🟡🐍Sviatoslove.pie♥🇺🇦#StandWithUkraine🙏 | українець на чужині
Fionauv does the same thing, referencing the pip code: https://github.com/astral-sh/uv/blob/1723ed00d6e6961abcf05d09abe59aaee005a6af/crates/uv-client/src/linehaul.rs#L61-L63
#Python@stfn I think the #pypa #python GitHub publish action is a good place to start to see what needs to be done.
https://github.com/pypa/gh-action-pypi-publish
You'll need to use tokens instead of Trusted Publishing, as your CI is not integrated into Trusted Publishing. Twine is the usual way.
https://twine.readthedocs.io/en/stable/
You may be able to generate & include attestations.
https://docs.pypi.org/attestations/
The blessed :octocat: GitHub Action, for publishing your :package: distribution files to PyPI, the tokenless way: https://github.com/marketplace/actions/pypi-publish - GitHub - pypa/gh-action-pypi-...
i released https://pypi.org/project/setuptools-scm/9.0.0/ today - its expected to work just the same for all users
its the last release with legacy python and legacy setuptools support
its also going to be the last release thats mostly standalone
future version will require modern setuptools and vcs-versioning - all build pipelines that still need legacy setuptools and/or old python had about half a decade now to update python tooling - its time to go modern #python #packaging #setuptools #pypa
📢 PSA: there's an effort by @karo @ https://github.com/pypa/packaging.python.org/pull/1662 to write some PyPUG documents regarding license declaration in #Python dists and #PEP 639. I think additional feedback would be useful.
Changed pages: glossary pyproject.toml sdist spec wheel spec installation spec ❓ The meaning of the license key in pyproject.toml is changed. The fact that table subkeys are deprecated is mention...
pip 24.3 has been released (*checks watch*) almost three weeks ago, but do you know what changed in this release?
If not, I have a release write-up for pip 24.3 that can fix that!
TL;DR: pip 24.3 is a small release with a truststore bugfix, error QoL improvements, and one minor deprecation of noncompliant wheel filenames (which won't affect you).
First blog post after a very long time: Publishing to PyPI with a Trusted Publisher from GitLab CI/CD 🦊
https://stefan.sofa-rockers.org/2024/11/14/gitlab-trusted-publisher/
Learn how to securely upload Python packages to PyPI from GitLab CI/CD pipelines using a “Trusted Publisher” (and without API tokens). Continuously test the release process with TestPyPI on every push. Use GitLab (deploy) environments as an additional...
Jak być dobrym upstreamem dla paczki Pythona:
1. Przestrzegać własnej polityki zagnieżdżania zależności tylko wtedy, kiedy to nie przeszkadza w niczym.
2. Kiedy ktoś zwraca uwagę na złamanie polityki, stwierdzić, że to w porządku, bo "opiekuni mają bliski(-awy) kontakt".
3. Wydać nową, problematyczną wersję, nie wykorzystując "bliski(-awego) kontaktu", by w tym samym czasie wydano nową wersję zależności.
4. No i nie zapominajmy, by szybko blokować możliwość komentowania na zgłoszeniach.
No cóż, i tak ich kod "devendoringu" nigdy nie działał (muszę kiedyś w końcu napisać porządne zgłoszenie na ten temat)…
https://github.com/pypa/pip/pull/12962#issuecomment-2400977486
W międzyczasie, szczerze polecam #uv. Ludzie odpowiedzialni za projekt mają wielkie znaczenie.
Mark
ossronny
Florian Schulze
Bastian Venthur
🇺🇦 Sviatoslav Sydorenko
Richard Si 🌺
Stefan Scherfke
Jezus Michał "Le Wzdych" (on)