Requirements
- Python 3.8+
- Flit to put Python packages and modules on PyPI
- Pydantic for the data parts.
Installation
pip install flit
pip install pyconverters-plugins
Development
The build is driven by Task and uv,
with the shared stages coming from the python-archetype submodule.
Getting started
The stages live in a Git submodule, so clone with --recurse-submodules:
git clone --recurse-submodules git@bitbucket.org:kairntech/pyformatters_json.git
cd pyformatters_json
sh -c "$(curl -sSL https://taskfile.dev/install.sh)" -- -d -b ~/.local/bin
task
Already cloned without it? The submodule directory is empty, and task fails on:
task: No Taskfile found at ".../submodules/python-archetype/resources/Taskfile.yml"
which means exactly that, and nothing worse:
git submodule update --init
Task is the only manual prerequisite. An archetype cannot bootstrap itself: uv and the
Python interpreter install themselves on demand (every task that runs uv depends on an
internal install-python task), but the thing that runs them does not. Make sure
~/.local/bin is on your PATH — that is where task and uv both land.
Running the pipeline
task stages # print the pipeline stages, in order
task # run the pipeline up to (but excluding) py:publish
task -- --skip-tests # same, without the test stage
task up-to -- py:lint # run the pipeline up to and including one stage
task jenkins # run every stage, exactly what Jenkins runs
task with no argument is safe by construction: it runs every stage but the last, and that
bound is computed from the STAGES list rather than written down. The last stage is the
only one with an effect outside your machine.
STAGES, declared once in Taskfile.yml, is the single definition of the pipeline order —
so what you run locally is what Jenkins runs.
Individual stages
| Task | Description |
|---|---|
task py:sync |
Install the project and its dependencies (uv sync) |
task py:lint |
ruff check and ruff format --check |
task py:format |
Reformat the code with ruff |
task py:test |
Run the test suite |
task py:test-marker -- <m> |
Run the tests carrying one pytest marker |
task py:sbom |
Generate a CycloneDX SBOM of the resolved environment |
task py:check-vulnerabilities |
Check for known CVEs |
task py:check-updates |
Check for dependency updates |
task py:build |
Build the wheel and sdist (uv build) |
task py:publish |
Publish the distributions (uv publish) |
task py:version-file |
Print the path of the file carrying __version__ |
task py:set-version VERSION=x |
Write that version into it |
uv.lock is not versioned here, so py:sync always resolves from scratch (--upgrade):
a stale lock lying around on a machine would otherwise make you test and audit versions the
CI never sees.
SBOM & vulnerability check
task py:sbom and task py:check-vulnerabilities wrap the underlying tools. To run them
by hand:
uv sync --extra test --extra sbom
uv run cyclonedx-py environment -o sbom.cdx.json --output-format json
uv run pip-audit --skip-editable --format json --output audit-report.json
Ask for all the extras, not just sbom: uv sync synchronises rather than adds, so
whatever the requested extras do not pull in gets removed. --extra sbom on its own
uninstalls ruff and pytest, leaving an environment that can no longer lint or test.
--skip-editable skips the project itself, which no advisory database can know about. The
tasks do the same, and pip-audit still exits non-zero when it finds a real vulnerability —
which is the contract the CI relies on. Avoid --strict: it turns "dependency not found on
PyPI" into a fatal error, so it breaks as soon as the local version is not a published one.
Release files for pyformatters-json 1.6.37
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| pyformatters_json-1.6.37.tar.gz | 4.9 kB | Without provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| pyformatters_json-1.6.37-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 9.4 kB
Release files / pyformatters_json-1.6.37.tar.gz
| Download URL | pyformatters_json-1.6.37.tar.gz |
|---|---|
| Size | 4.9 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
29fd814e9e677d5222066c1c63916aee1b6b95038e1356d85e336963ce71bee0
|
|
BLAKE2b-256 checksum How to use checksums |
7256debd551dc40fa4e5423161182b428392512454a74eb7545d354c7788397f
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
uv/0.12.9 {"installer":{"name":"uv","version":"0.12.9","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Ubuntu","version":"22.04","id":"jammy","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}
|
Release files / pyformatters_json-1.6.37-py3-none-any.whl
| Download URL | pyformatters_json-1.6.37-py3-none-any.whl |
|---|---|
| Size | 4.4 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
f71ac88c3220f55aa965b1b7fe8192ff7cc83577f7abdf39190c028e4d41e4c0
|
|
BLAKE2b-256 checksum How to use checksums |
a00208339a099d1e0e59c556a70e9dcfb31184eb1f374245ab9e10563fa86e33
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
uv/0.12.9 {"installer":{"name":"uv","version":"0.12.9","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Ubuntu","version":"22.04","id":"jammy","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}
|
Security for pyformatters-json 1.6.37
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
