Skip to main content

ColdPy

ColdPy profiles Python startup import cost by measuring import time and memory per module. It is built for serverless, microservices, and large Python apps where cold start matters.

What it measures

  • Import duration (milliseconds)
  • Import memory peak (MB) using tracemalloc
  • Per-module status (success/error)
  • Heavy module hints for lazy loading opportunities

Safety caveat

ColdPy measures real imports, so target module import code is executed in isolated subprocesses. This prevents state leakage between modules, but import side effects in target code may still occur.

Install

uv sync

Usage

coldpy scan
coldpy scan ./myproject
coldpy scan ./myproject --json report.json
coldpy scan ./myproject --exclude "migrations/**" --exclude "scripts/**"
coldpy top 10
coldpy top 20 --sort memory --threshold-mb 20

Commands

  • coldpy scan [PATH=. ] [--json OUTPUT_JSON] [--threshold-ms N] [--threshold-mb N] [--no-cache]
  • coldpy scan PATH [--python PYTHON] [--env-file ENV_FILE] [--no-project-env] [--exclude PATTERN]
  • coldpy top [N=10] [--sort time|memory] [--threshold-ms N] [--threshold-mb N]

coldpy top reads ./.coldpy/cache.json and fails if no cache exists.

For scan, ColdPy auto-detects project virtualenv Python in .venv, venv, or env and auto-loads environment variables from .env/.env.local when present. Use --python and --env-file only when you need to override auto-detection. ColdPy also excludes common migration paths by default (alembic/**, migrations/**).

JSON schema (v1)

{
  "schema_version": "1.0",
  "generated_at": "2026-02-20T10:00:00+00:00",
  "project_root": "/path/to/project",
  "settings": {
    "threshold_ms": 100,
    "threshold_mb": 50,
    "exclusions": ["tests", "venv"]
  },
  "summary": {
    "total_modules": 3,
    "scanned_modules": 2,
    "failed_modules": 1
  },
  "modules": [
    {
      "name": "pkg.fast",
      "file": "/path/to/project/pkg/fast.py",
      "import_time_ms": 1.234,
      "memory_mb": 0.123,
      "status": "ok",
      "error": null,
      "notes": []
    }
  ]
}

Cache behavior

  • Cache path: ./.coldpy/cache.json
  • Written by scan by default
  • Disable with --no-cache
  • Read by top

Troubleshooting

  • Cache not found: run coldpy scan <path> first.
  • No Python modules found: verify path and exclusions.
  • Import failures: check module side effects and importability from project root.

PyPI release setup

GitHub workflows are included in /Users/denis/Documents/ColdPy/.github/workflows:

  • ci.yml: test matrix on Python 3.10/3.11/3.12.
  • package.yml: build and validate sdist + wheel.
  • publish.yml: publish on GitHub Release (PyPI) or manual dispatch (TestPyPI/PyPI).

Recommended publishing model is Trusted Publisher (OIDC):

  1. Create a PyPI project for coldpy (and optionally a TestPyPI project).
  2. In PyPI project settings, add your GitHub repo as a trusted publisher.
  3. Create a GitHub Release to publish to PyPI.
  4. Use workflow dispatch with target=testpypi for preflight package checks.

If you prefer API tokens instead of OIDC, set password input in the publish action and store the token in GitHub Secrets.

Metadata

Release files for coldpy 0.1.0

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for coldpy 0.1.0
File Size Uploaded Provenance
coldpy-0.1.0.tar.gz 49.4 kB With provenance Details

Built distribution (wheel)

Table of built distributions (wheels) for coldpy 0.1.0
File Interpreter ABI Platform
coldpy-0.1.0-py3-none-any.whl Python 3 none any Details

Total release size: 61.7 kB

Release files / coldpy-0.1.0.tar.gz

Download URL coldpy-0.1.0.tar.gz
Size 49.4 kB
Tags Source
SHA-256 checksum
How to use checksums
2366254871bdd0b86cdd56ce70a65c91a5d63884cdc22da4108bceb2ef1b9b54
BLAKE2b-256 checksum
How to use checksums
8886fc5b39341311d0cdbc30b3433d63b64e8e774915252c233a47fb8a5a6e1b
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/6.1.0 CPython/3.13.7

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Feb 20, 2026.

Transparency log

Release files / coldpy-0.1.0-py3-none-any.whl

Download URL coldpy-0.1.0-py3-none-any.whl
Size 12.3 kB
Tags Python 3
SHA-256 checksum
How to use checksums
86b166c46c65965c3dc1fac5a4f605945b83f6c83edf2eba52eb10f1e145aff3
BLAKE2b-256 checksum
How to use checksums
dc9bc5795ef57424cd2b352591a9a08442c214162c267830f666014a7727b828
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/6.1.0 CPython/3.13.7

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Feb 20, 2026.

Transparency log

Security for coldpy 0.1.0

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

Full provenance

All 2 files in this release have been uploaded with provenance metadata.

Select from 2 files

Attestation for coldpy-0.1.0.tar.gz

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Feb 20, 2026.

Transparency log

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

To learn more about protecting yourself from malicious actors, visit our package security documentation.

Release history Release notifications | RSS feed

This release

0.1.0 This release

2 release files Full provenance

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page