ColdPy
ColdPy profiles Python startup import cost by measuring import time and memory per module. It is built for serverless, microservices, and large Python apps where cold start matters.
What it measures
- Import duration (milliseconds)
- Import memory peak (MB) using
tracemalloc - Per-module status (success/error)
- Heavy module hints for lazy loading opportunities
Safety caveat
ColdPy measures real imports, so target module import code is executed in isolated subprocesses. This prevents state leakage between modules, but import side effects in target code may still occur.
Install
uv sync
Usage
coldpy scan
coldpy scan ./myproject
coldpy scan ./myproject --json report.json
coldpy scan ./myproject --exclude "migrations/**" --exclude "scripts/**"
coldpy top 10
coldpy top 20 --sort memory --threshold-mb 20
Commands
coldpy scan [PATH=. ] [--json OUTPUT_JSON] [--threshold-ms N] [--threshold-mb N] [--no-cache]coldpy scan PATH [--python PYTHON] [--env-file ENV_FILE] [--no-project-env] [--exclude PATTERN]coldpy top [N=10] [--sort time|memory] [--threshold-ms N] [--threshold-mb N]
coldpy top reads ./.coldpy/cache.json and fails if no cache exists.
For scan, ColdPy auto-detects project virtualenv Python in .venv, venv, or env
and auto-loads environment variables from .env/.env.local when present.
Use --python and --env-file only when you need to override auto-detection.
ColdPy also excludes common migration paths by default (alembic/**, migrations/**).
JSON schema (v1)
{
"schema_version": "1.0",
"generated_at": "2026-02-20T10:00:00+00:00",
"project_root": "/path/to/project",
"settings": {
"threshold_ms": 100,
"threshold_mb": 50,
"exclusions": ["tests", "venv"]
},
"summary": {
"total_modules": 3,
"scanned_modules": 2,
"failed_modules": 1
},
"modules": [
{
"name": "pkg.fast",
"file": "/path/to/project/pkg/fast.py",
"import_time_ms": 1.234,
"memory_mb": 0.123,
"status": "ok",
"error": null,
"notes": []
}
]
}
Cache behavior
- Cache path:
./.coldpy/cache.json - Written by
scanby default - Disable with
--no-cache - Read by
top
Troubleshooting
Cache not found: runcoldpy scan <path>first.No Python modules found: verify path and exclusions.- Import failures: check module side effects and importability from project root.
PyPI release setup
GitHub workflows are included in /Users/denis/Documents/ColdPy/.github/workflows:
ci.yml: test matrix on Python 3.10/3.11/3.12.package.yml: build and validatesdist+wheel.publish.yml: publish on GitHub Release (PyPI) or manual dispatch (TestPyPI/PyPI).
Recommended publishing model is Trusted Publisher (OIDC):
- Create a PyPI project for
coldpy(and optionally a TestPyPI project). - In PyPI project settings, add your GitHub repo as a trusted publisher.
- Create a GitHub Release to publish to PyPI.
- Use workflow dispatch with
target=testpypifor preflight package checks.
If you prefer API tokens instead of OIDC, set password input in the publish action
and store the token in GitHub Secrets.
Metadata
Release files for coldpy 0.1.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| coldpy-0.1.0.tar.gz | 49.4 kB | With provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| coldpy-0.1.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 61.7 kB
Release files / coldpy-0.1.0.tar.gz
| Download URL | coldpy-0.1.0.tar.gz |
|---|---|
| Size | 49.4 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
2366254871bdd0b86cdd56ce70a65c91a5d63884cdc22da4108bceb2ef1b9b54
|
|
BLAKE2b-256 checksum How to use checksums |
8886fc5b39341311d0cdbc30b3433d63b64e8e774915252c233a47fb8a5a6e1b
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.7
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Feb 20, 2026.
Transparency logRelease files / coldpy-0.1.0-py3-none-any.whl
| Download URL | coldpy-0.1.0-py3-none-any.whl |
|---|---|
| Size | 12.3 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
86b166c46c65965c3dc1fac5a4f605945b83f6c83edf2eba52eb10f1e145aff3
|
|
BLAKE2b-256 checksum How to use checksums |
dc9bc5795ef57424cd2b352591a9a08442c214162c267830f666014a7727b828
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.7
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Feb 20, 2026.
Transparency logSecurity for coldpy 0.1.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for coldpy-0.1.0.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Feb 20, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.