Skip to main content

PyPack

What does it mean?

The name "PyPack" comes from the contraction of "Python" and "Package".

What is it for?

PyPack is a template for Python package repositories on GitLab.

Is it hard to use?

You need to be a bit familiar with python project packaging.

Background

Creating a package distribution for a Python project is a process that can already take some time. Putting it all together in a repository that allows full use of GitLab's CI/CD features can seem like a daunting extra step. The goal here is to simplify these processes by presenting a working example of a package distribution repository that uses CI/CD features.

Here are some references and recommended readings about the creation of Python package distributions and the use of CI/CD features:

Usage

The Python package used as an example here is called "Stemplate". The following explains how this package is automatically tested and deployed on PyPi thanks to the CI/CD features.

Deployment

To use this template follow these steps:

git clone git@gitlab.com:stemplate/pypack.git
  • Replace all occurrences of "stemplate" with the name of your Python package. (Use your editor's search tool.)
  • Adapt the pyproject.toml file, and add your potential dependencies. (Here NumPy is an example of dependency.)
  • Use template.md as a template for the new README.md.
  • Install the Python virtual environment with the command . setup.sh or source setup.sh. (See the setup.sh script for more information.)
  • Incorporate/adapt your package source files in the src/ directory.
  • Add the test functions for your package in the tests/run.py script.
  • Remove the .git directory and initialize a new one:
git init --initial-branch=main
git add <your-files>
git commit -m "initial commit"
git tag -a v1.0.0rc1 -m "version 1.0.0rc1"
  • Build and upload the package to Pypi with the command upload (accessible after sourcing setup.sh).
  • Create an empty repository on GitLab for your package distribution.
  • Create an API token for the project on PyPi. (Use the url address of your GitLab repository to name the token in PyPi.)
  • Add the PyPi Token variables on GitLab (Project > Settings > CI/CD > Variables):
    1. TWINE_USERNAME: __token__ (Add "Protect", "Mask", and "Expand" options)
    2. TWINE_PASSWORD: token value (Add "Protect", "Mask", and "Expand" options)
  • Protect the v* wildcard tag (Project > Settings > Repository > Protected tags).
  • Make sure that the main branch is protected and set "Allowed to push and merge" to "No one" (Project > Settings > Repository > Protected branch).
  • Push:
git remote add origin git@gitlab.com:<user/project>.git
git push origin main --tags
git branch --set-upstream-to=origin/main main

Development

At this stage your project is deployed on both GitLab and PyPi, and the pipeline should have been launched on GitLab. The latter is configured in the .gitlab-ci.yml YAML file. The configuration proposed in this file allows to run the tests each time GitLab receives a push.

  • Do not work on the main branch, create another one (like dev).
  • Use run, lint and makedocs commands to test, lint and document your package. (See the setup.sh script for more information.)
  • Make some potential modifications so that the pipeline runs without errors.
  • After merging your working branch into the main branch, if the pipeline passed, add a tag v1.0.0 "version 1.0.0" directly on GitLab. This will automatically deploy the new release on PyPi and build the documentation.
  • Delete the working branch.

Repeat these steps (from creating a new branch) for each modification made to the project (without forgetting to adapt the version in the tag name).

Credits

  • Dunstan Becht

License

This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program. If not, see https://www.gnu.org/licenses/.

Metadata

Release files for stemplate 1.0.1

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for stemplate 1.0.1
File Size Uploaded Provenance Actions
stemplate-1.0.1.tar.gz 19.4 kB Without provenance Details for stemplate-1.0.1.tar.gz

Built distribution (wheel)

Table of built distributions (wheels) for stemplate 1.0.1
File Interpreter ABI Platform Actions
stemplate-1.0.1-py3-none-any.whl Python 3 none any Details for stemplate-1.0.1-py3-none-any.whl

Total release size: 31.4 kB

Release files / stemplate-1.0.1.tar.gz

Download URL stemplate-1.0.1.tar.gz
Size 19.4 kB
Tags Source
SHA-256 checksum
How to use checksums
7721207eb0d45477d28966ae0877b58182ecd5bdd2738952cdf9c98b43165216
BLAKE2b-256 checksum
How to use checksums
1969bc6b7e715a8590556b9858268b814b4f4af59a971dbed02ecf5ed69d7578
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
No
Uploaded via twine/4.0.2 CPython/3.11.2

Release files / stemplate-1.0.1-py3-none-any.whl

Download URL stemplate-1.0.1-py3-none-any.whl
Size 12.0 kB
Tags Python 3
SHA-256 checksum
How to use checksums
2fa6838a4800b245690e077230e60c5764521b3012bc015b534a1b252b4d4809
BLAKE2b-256 checksum
How to use checksums
329e9624fb3bbd7b12660484f4fb53e4faff4f6dcb44fd09e04075ec580807aa
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
No
Uploaded via twine/4.0.2 CPython/3.11.2

Security for stemplate 1.0.1

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

No provenance found

None of the files in this release were uploaded with provenance metadata.

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

To learn more about protecting yourself from malicious actors, visit our package security documentation.

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page