Skip to content

feat: mlbundle 0.3.0 with runtime environment locks - #25

Merged
UlloaSP merged 8 commits into
mainfrom
develop
Oct 28, 2026
Merged

UlloaSP merged 8 commits into
mainfrom
develop

Conversation

@UlloaSP

@UlloaSP UlloaSP commented Oct 28, 2026

Copy link
Copy Markdown
Owner

Summary

mlbundle 0.3.0. Every bundle now carries pylock.toml, a canonical PEP 751 lock of what serving the model needs, so runtimes such as MLSuite can build one environment per lock instead of pinning a single scikit-learn version.

  • Targets: CPython with the GIL on linux-x86_64, linux-aarch64 (glibc 2.28+) and win-amd64. The manifest's writer_version pins mlbundle itself.
  • Export: pins the installed versions of pydantic and the model libraries, constrains every other installed distribution and resolves one preferred wheel per target with uv (new lock extra). environment_lock= accepts a prepared lock instead. Locked versions installed at training must match.
  • Inspect/load: validate canonical bytes, closed fields, wheel selection and the manifest binding without model libraries.
  • Serving: check_environment(view) requires exactly the target's locked distributions plus mlbundle at writer_version.
  • Manifest: drops environment.packages and records free_threaded. Format 1 stays unfrozen; bundles without pylock.toml must be re-exported.
  • Sites: docs gain the normative docs/format-environment.md; the landing shows the lock; the playground passes a lock prepared for its Pyodide versions (playground/scripts/lock.py).

Verification

  • ruff check, ruff format --check, pyright, pytest (1849 passed, 92.28% coverage, including a real uv resolution) and uv build.
  • vp run check, vp run build, playground test:runtime (10/10) and test:e2e (6/6).
  • Bundles exported on Windows, installed from their lock in clean environments, pass check_environment, load and predict on Windows and on Linux (WSL). The real CatBoost composite BP_All predicts identically to the original model (max difference 0.0).

Add the landing, documentation and playground sites with shared eshkra
branding, tested builds and Cloudflare deployment from main. Publish to
PyPI automatically when a push to main changes project.version, using the
CI-built distributions and the pypi_env token. Move schema inference to
mlschema 0.3 and prepare version 0.2.0.
PyPI renders the README without the repository, so relative links to docs,
LICENSE and site folders broke. Point them at the deployed sites and GitHub,
and test that every README link is absolute.
Publish the absolute README links to PyPI; 0.2.0's project page keeps the
broken relative links because published releases cannot change.
Every bundle now carries pylock.toml, a canonical PEP 751 lock of the
model's runtime distributions for CPython with the GIL on linux-x86_64,
linux-aarch64 (glibc 2.28+) and win-amd64. The manifest's writer_version
pins mlbundle itself, so unreleased versions can still export.

- export pins installed versions and resolves one wheel per target with
  uv (new lock extra), or accepts environment_lock=; locked versions
  installed at training must match
- inspect/load validate canonical bytes, closed fields, preferred-wheel
  selection and the manifest binding without model libraries
- check_environment verifies a serving interpreter against the lock
- manifest drops environment.packages and records free_threaded; bundles
  without pylock.toml must be re-exported
- docs, landing and playground (prepared Pyodide lock) updated
@coderabbitai

coderabbitai Bot commented Oct 28, 2026 •

Copy link
Copy Markdown

Important

  • 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 4b0d24c6-8f30-4fdc-bf6a-ad8f3a4e0432
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addedpypi/​uv@​0.13.6100100100100100

View full report

@UlloaSP
UlloaSP merged commit 6dd8bba into main Oct 28, 2026
21 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant