feat: CLI distribution — install script, Docker image, CI tests, remove musl from Python/Node

- Remove musllinux targets from Python wheel builds (publish + CI)
- Remove musl targets from Node.js NAPI builds
- Replace cross-compiled musl CLI with Docker-based Alpine builds
- Add cli-musl-binaries job using Dockerfile.musl-build for fully static binaries
- Add docker/Dockerfile.cli for minimal CLI Docker image
- Add scripts/install.sh curl-pipe-bash installer
- Add CLI variant to publish-docker.yaml (ghcr.io/kreuzberg-dev/kreuzberg-cli)
- Add test-docker-cli job to ci-docker.yaml with comprehensive tests
- Add scripts/test_docker_cli.sh with 13 CLI Docker tests
- Update docs with install script and CLI Docker instructions
- Delete scripts/publish/cli/configure-musl-linker.sh (no longer needed)

Author: Goldziher

.github/workflows/ci-docker.yaml

@@ -12,12 +12,14 @@ on:
       - 'crates/kreuzberg/**'
       - 'crates/kreuzberg-cli/**'
       - 'crates/kreuzberg-tesseract/**'
+      - 'crates/kreuzberg-pdfium-render/**'
       - 'docker/**'
       - '.dockerignore'
       - 'Cargo.toml'
       - 'Cargo.lock'
       - '.cargo/config.toml'
       - 'scripts/ci/docker/**'
+      - 'scripts/test_docker*.sh'
   pull_request:
     branches: [main]
     paths:
@@ -26,12 +28,14 @@ on:
       - 'crates/kreuzberg/**'
       - 'crates/kreuzberg-cli/**'
       - 'crates/kreuzberg-tesseract/**'
+      - 'crates/kreuzberg-pdfium-render/**'
       - 'docker/**'
       - '.dockerignore'
       - 'Cargo.toml'
       - 'Cargo.lock'
       - '.cargo/config.toml'
       - 'scripts/ci/docker/**'
+      - 'scripts/test_docker*.sh'
   workflow_dispatch:
     inputs:
       skip_tests:
@@ -161,3 +165,103 @@ jobs:
         if: success()
         shell: bash
         run: scripts/ci/docker/summary.sh "${{ matrix.variant }}" /tmp/kreuzberg-docker-test-results.json
+
+  test-docker-cli:
+    name: Build and Test Docker CLI Image
+    if: ${{ github.actor != 'dependabot[bot]' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 180
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Free up disk space
+        shell: bash
+        run: scripts/ci/docker/free-disk-space.sh
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build Docker CLI image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: docker/Dockerfile.cli
+          push: false
+          load: true
+          tags: kreuzberg:cli
+          cache-from: type=gha
+          cache-to: type=gha,mode=max,scope=ci-docker-cli
+
+      - name: Test Docker image size
+        shell: bash
+        run: |
+          size_mb=$(docker inspect kreuzberg:cli --format='{{.Size}}' | awk '{print int($1/1024/1024)}')
+          echo "CLI image size: ${size_mb}MB"
+          if [ "$size_mb" -gt 200 ]; then
+            echo "::warning::CLI image is larger than 200MB (${size_mb}MB). Expected a minimal static binary image."
+          fi
+
+      - name: Run CLI feature tests
+        if: ${{ !inputs.skip_tests }}
+        run: scripts/ci/docker/run-cli-tests.sh
+
+      - name: Save Docker image as artifact
+        if: success()
+        shell: bash
+        run: |
+          mkdir -p /tmp
+          docker save kreuzberg:cli | gzip > /tmp/kreuzberg-cli.tar.gz
+          ls -lh /tmp/kreuzberg-cli.tar.gz
+
+      - name: Upload Docker image artifact
+        if: success()
+        uses: actions/upload-artifact@v4
+        with:
+          name: docker-image-cli
+          path: /tmp/kreuzberg-cli.tar.gz
+          retention-days: 7
+          compression-level: 0
+
+      - name: Upload test results
+        if: always() && !inputs.skip_tests && hashFiles('/tmp/kreuzberg-docker-cli-test-results.json') != ''
+        uses: actions/upload-artifact@v4
+        with:
+          name: docker-test-results-cli
+          path: /tmp/kreuzberg-docker-cli-test-results.json
+          retention-days: 7
+
+      - name: Collect Docker logs on failure
+        if: failure()
+        shell: bash
+        run: scripts/ci/docker/collect-logs.sh /tmp/docker-logs
+
+      - name: Upload Docker logs
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: docker-logs-cli
+          path: /tmp/docker-logs/
+          retention-days: 7
+
+      - name: Clean up Docker resources
+        if: always()
+        shell: bash
+        run: |
+          docker ps -aq --filter "name=kreuzberg-cli-test" | xargs -r docker rm -f || true
+          docker rmi kreuzberg:cli || true
+          docker system prune -af --volumes || true
+
+      - name: Summary
+        if: success()
+        shell: bash
+        run: |
+          echo "Docker CLI image built and tested successfully!"
+          echo "Image: kreuzberg:cli"
+          if [ -f /tmp/kreuzberg-docker-cli-test-results.json ]; then
+            echo "Test Results:"
+            jq . < /tmp/kreuzberg-docker-cli-test-results.json || cat /tmp/kreuzberg-docker-cli-test-results.json
+          fi

.github/workflows/ci-python.yaml

@@ -208,66 +208,6 @@ jobs:
         shell: bash
         run: scripts/ci/python/smoke-test-wheel.sh
 
-  build-musllinux-python:
-    name: Python musllinux Build (${{ matrix.label }})
-    if: ${{ github.actor != 'dependabot[bot]' }}
-    timeout-minutes: 180
-    strategy:
-      fail-fast: true
-      matrix:
-        include:
-          - os: ubuntu-latest
-            label: linux-x86_64-musllinux
-            rust_target: x86_64-unknown-linux-musl
-            manylinux: musllinux_1_2
-          - os: ubuntu-24.04-arm
-            label: linux-aarch64-musllinux
-            rust_target: aarch64-unknown-linux-musl
-            manylinux: musllinux_1_2
-    runs-on: ${{ matrix.os }}
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Free disk space before setup
-        if: matrix.os == 'ubuntu-latest'
-        uses: ./.github/actions/free-disk-space-linux
-        with:
-          show-initial: "true"
-          show-final: "true"
-
-      - name: Build musllinux wheels
-        uses: PyO3/maturin-action@v1
-        with:
-          command: build
-          args: --release -i python3.10 --out ../../target/wheels
-          target: ${{ matrix.rust_target }}
-          manylinux: ${{ matrix.manylinux }}
-          working-directory: packages/python
-          sccache: false
-          before-script-linux: |
-            set -euo pipefail
-            rustup component add rust-src || true
-            if command -v apk &>/dev/null; then
-              apk add --no-cache openssl-dev pkgconf clang clang-dev libc++-dev musl-dev cmake make build-base
-            elif command -v apt-get &>/dev/null; then
-              apt-get update && apt-get install -y libssl-dev pkg-config clang cmake make musl-tools
-            fi
-            echo "=== Building CLI Binary (musllinux) ==="
-            cargo build --release --package kreuzberg-cli --features all
-            mkdir -p kreuzberg
-            cp ../../target/release/kreuzberg kreuzberg/kreuzberg-cli
-
-      - name: List built wheels
-        shell: bash
-        run: ls -lh target/wheels
-
-      - name: Upload wheels
-        uses: actions/upload-artifact@v4
-        with:
-          name: wheels-${{ matrix.label }}
-          path: target/wheels/*.whl
-          retention-days: 7
-
   build-python-sdist:
     name: Python Sdist
     if: ${{ github.actor != 'dependabot[bot]' }}

.github/workflows/publish-docker.yaml

@@ -121,6 +121,7 @@ jobs:
     outputs:
       core_exists: ${{ steps.core.outputs.exists }}
       full_exists: ${{ steps.full.outputs.exists }}
+      cli_exists: ${{ steps.cli.outputs.exists }}
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -148,6 +149,13 @@ jobs:
           SUMMARY_LABEL: full
         run: scripts/publish/check-docker-tag.sh
 
+      - name: Check CLI image tag
+        id: cli
+        env:
+          DOCKER_TAG: ghcr.io/kreuzberg-dev/kreuzberg-cli:${{ needs.prepare.outputs.version }}
+          SUMMARY_LABEL: cli
+        run: scripts/publish/check-docker-tag.sh
+
   publish-docker:
     name: Publish Docker image (${{ matrix.variant }})
     needs:
@@ -172,6 +180,11 @@ jobs:
             image: ghcr.io/kreuzberg-dev/kreuzberg
             tag_suffix: ""
             extra_tag: "latest"
+          - variant: cli
+            dockerfile: docker/Dockerfile.cli
+            image: ghcr.io/kreuzberg-dev/kreuzberg-cli
+            tag_suffix: ""
+            extra_tag: "latest"
     if: ${{ needs.prepare.outputs.release_docker == 'true' }}
     steps:
       - name: Checkout
@@ -195,27 +208,27 @@ jobs:
         uses: docker/setup-buildx-action@v3
 
       - name: Skip because tag already exists
-        if: ${{ needs.prepare.outputs.force_republish != 'true' && ((matrix.variant == 'core' && needs.check-docker.outputs.core_exists == 'true') || (matrix.variant == 'full' && needs.check-docker.outputs.full_exists == 'true')) }}
+        if: ${{ needs.prepare.outputs.force_republish != 'true' && ((matrix.variant == 'core' && needs.check-docker.outputs.core_exists == 'true') || (matrix.variant == 'full' && needs.check-docker.outputs.full_exists == 'true') || (matrix.variant == 'cli' && needs.check-docker.outputs.cli_exists == 'true')) }}
         run: echo "Docker tag already exists for variant ${{ matrix.variant }}; skipping publish." >> "$GITHUB_STEP_SUMMARY"
 
       - name: Build AMD64 test image
-        if: ${{ needs.prepare.outputs.force_republish == 'true' || (matrix.variant == 'core' && needs.check-docker.outputs.core_exists != 'true') || (matrix.variant == 'full' && needs.check-docker.outputs.full_exists != 'true') }}
+        if: ${{ needs.prepare.outputs.force_republish == 'true' || (matrix.variant == 'core' && needs.check-docker.outputs.core_exists != 'true') || (matrix.variant == 'full' && needs.check-docker.outputs.full_exists != 'true') || (matrix.variant == 'cli' && needs.check-docker.outputs.cli_exists != 'true') }}
         run: docker build -f ${{ matrix.dockerfile }} --build-arg PDFIUM_VERSION=${{ env.PDFIUM_VERSION }} --build-arg ONNXRUNTIME_VERSION=${{ env.ORT_VERSION }} -t kreuzberg-publish:${{ matrix.variant }}-test .
 
       - name: Run Docker feature tests
-        if: ${{ needs.prepare.outputs.force_republish == 'true' || (matrix.variant == 'core' && needs.check-docker.outputs.core_exists != 'true') || (matrix.variant == 'full' && needs.check-docker.outputs.full_exists != 'true') }}
+        if: ${{ needs.prepare.outputs.force_republish == 'true' || (matrix.variant == 'core' && needs.check-docker.outputs.core_exists != 'true') || (matrix.variant == 'full' && needs.check-docker.outputs.full_exists != 'true') || (matrix.variant == 'cli' && needs.check-docker.outputs.cli_exists != 'true') }}
         run: ./scripts/test_docker.sh --skip-build --image kreuzberg-publish:${{ matrix.variant }}-test --variant ${{ matrix.variant }} --verbose
 
       - name: Log in to GitHub Container Registry
-        if: ${{ needs.prepare.outputs.dry_run != 'true' && (needs.prepare.outputs.force_republish == 'true' || (matrix.variant == 'core' && needs.check-docker.outputs.core_exists != 'true') || (matrix.variant == 'full' && needs.check-docker.outputs.full_exists != 'true')) }}
+        if: ${{ needs.prepare.outputs.dry_run != 'true' && (needs.prepare.outputs.force_republish == 'true' || (matrix.variant == 'core' && needs.check-docker.outputs.core_exists != 'true') || (matrix.variant == 'full' && needs.check-docker.outputs.full_exists != 'true') || (matrix.variant == 'cli' && needs.check-docker.outputs.cli_exists != 'true')) }}
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Extract Docker metadata
-        if: ${{ needs.prepare.outputs.dry_run != 'true' && (needs.prepare.outputs.force_republish == 'true' || (matrix.variant == 'core' && needs.check-docker.outputs.core_exists != 'true') || (matrix.variant == 'full' && needs.check-docker.outputs.full_exists != 'true')) }}
+        if: ${{ needs.prepare.outputs.dry_run != 'true' && (needs.prepare.outputs.force_republish == 'true' || (matrix.variant == 'core' && needs.check-docker.outputs.core_exists != 'true') || (matrix.variant == 'full' && needs.check-docker.outputs.full_exists != 'true') || (matrix.variant == 'cli' && needs.check-docker.outputs.cli_exists != 'true')) }}
         id: docker_meta
         uses: docker/metadata-action@v5
         with:
@@ -225,7 +238,7 @@ jobs:
             type=raw,value=${{ matrix.extra_tag }}
 
       - name: Build and push image
-        if: ${{ needs.prepare.outputs.dry_run != 'true' && (needs.prepare.outputs.force_republish == 'true' || (matrix.variant == 'core' && needs.check-docker.outputs.core_exists != 'true') || (matrix.variant == 'full' && needs.check-docker.outputs.full_exists != 'true')) }}
+        if: ${{ needs.prepare.outputs.dry_run != 'true' && (needs.prepare.outputs.force_republish == 'true' || (matrix.variant == 'core' && needs.check-docker.outputs.core_exists != 'true') || (matrix.variant == 'full' && needs.check-docker.outputs.full_exists != 'true') || (matrix.variant == 'cli' && needs.check-docker.outputs.cli_exists != 'true')) }}
         uses: docker/build-push-action@v6
         with:
           context: .