chore: merge master into distributed transport PR

Keep the newer SQLite dependency from master to resolve the conflict.

Assisted-by: Codex:gpt-6

.github/workflows/backend.yml

@@ -355,7 +355,7 @@ jobs:
     with:
       backend: ${{ matrix.backend }}
       build-type: ${{ matrix.build-type }}
-      go-version: "1.25.x"
+      go-version: "1.27.x"
       tag-suffix: ${{ matrix.tag-suffix }}
       lang: ${{ matrix.lang || 'python' }}
       use-pip: ${{ matrix.backend == 'diffusers' }}

.github/workflows/backend_build.yml

@@ -252,7 +252,8 @@ jobs:
           name: digests${{ inputs.tag-suffix }}--${{ inputs.platform-tag || 'single' }}
           path: /tmp/digests/*
           if-no-files-found: error
-          retention-days: 1
+          # Release matrices and their retries can outlive a one-day artifact.
+          retention-days: 7
 
       - name: Build (PR)
         uses: docker/build-push-action@v7

.github/workflows/backend_build_darwin.yml

@@ -22,7 +22,8 @@ on:
         type: string
       go-version:
         description: 'Go version to use'
-        default: '1.24.x'
+        # Go 1.27 stamps pure-Go hosts with SDK metadata that supports modern Metal APIs.
+        default: '1.27.x'
         type: string
       tag-suffix:
         description: 'Tag suffix for the built image'

.github/workflows/backend_pr.yml

@@ -281,7 +281,7 @@ jobs:
     with:
       backend: ${{ matrix.backend }}
       build-type: ${{ matrix.build-type }}
-      go-version: "1.25.x"
+      go-version: "1.27.x"
       tag-suffix: ${{ matrix.tag-suffix }}
       lang: ${{ matrix.lang || 'python' }}
       use-pip: ${{ matrix.backend == 'diffusers' }}

.github/workflows/gallery_publish.yml

@@ -0,0 +1,78 @@
+name: Publish official OCI galleries
+
+on:
+  push:
+    branches: [master]
+    paths:
+      - 'gallery/**'
+      - 'backend/index.yaml'
+      - 'scripts/build/gallery/**'
+      - '.github/workflows/gallery_publish.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: publish-official-galleries
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    if: github.repository == 'mudler/LocalAI' && github.ref == 'refs/heads/master'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    env:
+      COSIGN_EXPERIMENTAL: '1'
+      GALLERY_REPOSITORY: quay.io/go-skynet/local-ai-backends
+    strategy:
+      matrix:
+        include:
+          - source: gallery
+            tag: gallery-models
+          - source: backend
+            tag: gallery-backends
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+      - name: Test and package gallery
+        env:
+          GALLERY_SOURCE: ${{ matrix.source }}
+        run: |
+          go test ./scripts/build/gallery -count=1
+          go run ./scripts/build/gallery . "$GALLERY_SOURCE" "$RUNNER_TEMP/gallery"
+      - uses: oras-project/setup-oras@v1
+        with:
+          version: '1.3.0'
+      - uses: sigstore/cosign-installer@v3
+        with:
+          cosign-release: 'v2.6.5'
+      - name: Login to Quay.io
+        uses: docker/login-action@v4
+        with:
+          registry: quay.io
+          username: ${{ secrets.LOCALAI_REGISTRY_USERNAME }}
+          password: ${{ secrets.LOCALAI_REGISTRY_PASSWORD }}
+      - name: Publish and sign gallery
+        shell: bash
+        env:
+          GALLERY_TAG: ${{ matrix.tag }}
+        run: |
+          set -euo pipefail
+          cd "$RUNNER_TEMP/gallery"
+          files=()
+          while IFS= read -r -d '' file; do
+            files+=("${file#./}:application/yaml")
+          done < <(find . -type f -print0 | sort -z)
+          # Publish an immutable revision, then expose latest only after signing.
+          ref="$GALLERY_REPOSITORY:$GALLERY_TAG-$GITHUB_SHA"
+          oras push --artifact-type application/vnd.localai.gallery.v1 \
+            --format json "$ref" "${files[@]}" > "$RUNNER_TEMP/push.json"
+          digest=$(jq -er '.digest' "$RUNNER_TEMP/push.json")
+          cosign sign --yes --new-bundle-format \
+            --registry-referrers-mode=oci-1-1 "$GALLERY_REPOSITORY@$digest"
+          oras tag "$GALLERY_REPOSITORY@$digest" "$GALLERY_TAG"