pyprocessors_glotlid

GlotLID annotations coming from different annotators

Parameters

Installation

You can simply pip install pyprocessors_glotlid.

Development

The build is driven by Task and uv, with the shared stages coming from the python-archetype submodule.

Getting started

The stages live in a Git submodule, so clone with --recurse-submodules:

git clone --recurse-submodules git@bitbucket.org:kairntech/pyprocessors_glotlid.git
cd pyprocessors_glotlid
sh -c "$(curl -sSL https://taskfile.dev/install.sh)" -- -d -b ~/.local/bin
task

Already cloned without it? The submodule directory is empty, and task fails on:

task: No Taskfile found at ".../submodules/python-archetype/resources/Taskfile.yml"

which means exactly that, and nothing worse:

git submodule update --init

Task is the only manual prerequisite. An archetype cannot bootstrap itself: uv and the Python interpreter install themselves on demand (every task that runs uv depends on an internal install-python task), but the thing that runs them does not. Make sure ~/.local/bin is on your PATH — that is where task and uv both land.

Running the pipeline

task stages          # print the pipeline stages, in order
task                 # run the pipeline up to (but excluding) py:publish
task -- --skip-tests # same, without the test stage
task up-to -- py:lint # run the pipeline up to and including one stage
task jenkins         # run every stage, exactly what Jenkins runs

task with no argument is safe by construction: it runs every stage but the last, and that bound is computed from the STAGES list rather than written down. The last stage is the only one with an effect outside your machine.

STAGES, declared once in Taskfile.yml, is the single definition of the pipeline order — so what you run locally is what Jenkins runs.

Individual stages

uv.lock is not versioned here, so py:sync always resolves from scratch (--upgrade): a stale lock lying around on a machine would otherwise make you test and audit versions the CI never sees.

SBOM & vulnerability check

task py:sbom and task py:check-vulnerabilities wrap the underlying tools. To run them by hand:

uv sync --extra test --extra sbom
uv run cyclonedx-py environment -o sbom.cdx.json --output-format json
uv run pip-audit --skip-editable --format json --output audit-report.json

Ask for all the extras, not just sbom: uv sync synchronises rather than adds, so whatever the requested extras do not pull in gets removed. --extra sbom on its own uninstalls ruff and pytest, leaving an environment that can no longer lint or test.

--skip-editable skips the project itself, which no advisory database can know about. The tasks do the same, and pip-audit still exits non-zero when it finds a real vulnerability — which is the contract the CI relies on. Avoid --strict: it turns "dependency not found on PyPI" into a fatal error, so it breaks as soon as the local version is not a published one.