVersion, and image tag are pinned to the git tag.
 #   helm upgrade --install marimohub oci://ghcr.io/marimo-team/charts/marimohub \
 #     --version 1.4.2 -n marimohub -f values.yaml
 on:
@@ -20,6 +20,140 @@ env:
   CHART_REGISTRY: oci://ghcr.io/${{ github.repository_owner }}/charts
 
 jobs:
+  cli:
+    name: Build CLI (${{ matrix.target }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 25
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-24.04-arm
+            target: aarch64-unknown-linux-gnu
+          - os: macos-15-intel
+            target: x86_64-apple-darwin
+          - os: macos-15
+            target: aarch64-apple-darwin
+          - os: windows-latest
+            target: x86_64-pc-windows-msvc
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - name: Install Rust target
+        shell: bash
+        working-directory: apps/cli
+        run: |
+          rustup show
+          rustup target add "${{ matrix.target }}"
+      - name: Install dist
+        shell: bash
+        run: |
+          curl --proto '=https' --tlsv1.2 -LsSf \
+            https://github.com/axodotdev/cargo-dist/releases/download/v0.32.0/cargo-dist-installer.sh | sh
+      - name: Build and test
+        shell: bash
+        working-directory: apps/cli
+        run: |
+          cargo test --locked
+          cargo run --locked --example generate-assets -- generated
+          dist build --artifacts=local --target "${{ matrix.target }}" \
+            --tag "$GITHUB_REF_NAME" --allow-dirty
+      - name: Build binary wheel
+        shell: bash
+        working-directory: apps/cli
+        run: |
+          python -m pip install 'maturin==1.9.4'
+          python -m maturin build --release --locked \
+            --target "${{ matrix.target }}" \
+            --out ../../wheelhouse
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: mohub-${{ matrix.target }}
+          path: |
+            apps/cli/target/distrib/*.tar.gz
+            apps/cli/target/distrib/*.zip
+            apps/cli/target/distrib/*.msi
+            apps/cli/target/distrib/*.sha256
+            apps/cli/target/distrib/mohub-*-update*
+            wheelhouse/*.whl
+          if-no-files-found: error
+
+  cli-linux-x64:
+    name: Build CLI (x86_64-unknown-linux-gnu, glibc 2.28)
+    runs-on: ubuntu-latest
+    container: quay.io/pypa/manylinux_2_28_x86_64:latest
+    timeout-minutes: 25
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - name: Install build tools
+        shell: bash
+        run: |
+          dnf install -y dbus-devel python3-pip
+          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+      - name: Install dist
+        shell: bash
+        run: |
+          curl --proto '=https' --tlsv1.2 -LsSf \
+            https://github.com/axodotdev/cargo-dist/releases/download/v0.32.0/cargo-dist-installer.sh | sh
+      - name: Build and test
+        shell: bash
+        working-directory: apps/cli
+        run: |
+          cargo test --locked
+          cargo run --locked --example generate-assets -- generated
+          dist build --artifacts=local --target x86_64-unknown-linux-gnu \
+            --tag "$GITHUB_REF_NAME" --allow-dirty
+      - name: Build binary wheel
+        shell: bash
+        working-directory: apps/cli
+        run: |
+          /opt/python/cp39-cp39/bin/python -m pip install 'maturin==1.9.4'
+          /opt/python/cp39-cp39/bin/python -m maturin build \
+            --release --locked --out ../../wheelhouse
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: mohub-x86_64-unknown-linux-gnu
+          path: |
+            apps/cli/target/distrib/*.tar.gz
+            apps/cli/target/distrib/*.sha256
+            apps/cli/target/distrib/mohub-*-update*
+            wheelhouse/*.whl
+          if-no-files-found: error
+
+  cli-installers:
+    name: Build CLI installers
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    needs: [cli, cli-linux-x64]
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - name: Install dist
+        run: |
+          curl --proto '=https' --tlsv1.2 -LsSf \
+            https://github.com/axodotdev/cargo-dist/releases/download/v0.32.0/cargo-dist-installer.sh | sh
+      - name: Build installers
+        working-directory: apps/cli
+        run: |
+          cargo run --locked --example generate-assets -- generated
+          dist build --artifacts=global --tag "$GITHUB_REF_NAME" --allow-dirty
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: mohub-installers
+          path: |
+            apps/cli/target/distrib/*.sh
+            apps/cli/target/distrib/*.ps1
+            apps/cli/target/distrib/*.rb
+            apps/cli/target/distrib/*.tar.gz
+            apps/cli/target/distrib/*.sha256
+            apps/cli/target/distrib/*.sum
+          if-no-files-found: error
+
   image:
     name: Build & push image
     runs-on: ubuntu-latest
@@ -134,29 +268,56 @@ jobs:
     name: Publish GitHub release notes
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    needs: [cli, cli-linux-x64, cli-installers]
     permissions:
       contents: write
+      id-token: write
+      attestations: write
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           # changelogithub diffs against the previous tag, so it needs full history.
           fetch-depth: 0
 
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          pattern: mohub-*
+          path: release-assets
+          merge-multiple: true
+
+      - name: Create checksums and dependency SBOM
+        run: |
+          cargo install cargo-cyclonedx --locked --version 0.5.7
+          (cd apps/cli && cargo cyclonedx \
+            --format json --override-filename mohub.cdx.json)
+          cp apps/cli/mohub.cdx.json release-assets/mohub.cdx.json
+          (cd release-assets && sha256sum ./* > SHA256SUMS)
+
+      - name: Attest CLI artifacts
+        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2
+        with:
+          subject-path: 'release-assets/*'
+
       - name: Generate changelog and create GitHub release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: npx changelogithub@14.0.0
 
+      - name: Attach CLI artifacts
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh release upload "$GITHUB_REF_NAME" release-assets/* --clobber
+
   notify:
     name: Notify Slack
     runs-on: ubuntu-latest
     timeout-minutes: 5
     # Report the overall outcome once every release job has finished.
-    needs: [image, chart, release-notes]
+    needs: [cli, cli-linux-x64, cli-installers, image, chart, release-notes]
     if: always()
     steps:
       - name: Notify Slack - Release Success
-        if: ${{ !contains(needs.*.result, 'failure') && !contains(needs.*.result, 'cancelled') }}
+        if: ${{ !contains(needs.*.result, 'failure') && !contains(needs.*.result, 'cancelled') && !contains(needs.*.result, 'skipped') }}
         uses: slackapi/slack-github-action@0d95c9a7becc1e6e297d76df9bc735c44f4cbcbc # v3.0.5
         with:
           webhook: ${{ secrets.SLACK_WEBHOOK_URL_RELEASES }}
@@ -176,7 +337,7 @@ jobs:
             }
 
       - name: Notify Slack - Release Failed
-        if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}
+        if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped') }}
         uses: slackapi/slack-github-action@0d95c9a7becc1e6e297d76df9bc735c44f4cbcbc # v3.0.5
         with:
           webhook: ${{ secrets.SLACK_WEBHOOK_URL_RELEASES }}

.gitignore

@@ -1,4 +1,8 @@
 node_modules
+/apps/cli/target
+/apps/cli/*.cdx.json
+/apps/cli/generated/completions/
+/apps/cli/generated/man/
 dist
 coverage
 *.log