v2.15.0 (#773)

Co-authored-by: Kim-Adeline Miguel <51720070+kimadeline@users.noreply.github.com>
Co-authored-by: Mathias Gesbert <mathias.gesbert@mistral.ai>
Co-authored-by: Maxime Dolores <maxime.dolores@ext.mistral.ai>
Co-authored-by: Nelson PROIA <144663685+Nelson-PROIA@users.noreply.github.com>
Co-authored-by: Paul VEZIA <166131032+le-codeur-rapide@users.noreply.github.com>
Co-authored-by: Pierre Rossinès <pierre.rossines@mistral.ai>
Co-authored-by: Quentin <quentin.torroba@mistral.ai>
Co-authored-by: Val <102326092+vdeva@users.noreply.github.com>
Co-authored-by: Vincent G <10739306+VinceOPS@users.noreply.github.com>
Co-authored-by: Mistral Vibe <vibe@mistral.ai>

scripts/ci/build-pyinstaller-binaries.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [ "$#" -eq 0 ]; then
+  echo "Usage: $0 <pyinstaller-spec> [<pyinstaller-spec> ...]" >&2
+  exit 2
+fi
+
+uv sync --no-dev --group build
+
+for spec in "$@"; do
+  uv run --no-dev --group build pyinstaller "${spec}"
+done

scripts/ci/clear-linux-execstack.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [ "$#" -eq 0 ]; then
+  echo "Usage: $0 <pyinstaller-bundle-dir> [<pyinstaller-bundle-dir> ...]" >&2
+  exit 2
+fi
+
+for bundle_dir in "$@"; do
+  internal_dir="${bundle_dir}/_internal"
+  binary_name="$(basename "${bundle_dir}")"
+  binary_name="${binary_name%-dir}"
+  binary_path="${bundle_dir}/${binary_name}"
+
+  find "${internal_dir}" -name '*.so*' -type f -print0 | while IFS= read -r -d '' library; do
+    patchelf --clear-execstack "${library}"
+  done
+
+  if [ -f "${binary_path}" ]; then
+    patchelf --clear-execstack "${binary_path}" || true
+  fi
+done

scripts/ci/setup-linux-pyinstaller-build.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Build in manylinux for glibc compatibility, then clear executable-stack
+# flags rejected by hardened Linux kernels.
+python_version="${PYTHON_VERSION:-3.12}"
+patchelf_version="${PATCHELF_VERSION:-0.18.0}"
+
+uv python install "${python_version}"
+
+curl -sL "https://github.com/NixOS/patchelf/releases/download/${patchelf_version}/patchelf-${patchelf_version}-$(uname -m).tar.gz" \
+  | tar xz -C /usr/local
+
+find "$(uv python dir)" -name 'libpython*.so*' -type f -exec patchelf --clear-execstack {} \;

scripts/ci/smoke-pyinstaller-cli.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+binary_dir="${1:-dist/vibe-dir}"
+
+if [ -n "${PYTHON_BIN:-}" ]; then
+  read -r -a python_cmd <<< "${PYTHON_BIN}"
+elif command -v uv >/dev/null 2>&1; then
+  python_cmd=(uv run python)
+elif [ -x ".venv/bin/python" ]; then
+  python_cmd=(.venv/bin/python)
+elif [ -x ".venv/Scripts/python.exe" ]; then
+  python_cmd=(.venv/Scripts/python.exe)
+else
+  python_cmd=(python)
+fi
+
+"${python_cmd[@]}" tests/cli/smoke_binary.py "${binary_dir}"