Merge remote-tracking branch 'origin/main' into ragnorc/explore-api

# Conflicts:
#	CONTRIBUTING.md

.github/workflows/ci.yml

@@ -140,6 +140,52 @@ jobs:
         if: needs.classify_changes.outputs.run_full_ci == 'true'
         run: cargo test --workspace --locked
 
+  test_aws_feature:
+    name: Test omnigraph-server --features aws
+    needs: classify_changes
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+    env:
+      CARGO_TERM_COLOR: always
+    steps:
+      - name: Skip for text-only changes
+        if: needs.classify_changes.outputs.run_full_ci != 'true'
+        run: echo "Text-only change detected; skipping aws feature build."
+
+      - name: Checkout source
+        if: needs.classify_changes.outputs.run_full_ci == 'true'
+        uses: actions/checkout@v5.0.1
+
+      - name: Install system dependencies
+        if: needs.classify_changes.outputs.run_full_ci == 'true'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y protobuf-compiler libprotobuf-dev
+
+      - name: Install Rust stable
+        if: needs.classify_changes.outputs.run_full_ci == 'true'
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: stable
+
+      - name: Cache Rust build data
+        if: needs.classify_changes.outputs.run_full_ci == 'true'
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: |
+            . -> target
+          key: aws-feature
+
+      - name: Build omnigraph-server with aws feature
+        if: needs.classify_changes.outputs.run_full_ci == 'true'
+        run: cargo build --locked -p omnigraph-server --features aws
+
+      - name: Test omnigraph-server with aws feature
+        if: needs.classify_changes.outputs.run_full_ci == 'true'
+        run: cargo test --locked -p omnigraph-server --features aws
+
   rustfs_integration:
     name: RustFS S3 Integration
     needs:

.github/workflows/package.yml

@@ -0,0 +1,57 @@
+name: Package
+
+# Builds both the default and aws-feature omnigraph-server images and pushes
+# them to ECR. Invoked manually via workflow_dispatch — not wired to tags or
+# main pushes today.
+#
+# Prerequisites:
+#   - Repo vars AWS_REGION, AWS_ROLE_TO_ASSUME, AWS_CODEBUILD_PACKAGE_PROJECT,
+#     AWS_ARTIFACT_BUCKET are set.
+#   - The shared workflow at ModernRelay/.github supports the `features` and
+#     `image_tag_suffix` inputs (ModernRelay/.github PR #2 or later).
+#
+# Each invocation produces two ECR tags per source commit:
+#   - <source_sha>         (default features)
+#   - <source_sha>-aws     (--features aws)
+
+on:
+  workflow_dispatch:
+    inputs:
+      source_ref:
+        description: Git ref to package (branch, tag, or SHA). Defaults to the workflow's own ref.
+        required: false
+        type: string
+        default: ""
+
+jobs:
+  package_default:
+    name: Package default build
+    uses: ModernRelay/.github/.github/workflows/omnigraph-package.yml@main
+    permissions:
+      id-token: write
+      contents: read
+      attestations: write
+    with:
+      repository: ${{ github.repository }}
+      source_ref: ${{ inputs.source_ref != '' && inputs.source_ref || github.sha }}
+      aws_region: ${{ vars.AWS_REGION }}
+      aws_role_to_assume: ${{ vars.AWS_ROLE_TO_ASSUME }}
+      aws_codebuild_package_project: ${{ vars.AWS_CODEBUILD_PACKAGE_PROJECT }}
+      aws_artifact_bucket: ${{ vars.AWS_ARTIFACT_BUCKET }}
+
+  package_aws:
+    name: Package aws-feature build
+    uses: ModernRelay/.github/.github/workflows/omnigraph-package.yml@main
+    permissions:
+      id-token: write
+      contents: read
+      attestations: write
+    with:
+      repository: ${{ github.repository }}
+      source_ref: ${{ inputs.source_ref != '' && inputs.source_ref || github.sha }}
+      aws_region: ${{ vars.AWS_REGION }}
+      aws_role_to_assume: ${{ vars.AWS_ROLE_TO_ASSUME }}
+      aws_codebuild_package_project: ${{ vars.AWS_CODEBUILD_PACKAGE_PROJECT }}
+      aws_artifact_bucket: ${{ vars.AWS_ARTIFACT_BUCKET }}
+      features: aws
+      image_tag_suffix: "-aws"