Skip to main content

py-lean

Detect and fix missing source-exclude patterns in Python projects built with uv_build.

py-lean is a Python counterpart to cargo-lean. It checks the source-distribution configuration in pyproject.toml so repository-only files don't unnecessarily end up in published archives.

Why?

A Python package's source repository often contains more than consumers need to install and use it. Tests, CI workflows, development configuration, and other repository-specific files can add unnecessary noise and size to source distributions.

py-lean helps make distribution contents intentional by identifying common repository artefacts that are missing from tool.uv.build-backend.source-exclude. It can also add the missing patterns to pyproject.toml.

Your working repository remains intact: py-lean configures what is excluded from the built source distribution; it does not delete those files from your project.

Features

  • Lint — Detect common repository artefacts that are not listed in source-exclude.
  • Create — Add a source-exclude configuration for detected artefacts.
  • Update — Add missing exclusion patterns to an existing configuration.
  • Preview changes — Use --dry-run and --diff to review proposed edits before applying them.
  • Machine-readable output — Emit lint results as JSON.

Requirements

  • Python 3.11 or newer
  • uv and a project using the uv_build build backend

Required build-system configuration

py-lean manages tool.uv.build-backend.source-exclude, which is a uv_build configuration. The target project must therefore use uv_build as its build backend for this setting to apply.

For example, the target project's pyproject.toml should include:

[build-system]
requires = ["uv_build"]
build-backend = "uv_build"

If the project uses a different build backend, py-lean's source-exclude configuration will not control that backend's source-distribution contents.

Installation

Install with uv:

uv tool install py-lean-package

Or install from source:

git clone https://github.com/raphaelstolt/py-lean.git
cd py-lean
uv sync
uv run --project . py-lean --help

Usage

Lint

Check for missing patterns in source-exclude:

py-lean lint

Options:

Flag Description
-m, --manifest-path <PATH> Path to pyproject.toml (default: pyproject.toml)
--format <text|json> Output format (default: text)
-p, --patterns <PATTERNS> Space-separated artefact patterns to check, e.g., "tests/ benchmarks/"
--dry-run Show what would be done without making changes
--diff Show a diff of the proposed changes

Examples:

# Lint with JSON output
py-lean lint --format json

# Use a custom manifest path
py-lean lint -m path/to/pyproject.toml

# Check selected artefact patterns
py-lean lint -p "tests/ benchmarks/"

Create

Create a tool.uv.build-backend.source-exclude configuration containing common repository artefacts:

py-lean create

This scans the project for common artefacts, such as tests/, docs/, and .git/, and adds the detected patterns to pyproject.toml.

Options:

Flag Description
--dry-run Preview changes without modifying files
--diff Show a unified diff of the proposed changes

Update

Add missing patterns to an existing source-exclude configuration:

py-lean update

Options:

Flag Description
--dry-run Preview changes without modifying files
--diff Show a unified diff of the proposed changes

Examples:

# Preview changes
py-lean update --dry-run --diff

# Apply changes
py-lean update

Configuration

Pattern precedence

py-lean determines which artefact patterns to check using the following precedence:

  1. CLI --patterns — highest priority; replaces other pattern sources.
  2. tool.uv.build-backend.source-exclude in pyproject.toml — patterns already configured for the build backend.
  3. Built-in defaults — used when neither of the above is configured.

Use --patterns to override the default patterns:

py-lean lint -p "tests/ benchmarks/"

Default artefact patterns

By default, py-lean checks for these 20 patterns:

tests/, docs/, dist/, build/, htmlcov/,
.venv/, __pycache__/, .tox/, .mypy_cache/, .pytest_cache/, .github/,
.idea/, .vscode/, .vs/, .ruff_cache/,
*.egg-info, .DS_Store, *.pyc, *.pyo, .coverage

Note: .git is not included as it is automatically excluded by build backends.

Override them with --patterns:

py-lean lint -p ".idea/ __pycache__/"

CI integration

Add py-lean to your CI pipeline to ensure that source-exclude patterns are kept up to date:

- name: Install py-lean
  run: uv tool install py-lean-package

- name: Check source-exclude patterns
  run: py-lean lint

Failing the build when patterns are missing prevents repository artefacts from ending up in published distributions.

Development

See CONTRIBUTING.md for development instructions.

License

This project is licensed under the MIT License. See LICENSE.md for details.

Metadata

Release files for py-lean-package 0.2.1

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for py-lean-package 0.2.1
File Size Uploaded Provenance Actions
py_lean_package-0.2.1.tar.gz 9.2 kB Without provenance Details for py_lean_package-0.2.1.tar.gz

Built distribution (wheel)

Table of built distributions (wheels) for py-lean-package 0.2.1
File Interpreter ABI Platform Actions
py_lean_package-0.2.1-py3-none-any.whl Python 3 none any Details for py_lean_package-0.2.1-py3-none-any.whl

Total release size: 20.1 kB

Release files / py_lean_package-0.2.1.tar.gz

Download URL py_lean_package-0.2.1.tar.gz
Size 9.2 kB
Tags Source
SHA-256 checksum
How to use checksums
7040742883eea72d73ed15f8e9203160a3e3e831a9aa295b35fb32ff1ee0fa88
BLAKE2b-256 checksum
How to use checksums
4467f9f3462d2641084ab8d220ece1dd5384893d809de599d685b9cf8ab54552
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via uv/0.13.6 {"installer":{"name":"uv","version":"0.13.6","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Ubuntu","version":"26.04","id":"resolute","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}

Release files / py_lean_package-0.2.1-py3-none-any.whl

Download URL py_lean_package-0.2.1-py3-none-any.whl
Size 10.9 kB
Tags Python 3
SHA-256 checksum
How to use checksums
3a397253d1c74db6923c00f32bdc8c2c9212287fa153eb87a8396a4a3184e785
BLAKE2b-256 checksum
How to use checksums
4c59fb13ea2156261384c681eeee9916e44ce32ee58e36628b2755265153ff5c
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via uv/0.13.6 {"installer":{"name":"uv","version":"0.13.6","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Ubuntu","version":"26.04","id":"resolute","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}

Security for py-lean-package 0.2.1

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

No provenance found

None of the files in this release were uploaded with provenance metadata.

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

To learn more about protecting yourself from malicious actors, visit our package security documentation.

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page