grzegorz-roboflow · Oct 19, 2026 · Aug 31, 2026 · Aug 31, 2026 · Sep 1, 2026 · Sep 1, 2026
@@ -1,4 +1,5 @@
 name: Build inference_server images
+run-name: Build inference_server images (${{ (!inputs.cpu && !inputs.gpu && !inputs.jetson_5_1_1 && !inputs.jetson_6_0_0 && !inputs.jetson_6_2_0) && 'all' || '' }}${{ inputs.cpu && 'cpu' || '' }}${{ inputs.gpu && format('{0}gpu', inputs.cpu && ', ' || '') || '' }}${{ inputs.jetson_5_1_1 && format('{0}jetson-5.1.1', (inputs.cpu || inputs.gpu) && ', ' || '') || '' }}${{ inputs.jetson_6_0_0 && format('{0}jetson-6.0.0', (inputs.cpu || inputs.gpu || inputs.jetson_5_1_1) && ', ' || '') || '' }}${{ inputs.jetson_6_2_0 && format('{0}jetson-6.2.0', (inputs.cpu || inputs.gpu || inputs.jetson_5_1_1 || inputs.jetson_6_0_0) && ', ' || '') || '' }})
 
 # Manual only. When you click "Run workflow", pick your branch as the ref —
 # it builds that ref's code (never main on its own). Tick the targets you want;
@@ -15,7 +16,7 @@ on:
         default: false
       cpu:
         type: boolean
-        description: "Build CPU (amd64)"
+        description: "Build CPU (amd64 + arm64/Apple Silicon)"
         default: false
       jetson_5_1_1:
         type: boolean
@@ -31,7 +32,7 @@ on:
         default: false
       tag_suffix:
         type: string
-        description: "Postfix appended to image tag, e.g. -test → :gpu-0.1.0-test"
+        description: "Postfix appended after a dash, e.g. test → :gpu-0.1.0-test (no leading dash needed)"
         default: ""
       push:
         type: boolean
@@ -46,16 +47,23 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       matrix: ${{ steps.set.outputs.matrix }}
-      version: ${{ steps.ver.outputs.version }}
+      server_version: ${{ steps.ver.outputs.server_version }}
+      manager_version: ${{ steps.ver.outputs.manager_version }}
+      models_version: ${{ steps.ver.outputs.models_version }}
     steps:
       - name: Checkout
         uses: actions/checkout@v6
-      - name: Read inference_server version
+      - name: Read package versions
         id: ver
         run: |
-          v=$(python -c "import tomllib; print(tomllib.load(open('inference_server/pyproject.toml','rb'))['project']['version'])")
-          echo "version=$v" >> "$GITHUB_OUTPUT"
-          echo "inference_server version: $v"
+          get() { python -c "import tomllib,sys; print(tomllib.load(open(sys.argv[1],'rb'))['project']['version'])" "$1"; }
+          sv=$(get inference_server/pyproject.toml)
+          mv=$(get inference_model_manager/pyproject.toml)
+          iv=$(get inference_models/pyproject.toml)
+          echo "server_version=$sv"  >> "$GITHUB_OUTPUT"
+          echo "manager_version=$mv" >> "$GITHUB_OUTPUT"
+          echo "models_version=$iv"  >> "$GITHUB_OUTPUT"
+          echo "inference_server=$sv  inference_model_manager=$mv  inference_models=$iv"
       - name: Compute build matrix (none selected = all)
         id: set
         env:
@@ -69,7 +77,7 @@ jobs:
           all_json=$(cat <<EOF
           [
             {"name":"gpu","dockerfile":"inference_server/docker/Dockerfile.gpu","platform":"linux/amd64","depot_project":"grl7ffzxd7","sel":"$GPU"},
-            {"name":"cpu","dockerfile":"inference_server/docker/Dockerfile.cpu","platform":"linux/amd64","depot_project":"grl7ffzxd7","sel":"$CPU"},
+            {"name":"cpu","dockerfile":"inference_server/docker/Dockerfile.cpu","platform":"linux/amd64,linux/arm64","depot_project":"grl7ffzxd7","sel":"$CPU"},
             {"name":"jetson-5.1.1","dockerfile":"inference_server/docker/Dockerfile.jetson.5.1.1","platform":"linux/arm64","depot_project":"2rp7mfjw7q","sel":"$J511"},
             {"name":"jetson-6.0.0","dockerfile":"inference_server/docker/Dockerfile.jetson.6.0.0","platform":"linux/arm64","depot_project":"2rp7mfjw7q","sel":"$J600"},
             {"name":"jetson-6.2.0","dockerfile":"inference_server/docker/Dockerfile.jetson.6.2.0","platform":"linux/arm64","depot_project":"2rp7mfjw7q","sel":"$J620"}
@@ -115,4 +123,10 @@ jobs:
           platforms: ${{ matrix.platform }}
           pull: true
           push: ${{ inputs.push }}
-          tags: ${{ env.IMAGE }}:${{ matrix.name }}-${{ needs.setup.outputs.version }}${{ inputs.tag_suffix }}
+          tags: ${{ env.IMAGE }}:${{ matrix.name }}-${{ needs.setup.outputs.server_version }}${{ inputs.tag_suffix != '' && format('-{0}', inputs.tag_suffix) || '' }}
+          labels: |
+            org.opencontainers.image.version=${{ needs.setup.outputs.server_version }}
+            org.opencontainers.image.revision=${{ github.sha }}
+            com.roboflow.inference_server.version=${{ needs.setup.outputs.server_version }}
+            com.roboflow.inference_model_manager.version=${{ needs.setup.outputs.manager_version }}
+            com.roboflow.inference_models.version=${{ needs.setup.outputs.models_version }}
@@ -102,12 +102,15 @@ jobs:
         run: |
           python -m pip install --upgrade pip
           pip install --upgrade setuptools
-          pip install -r requirements/_requirements.txt \
+          pip install --extra-index-url https://download.pytorch.org/whl/cpu \
+                      -r requirements/_requirements.txt \
                       -r requirements/requirements.cpu.txt \
                       -r requirements/requirements.http.txt \
                       -r requirements/requirements.sdk.http.txt \
                       -r requirements/requirements.sdk.webrtc.txt \
-                      -r requirements/requirements.test.unit.txt
+                      -r requirements/requirements.test.unit.txt \
+                      -r requirements/requirements.transformers.txt
+          pip install --no-deps './inference_models[torch-cpu,onnx-cpu]'
 
       - name: 🏗️ Build and install same-checkout server dependencies
         run: |

@@ -46,7 +46,7 @@ jobs:
           python -m pip install --upgrade pip
           pip install --upgrade setuptools
           pip install --extra-index-url https://download.pytorch.org/whl/cpu -r requirements/_requirements.txt -r requirements/requirements.cpu.txt -r requirements/requirements.sdk.http.txt -r requirements/requirements.test.unit.txt -r requirements/requirements.http.txt -r requirements/requirements.yolo_world.txt -r requirements/requirements.doctr.txt -r requirements/requirements.sam.txt -r requirements/requirements.transformers.txt -r requirements/requirements.cli.txt -r requirements/requirements.sdk.http.txt
-          pip install --no-deps ./inference_models
+          pip install --no-deps './inference_models[torch-cpu,onnx-cpu]'
       - name: 🏗️ Build and install roboflow-workflows and streamvision wheels
         run: |
           make create_workflows_wheel create_streamvision_wheel

@@ -55,6 +55,7 @@ jobs:
           python -m pip install --upgrade pip
           pip install --upgrade setuptools
           pip install --extra-index-url https://download.pytorch.org/whl/cpu -r requirements/_requirements.txt -r requirements/requirements.cpu.txt -r requirements/requirements.sdk.http.txt -r requirements/requirements.test.unit.txt -r requirements/requirements.http.txt -r requirements/requirements.yolo_world.txt -r requirements/requirements.sam.txt -r requirements/requirements.transformers.txt
+          pip install --no-deps './inference_models[torch-cpu,onnx-cpu]'
       - name: 🏗️ Build and install roboflow-workflows and streamvision wheels
         run: |
           make create_workflows_wheel create_streamvision_wheel

@@ -22,6 +22,13 @@ on:
         description: "Prebuilt roboflow/roboflow-inference-server-cpu tag to test (e.g. 1.6.2-post3-rc1). Empty = build the image from this ref."
         type: string
         default: ""
+      server-image:
+        description: "Server under test: legacy inference image or the new inference_server image"
+        type: choice
+        default: legacy
+        options:
+          - legacy
+          - new
   workflow_call:
     # Called by fast_track_integration_tests.yml with a prebuilt image tag, so
     # the 15-minute in-job image build is skipped.
@@ -95,6 +102,9 @@ jobs:
       contents: read
       id-token: write
     env:
+      SERVER_IMAGE: ${{ github.event.inputs.server-image || 'legacy' }}
+      INFERENCE_SERVER_REPO: ${{ github.event.inputs.server-image == 'new' && 'inference-server-experimental' || 'roboflow-inference-server-cpu' }}
+      PYTEST_EXTRA_ARGS: ${{ github.event.inputs.server-image == 'new' && '--ignore=tests/inference/integration_tests/test_video_processing_endpoints.py --ignore=tests/inference/integration_tests/yolo_world_test.py --deselect tests/inference/integration_tests/test_workflow_endpoints.py::test_compilation_endpoint_when_compilation_succeeds_with_custom_block' || '' }}
       MODEL_MODE: ${{ matrix.use-inference-models }}
       IMAGE_FAMILY: cpu
       IMAGE_TAG: ${{ inputs.image_tag }}
@@ -107,7 +117,7 @@ jobs:
     strategy:
       fail-fast: true
       matrix:
-        use-inference-models: ${{ fromJSON((inputs.use-inference-models || 'all') == 'all'&& '["true","false"]'|| format('["{0}"]', inputs.use-inference-models)) }}
+        use-inference-models: ${{ fromJSON(github.event.inputs.server-image == 'new' && '["true"]' || ((inputs.use-inference-models || 'all') == 'all' && '["true","false"]' || format('["{0}"]', inputs.use-inference-models))) }}
     timeout-minutes: 60
 
     steps:
@@ -160,7 +170,7 @@ jobs:
           python -m pip install --upgrade pip
           python -m pip install -r requirements/requirements.test.unit.txt -r requirements/requirements.test.integration.txt -r requirements/requirements.code_analysis.txt
       - name: 🔨 Build and Push Test Docker
-        if: ${{ inputs.image_tag == '' && inputs.image_digest == '' && !inputs.private_image }}
+        if: ${{ env.SERVER_IMAGE == 'legacy' && inputs.image_tag == '' && inputs.image_digest == '' && !inputs.private_image }}
         run: |
           docker pull roboflow/roboflow-inference-server-cpu:test
           docker build -t roboflow/roboflow-inference-server-cpu:test -f docker/dockerfiles/Dockerfile.onnx.cpu .
@@ -182,9 +192,13 @@ jobs:
             -e CPU_IMAGE_TEST=true \
             -v "$PWD/tests/docker/test_cpu_torch_runtime.py:/test_cpu_torch_runtime.py:ro" \
             "$INFERENCE_TEST_IMAGE" -c 'python3 -m pip install pytest && python3 -m pytest /test_cpu_torch_runtime.py -v'
+      - name: 🔨 Build Test Docker - inference_server
+        if: ${{ env.SERVER_IMAGE == 'new' && inputs.image_digest == '' && !inputs.private_image }}
+        run: |
+          docker build -t roboflow/inference-server-experimental:test -f inference_server/docker/Dockerfile.cpu .
       - name: 🔋 Start Test Docker
         run: |
-          USE_INFERENCE_MODELS="$MODEL_MODE" PORT=9101 INFERENCE_SERVER_REPO=roboflow-inference-server-cpu make start_test_docker_cpu
+          USE_INFERENCE_MODELS="$MODEL_MODE" PORT=9101 INFERENCE_SERVER_REPO="$INFERENCE_SERVER_REPO" make start_test_docker_cpu
           CI_IMAGE_ACTION=port python3 .github/scripts/ci_image.py
       - name: 🧪 Integration Tests of inference server [x86 CPU]
         env:
@@ -198,8 +212,13 @@ jobs:
           melee_API_KEY: ${{ secrets.MELEE_API_KEY }}
           yolonas_test_API_KEY: ${{ secrets.YOLONAS_TEST_API_KEY }}
         run: |
-          USE_INFERENCE_MODELS="$MODEL_MODE" PORT="${TEST_PORT:-9101}" SKIP_LMM_TEST=True python -m pytest tests/inference/integration_tests
+          USE_INFERENCE_MODELS="$MODEL_MODE" PORT="${TEST_PORT:-9101}" SKIP_LMM_TEST=True python -m pytest tests/inference/integration_tests $PYTEST_EXTRA_ARGS
           make stop_test_docker
+      - name: 📜 Dump server logs on failure
+        if: failure()
+        run: |
+          docker logs "$INFERENCE_TEST_CONTAINER" --tail 1000 || true
+          make stop_test_docker || true
       - name: Remove this job's test container
         if: ${{ always() }}
         run: |

@@ -105,7 +105,7 @@ jobs:
           python -m pip install --upgrade pip
           pip install --upgrade setuptools
           pip install --extra-index-url https://download.pytorch.org/whl/cpu -r requirements/_requirements.txt -r requirements/requirements.sam.txt -r requirements/requirements.cpu.txt -r requirements/requirements.http.txt -r requirements/requirements.test.unit.txt -r requirements/requirements.doctr.txt -r requirements/requirements.yolo_world.txt -r requirements/requirements.transformers.txt -r requirements/requirements.sdk.http.txt -r requirements/requirements.easyocr.txt
-          pip install --no-deps ./inference_models
+          pip install --no-deps './inference_models[torch-cpu,onnx-cpu]'
       - name: 🔤 Cache Workflows font assets
         uses: actions/cache@v5
         with:

@@ -0,0 +1,177 @@
+name: publish inference-server stack
+on:
+  #release:
+  #  types: [created]
+  workflow_dispatch:
+    inputs:
+      publish:
+        description: "Actually publish the package to PyPI"
+        required: false
+        default: false
+        type: boolean
+      candidate_run_id:
+        description: "Run id of the build-candidates run to publish"
+        required: false
+        default: ""
+        type: string
+
+# build-candidates only reads the checkout; publish-gated widens this for
+# trusted publishing.
+permissions:
+  contents: read
+
+jobs:
+  build-candidates:
+    if: ${{ !inputs.publish }}
+    runs-on:
+      labels: depot-ubuntu-22.04-small
+      group: public-depot
+    steps:
+      - name: 🛎️ Checkout
+        uses: actions/checkout@v4
+      - name: 📦 Set up uv
+        uses: astral-sh/setup-uv@v5
+      - name: Assert matching versions
+        run: |
+          python - <<'EOF'
+          import tomllib
+          v1 = tomllib.load(open("inference_model_manager/pyproject.toml","rb"))["project"]["version"]
+          v2 = tomllib.load(open("inference_server/pyproject.toml","rb"))["project"]["version"]
+          assert v1 == v2, f"version mismatch: {v1} != {v2}"
+          EOF
+      - name: 🔨 Build inference-model-manager
+        run: cd inference_model_manager && uv build
+      - name: 🔨 Build inference-server
+        run: cd inference_server && uv build
+      - name: Guard against private module leaks
+        run: |
+          set -euo pipefail
+          python - <<'EOF'
+          import fnmatch
+          import pathlib
+          import sys
+          import tarfile
+          import zipfile
+
+          DISTS = {
+              "inference_model_manager": pathlib.Path("inference_model_manager/dist"),
+              "inference_server": pathlib.Path("inference_server/dist"),
+          }
+          SDIST_SCAFFOLDING = {
+              "PKG-INFO",
+              "MANIFEST.in",
+              "pyproject.toml",
+              "setup.cfg",
+              "setup.py",
+              "README",
+              "README.md",
+              "README.rst",
+              "README.txt",
+              "LICENSE",
+              "LICENCE",
+              "LICENSE.md",
+              "LICENSE.txt",
+              "NOTICE",
+              "NOTICE.md",
+              "NOTICE.txt",
+          }
+
+          failures = []
+
+          def allowed(package, name):
+              if name == package:
+                  return True
+              for pattern in (
+                  f"{package}-*.dist-info",
+                  f"{package}-*.data",
+                  f"{package}.egg-info",
+                  f"{package}-*.egg-info",
+              ):
+                  if fnmatch.fnmatch(name, pattern):
+                      return True
+              return name in SDIST_SCAFFOLDING
+
+          def members_of(path):
+              if path.name.endswith(".whl"):
+                  with zipfile.ZipFile(path) as archive:
+                      return [n for n in archive.namelist() if n.strip("/")], False
+              if path.name.endswith((".tar.gz", ".tgz")):
+                  with tarfile.open(path) as archive:
+                      return [m.name for m in archive.getmembers() if m.name.strip("./")], True
+              raise ValueError(f"unrecognised distribution file: {path}")
+
+          def top_levels(path):
+              names, is_sdist = members_of(path)
+              if not names:
+                  raise ValueError(f"{path}: archive is empty")
+              tops = set()
+              for name in names:
+                  parts = [p for p in name.replace("\\", "/").split("/") if p not in ("", ".")]
+                  if not parts:
+                      continue
+                  if is_sdist:
+                      # sdists nest everything under a single <name>-<version>/ root
+                      if len(parts) < 2:
+                          continue
+                      tops.add(parts[1])
+                  else:
+                      tops.add(parts[0])
+              if not tops:
+                  raise ValueError(f"{path}: no inspectable entries")
+              return tops
+
+          for package, dist_dir in DISTS.items():
+              if not dist_dir.is_dir():
+                  failures.append(f"{dist_dir}: directory missing")
+                  continue
+              files = sorted(p for p in dist_dir.iterdir() if p.is_file())
+              if not files:
+                  failures.append(f"{dist_dir}: no distribution files built")
+                  continue
+              print(f"{package}: inspecting {len(files)} distribution file(s)")
+              for path in files:
+                  try:
+                      tops = top_levels(path)
+                  except (ValueError, tarfile.TarError, zipfile.BadZipFile) as error:
+                      failures.append(str(error))
+                      continue
+                  for name in sorted(tops):
+                      if not allowed(package, name):
+                          failures.append(f"{path}: disallowed top-level entry {name!r}")
+
+          if failures:
+              for failure in failures:
+                  print(f"LEAK GUARD FAILURE: {failure}")
+              sys.exit(1)
+          print("leak guard: all distribution files contain only allowlisted top-level entries")
+          EOF
+      - name: 📦 Bundle candidates
+        run: |
+          mkdir -p /tmp/candidate/dists
+          cp inference_model_manager/dist/* inference_server/dist/* /tmp/candidate/dists/
+          (cd /tmp/candidate/dists && shasum -a 256 * > ../SHA256SUMS)
+      - uses: actions/upload-artifact@v4
+        with:
+          name: public-wheels
+          path: /tmp/candidate/
+  publish-gated:
+    if: ${{ inputs.publish }}
+    runs-on:
+      labels: depot-ubuntu-22.04-small
+      group: public-depot
+    permissions:
+      id-token: write
+      contents: read
+      actions: read
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: public-wheels
+          path: /tmp/candidate
+          run-id: ${{ inputs.candidate_run_id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Verify candidate checksums
+        run: cd /tmp/candidate/dists && shasum -a 256 -c ../SHA256SUMS
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: /tmp/candidate/dists/