refactor: enforce ADR boundaries and extract media encode helpers

.github/actions/cache-docker/action.yml

@@ -0,0 +1,12 @@
+name: 'Setup Docker'
+description: 'Setup Docker Buildx and pre-pull compose images'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+
+    - name: Pull Docker images
+      shell: bash
+      run: docker compose pull --quiet

.github/actions/docker-cleanup/action.yml

@@ -0,0 +1,10 @@
+name: 'Docker Cleanup'
+description: 'Cleanup Docker Compose services and volumes'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Docker compose down
+      if: always()
+      shell: bash
+      run: docker compose down -v

.github/actions/setup-rust-env/action.yml

@@ -0,0 +1,74 @@
+name: 'Setup Rust Environment'
+description: 'Setup Rust toolchain, Python, caching, and common build dependencies'
+
+inputs:
+  python-version:
+    description: 'Python version to install'
+    required: false
+    default: '3.11'
+  rust-components:
+    description: 'Rust components to install (comma-separated)'
+    required: false
+    default: ''
+  cache-pip:
+    description: 'Enable pip caching'
+    required: false
+    default: 'false'
+  install-maturin:
+    description: 'Install maturin for building Python wheels'
+    required: false
+    default: 'false'
+  install-build-deps:
+    description: 'Install protobuf-compiler, mold, and clang on Linux'
+    required: false
+    default: 'true'
+
+runs:
+  using: 'composite'
+  steps:
+    - uses: actions/setup-python@v5
+      with:
+        python-version: ${{ inputs.python-version }}
+        cache: ${{ inputs.cache-pip == 'true' && 'pip' || '' }}
+
+    - uses: dtolnay/rust-toolchain@stable
+      with:
+        components: ${{ inputs.rust-components }}
+
+    - name: Install Linux build dependencies
+      if: runner.os == 'Linux' && inputs.install-build-deps == 'true'
+      shell: bash
+      run: sudo apt-get update && sudo apt-get install -y protobuf-compiler mold clang
+
+    - name: Detect cache key suffix
+      id: cache-suffix
+      shell: bash
+      run: |
+        if [ "${{ runner.os }}" = "Linux" ]; then
+          UBUNTU_VERSION=$(lsb_release -rs | tr -d '.')
+          echo "suffix=ubuntu-${UBUNTU_VERSION}" >> $GITHUB_OUTPUT
+        else
+          echo "suffix=${{ runner.os }}" >> $GITHUB_OUTPUT
+        fi
+
+    - name: Setup sccache
+      uses: mozilla-actions/sccache-action@v0.0.9
+
+    - name: Setup cargo retry wrapper
+      shell: bash
+      run: |
+        mkdir -p "$HOME/.cargo-bin"
+        cp "${{ github.action_path }}/scripts/cargo-with-retry.sh" "$HOME/.cargo-bin/cargo-retry"
+        chmod +x "$HOME/.cargo-bin/cargo-retry"
+        echo "$HOME/.cargo-bin" >> $GITHUB_PATH
+        echo "SCCACHE_IGNORE_SERVER_IO_ERROR=1" >> $GITHUB_ENV
+
+    - uses: Swatinem/rust-cache@v2
+      with:
+        shared-key: rust-stable-${{ runner.os }}-${{ steps.cache-suffix.outputs.suffix }}
+        cache-on-failure: true
+
+    - name: Install maturin
+      if: inputs.install-maturin == 'true'
+      shell: bash
+      run: pip install maturin[patchelf] --upgrade

.github/actions/setup-rust-env/scripts/cargo-with-retry.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+
+set -euo pipefail
+
+TMPFILE=$(mktemp)
+trap "rm -f $TMPFILE" EXIT
+
+cargo "$@" 2>&1 | tee "$TMPFILE"
+EXIT_CODE=${PIPESTATUS[0]}
+
+if grep -qE "502 Bad Gateway|503 Service Unavailable|cache storage failed|dns error|sccache" "$TMPFILE"; then
+  echo ""
+  echo "=== sccache/cache error detected, retrying without sccache ==="
+  echo ""
+  unset RUSTC_WRAPPER
+  unset SCCACHE_GHA_ENABLED
+  cargo "$@"
+else
+  exit $EXIT_CODE
+fi

.github/actions/wait-for-services/action.yml

@@ -0,0 +1,111 @@
+name: 'Wait for Services'
+description: 'Wait for roboflow Docker Compose services to become healthy'
+
+inputs:
+  timeout:
+    description: 'Timeout in seconds for health checks'
+    required: false
+    default: '300'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Wait for services to be healthy
+      shell: bash
+      run: |
+        echo "Waiting for PD, TiKV, and MinIO to become healthy..."
+        timeout ${{ inputs.timeout }} bash -c '
+          for i in {1..30}; do
+            output=$(docker compose ps)
+
+            pd_healthy=0
+            tikv_healthy=0
+            minio_healthy=0
+
+            if echo "$output" | grep "roboflow-pd" | grep -q "healthy"; then
+              pd_healthy=1
+            else
+              echo "  [waiting] pd"
+            fi
+
+            if echo "$output" | grep "roboflow-tikv" | grep -q "healthy"; then
+              tikv_healthy=1
+            else
+              echo "  [waiting] tikv"
+            fi
+
+            if echo "$output" | grep "roboflow-minio" | grep -q "healthy"; then
+              minio_healthy=1
+            else
+              echo "  [waiting] minio"
+            fi
+
+            echo "PD: $pd_healthy/1, TiKV: $tikv_healthy/1, MinIO: $minio_healthy/1 (attempt $i/30)"
+
+            if [ "$pd_healthy" -eq 1 ] && [ "$tikv_healthy" -eq 1 ] && [ "$minio_healthy" -eq 1 ]; then
+              echo "All services are healthy!"
+              docker compose ps
+              exit 0
+            fi
+
+            sleep 10
+          done
+
+          echo "Services not healthy after timeout"
+          docker compose ps
+          echo ""
+          echo "=== PD logs ==="
+          docker compose logs pd --tail 60 || true
+          echo ""
+          echo "=== TiKV logs ==="
+          docker compose logs tikv --tail 60 || true
+          echo ""
+          echo "=== MinIO logs ==="
+          docker compose logs minio --tail 60 || true
+          exit 1
+        '
+
+    - name: Verify service connectivity
+      shell: bash
+      run: |
+        echo "Verifying PD connectivity..."
+        for i in {1..30}; do
+          if curl -sf http://localhost:2379/health > /dev/null 2>&1 && curl -sf http://pd:2379/health > /dev/null 2>&1; then
+            echo "PD is healthy"
+            break
+          fi
+          if [ "$i" -eq 30 ]; then
+            echo "PD failed readiness checks" >&2
+            docker compose logs pd --tail 100 || true
+            exit 1
+          fi
+          sleep 2
+        done
+
+        echo "Verifying TiKV connectivity..."
+        for i in {1..30}; do
+          if curl -sf http://localhost:20180/status > /dev/null 2>&1; then
+            echo "TiKV is healthy"
+            break
+          fi
+          if [ "$i" -eq 30 ]; then
+            echo "TiKV failed readiness checks" >&2
+            docker compose logs tikv --tail 100 || true
+            exit 1
+          fi
+          sleep 2
+        done
+
+        echo "Verifying MinIO connectivity..."
+        for i in {1..30}; do
+          if curl -sf http://localhost:9000/minio/health/ready > /dev/null 2>&1; then
+            echo "MinIO is healthy"
+            break
+          fi
+          if [ "$i" -eq 30 ]; then
+            echo "MinIO failed readiness checks" >&2
+            docker compose logs minio --tail 100 || true
+            exit 1
+          fi
+          sleep 2
+        done