pin-env-yml
Pin conda/micromamba
environment.ymlpackages to their currently installed versions — in-place, without bloat.
The Problem
Sharing a conda environment.yml with unpinned versions leads to non-reproducible environments:
# ❌ Unpinned — different installs on different machines
dependencies:
- numpy
- pandas
- scikit-learn
Tools like conda-lock solve this by generating a separate lockfile. But sometimes you just want to pin the versions directly in your existing environment.yml, without changing your workflow.
That's exactly what pin-env-yml does.
Installation
pip install pin-env-yml
Requires Python 3.8+. No external dependencies — only Python stdlib.
Usage
CLI
# Reads env name from the 'name:' field in the YML
pin-env-yml environment.yml
# Or specify the env name explicitly
pin-env-yml environment.yml myenv
Python API
from pin_env_yml import pin_yml
# Pin in-place
pinned_count = pin_yml("environment.yml")
pinned_count = pin_yml("environment.yml", target_env_name="myenv")
Example
Before (environment.yml):
name: myproject
channels:
- conda-forge
- defaults
dependencies:
- python
- numpy
- pandas
- pip:
- requests
- httpx
Run:
pin-env-yml environment.yml
# 🔍 Analyzing YML file: environment.yml
# 📦 Matching against installed packages in env: myproject
# 📌 Pinned python → 3.11.9 (conda)
# 📌 Pinned numpy → 1.26.4 (conda)
# 📌 Pinned pandas → 2.2.2 (conda)
# 📌 Pinned requests → 2.32.3 (pip)
# 📌 Pinned httpx → 0.27.0 (pip)
#
# ✨ Done! Pinned 5 explicit dependencies in: environment.yml
After (environment.yml):
name: myproject
channels:
- conda-forge
- defaults
dependencies:
- python=3.11.9
- numpy=1.26.4
- pandas=2.2.2
- pip:
- requests==2.32.3
- httpx==0.27.0
How It Works
- Reads the
environment.ymlfile - Queries
micromamba list -n <env> --json(falls back toconda list) - For each explicit dependency in the YML, substitutes the currently installed version
- Writes the updated file back in-place
- Uses
=for conda packages and==for pip packages (correct convention for each)
Requirements
- Python 3.8+
micromambaorcondamust be in your PATH and the target environment must exist
License
MIT © Santt997
Metadata
Release files for pin-env-yml 0.1.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| pin_env_yml-0.1.0.tar.gz | 6.2 kB | Without provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| pin_env_yml-0.1.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 12.5 kB
Release files / pin_env_yml-0.1.0.tar.gz
| Download URL | pin_env_yml-0.1.0.tar.gz |
|---|---|
| Size | 6.2 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
ae19898dfadee31a2ae44a9e6100cd273d1dfbd77facf849122f0a5b9362d661
|
|
BLAKE2b-256 checksum How to use checksums |
630321a924c7413f6a3610bf6ea5ae24a34f732235b20d522625091cf11e862d
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.13.5
|
Release files / pin_env_yml-0.1.0-py3-none-any.whl
| Download URL | pin_env_yml-0.1.0-py3-none-any.whl |
|---|---|
| Size | 6.3 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
439f0a97343369807708da57126b1ccf713fbebb61a7c4184c9253e01bb71d68
|
|
BLAKE2b-256 checksum How to use checksums |
af713122cbd3de79cc508a6d9312f5edbc77d4e18ca3cdc09f2d4b04fd16b739
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.13.5
|
Security for pin-env-yml 0.1.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.