PyPack
What does it mean?
The name "PyPack" comes from the contraction of "Python" and "Package".
What is it for?
PyPack is a template for Python package repositories on GitLab.
Is it hard to use?
You need to be a bit familiar with python project packaging.
Background
Creating a package distribution for a Python project is a process that can already take some time. Putting it all together in a repository that allows full use of GitLab's CI/CD features can seem like a daunting extra step. The goal here is to simplify these processes by presenting a working example of a package distribution repository that uses CI/CD features.
Here are some references and recommended readings about the creation of Python package distributions and the use of CI/CD features:
- Tool recommendations
- Packaging Python Projects
- PyPi classifiers
- Git Basics - Tagging
.gitlab-ci.ymlkeyword reference
Usage
The Python package used as an example here is called "Stemplate". The following explains how this package is automatically tested and deployed on PyPi thanks to the CI/CD features.
Deployment
To use this template follow these steps:
- Download or clone the PyPack project from its GitLab repository.
git clone git@gitlab.com:stemplate/pypack.git
- Replace all occurrences of "stemplate" with the name of your Python package. (Use your editor's search tool.)
- Adapt the
pyproject.tomlfile, and add your potential dependencies. (Here NumPy is an example of dependency.) - Use
template.mdas a template for the newREADME.md. - Install the Python virtual environment with the command
. setup.shorsource setup.sh. (See thesetup.shscript for more information.) - Incorporate/adapt your package source files in the
src/directory. - Add the test functions for your package in the
tests/run.pyscript. - Remove the
.gitdirectory and initialize a new one:
git init --initial-branch=main
git add <your-files>
git commit -m "initial commit"
git tag -a v1.0.0rc1 -m "version 1.0.0rc1"
- Build and upload the package to Pypi with the command
upload(accessible after sourcingsetup.sh). - Create an empty repository on GitLab for your package distribution.
- Create an API token for the project on PyPi. (Use the url address of your GitLab repository to name the token in PyPi.)
- Add the PyPi Token variables on GitLab (Project > Settings > CI/CD > Variables):
TWINE_USERNAME:__token__(Add "Protect", "Mask", and "Expand" options)TWINE_PASSWORD: token value (Add "Protect", "Mask", and "Expand" options)
- Protect the
v*wildcard tag (Project > Settings > Repository > Protected tags). - Make sure that the
mainbranch is protected and set "Allowed to push and merge" to "No one" (Project > Settings > Repository > Protected branch). - Push:
git remote add origin git@gitlab.com:<user/project>.git
git push origin main --tags
git branch --set-upstream-to=origin/main main
Development
At this stage your project is deployed on both GitLab and PyPi, and the pipeline should have been launched on GitLab.
The latter is configured in the .gitlab-ci.yml YAML file.
The configuration proposed in this file allows to run the tests each time GitLab receives a push.
- Do not work on the main branch, create another one (like
dev). - Use
run,lintandmakedocscommands to test, lint and document your package. (See thesetup.shscript for more information.) - Make some potential modifications so that the pipeline runs without errors.
- After merging your working branch into the
mainbranch, if the pipeline passed, add a tagv1.0.0"version 1.0.0" directly on GitLab. This will automatically deploy the new release on PyPi and build the documentation. - Delete the working branch.
Repeat these steps (from creating a new branch) for each modification made to the project (without forgetting to adapt the version in the tag name).
Credits
- Dunstan Becht
License
This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License along with this program. If not, see https://www.gnu.org/licenses/.
Metadata
Release files for stemplate 1.0.1
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| stemplate-1.0.1.tar.gz | 19.4 kB | Without provenance | Details for stemplate-1.0.1.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| stemplate-1.0.1-py3-none-any.whl | Python 3 | none | any | Details for stemplate-1.0.1-py3-none-any.whl |
Total release size: 31.4 kB
Release files / stemplate-1.0.1.tar.gz
| Download URL | stemplate-1.0.1.tar.gz |
|---|---|
| Size | 19.4 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
7721207eb0d45477d28966ae0877b58182ecd5bdd2738952cdf9c98b43165216
|
|
BLAKE2b-256 checksum How to use checksums |
1969bc6b7e715a8590556b9858268b814b4f4af59a971dbed02ecf5ed69d7578
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/4.0.2 CPython/3.11.2
|
Release files / stemplate-1.0.1-py3-none-any.whl
| Download URL | stemplate-1.0.1-py3-none-any.whl |
|---|---|
| Size | 12.0 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
2fa6838a4800b245690e077230e60c5764521b3012bc015b534a1b252b4d4809
|
|
BLAKE2b-256 checksum How to use checksums |
329e9624fb3bbd7b12660484f4fb53e4faff4f6dcb44fd09e04075ec580807aa
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/4.0.2 CPython/3.11.2
|
Security for stemplate 1.0.1
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.