ci: build the CLI release through turbo and narrow the release trigger

[userAugustos]

Closes #129. Stacked on #135: the base of this PR is the #135 branch, so the diff shows only this change.

Summary

• The PyPI job builds the wheel and sdist with bun run build --filter=canyonos. On a release runner there is no turbo cache, so this always runs uv build --package canyonos. The publish step passes --check-url so a rerun after a partial failure does not fail on a file that is already uploaded.
• The binary matrix builds with a new build:binary turbo task that holds the Nuitka command. The per-OS asset name reaches --output-filename through turbo's -- passthrough. The task is uncached because a turbo hash does not include the runner OS.
• Nuitka is pinned by uv.lock through a release dependency group of the CLI package. A plain uv sync skips that group; the release job syncs it explicitly.
• The release trigger excludes packages/cli/tests, Markdown files, and install.sh. A change that ships nothing no longer cuts a release. The version bump still refreshes uv.lock in the same commit.
• The core image workflow does not change. It already builds from packages/core with per-package triggers, and a turbo wrapper would cache nothing for a pushed multi-arch image.
• Tag names, asset names, install.sh, and the Homebrew formula are unchanged.

Test

• bun run build --filter=canyonos from a checkout with no .venv writes only dist/canyonos-*.
• uv sync --locked does not install nuitka; uv sync --locked --package canyonos --group release does.
• bun run build:binary --filter=canyonos --dry-run=json -- --output-filename=x shows the Nuitka command with the passthrough argument.
• A manual run of cli-release.yml against an existing tag rebuilds and reattaches the four binaries.
• bun run check and bun run test pass.

Review Focus

• .github/workflows/cli-release.yml: the three replaced steps and the -- passthrough.
• .github/workflows/cli-release-tag.yml: the negated paths and the [skip release] guard, which the bump commit still needs because packages/cli/pyproject.toml stays a released path.
• turbo.json: the build:binary task is the single source of the Nuitka flags.

Known and accepted

• The four-OS Nuitka compile, asset attachment, and the PyPI upload are only exercised by a real release or a manual dispatch of cli-release.yml.
• The auto-bump flow stays. release-please was evaluated and parked: most commits on main are not conventional commits, PRs land as merge commits, and release-please does not update uv.lock.
• actionlint reports the macos-15-intel runner label as unknown. The label is valid; the linter's list is stale.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}