Skip to main content

python-cicd-demo

A throwaway Python package whose only purpose is to exercise the release CI/CD + PyPI flow used by scm-python, end to end:

  • Version-driven release — the version in pyproject.toml is the single source of truth. Merging a version bump into main triggers a publish.
  • CHANGELOG-driven notes — the ## [X.Y.Z] section becomes the GitHub Release body; a missing/empty section fails the release early.
  • PyPI Trusted Publishing (OIDC) — no stored API tokens; publishing runs in an approval-gated pypi environment.

Layout

cicd_demo/            # the (flat-layout) package
tests/                # a trivial pytest suite
pyproject.toml        # setuptools build + version of record
CHANGELOG.md          # Keep a Changelog; drives Release notes
.github/workflows/
  test.yml            # CI on develop
  release-python-sdk.yml  # version-triggered release to PyPI

Local use

python -m venv .venv && source .venv/bin/activate
pip install -e ".[dev]"
pytest
cicd-demo            # prints: Hello, world! (python-cicd-demo 0.1.0)

How to cut a release

  1. Edit pyproject.toml → bump version.
  2. In CHANGELOG.md, promote ## [Unreleased] to ## [X.Y.Z] - <date>.
  3. Commit on develop, open a PR to main, merge it.
  4. Approve the run in the pypi environment → it builds, publishes to PyPI, and cuts a vX.Y.Z tag + GitHub Release.

See SETUP.md for the one-time PyPI/GitHub configuration required first.

Metadata

Release files for python-cicd-demo 0.1.0

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for python-cicd-demo 0.1.0
File Size Uploaded Provenance Actions
python_cicd_demo-0.1.0.tar.gz 7.6 kB With provenance Details for python_cicd_demo-0.1.0.tar.gz

Built distribution (wheel)

Table of built distributions (wheels) for python-cicd-demo 0.1.0
File Interpreter ABI Platform Actions
python_cicd_demo-0.1.0-py3-none-any.whl Python 3 none any Details for python_cicd_demo-0.1.0-py3-none-any.whl

Total release size: 15.0 kB

Release files / python_cicd_demo-0.1.0.tar.gz

Download URL python_cicd_demo-0.1.0.tar.gz
Size 7.6 kB
Tags Source
SHA-256 checksum
How to use checksums
4da9fd104a245f1ffe50f3991911935dbef86da20876d7e112a583c2298ed0bb
BLAKE2b-256 checksum
How to use checksums
d4d4e204d2b072abb2cb712e1d0751debb80dbd79e44dd8922456d248100879d
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/6.1.0 CPython/3.13.13

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Jun 5, 2026.

Transparency log

Release files / python_cicd_demo-0.1.0-py3-none-any.whl

Download URL python_cicd_demo-0.1.0-py3-none-any.whl
Size 7.5 kB
Tags Python 3
SHA-256 checksum
How to use checksums
3c2ed1ebaa7c25a5d8090a162dddc3071f1fd56f7305a38b63bb96295c608787
BLAKE2b-256 checksum
How to use checksums
792291d5c4ec4151b37c2cd58972aef155100dc5ca20da63917ce873309d8359
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/6.1.0 CPython/3.13.13

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Jun 5, 2026.

Transparency log

Security for python-cicd-demo 0.1.0

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

Full provenance

Both files in this release have been uploaded with provenance metadata.

Select from 2 files

Attestation for python_cicd_demo-0.1.0.tar.gz

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Jun 5, 2026.

Transparency log

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

To learn more about protecting yourself from malicious actors, visit our package security documentation.

Release history Release notifications | RSS feed

This release

0.1.0 This release

2 release files Full provenance

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page