
Product
Introducing Pull Request Stories to Help Security Teams Track Supply Chain Risks
Socket’s new Pull Request Stories give security teams clear visibility into dependency risks and outcomes across scanned pull requests.
semantic-release-pypi
Advanced tools
semantic-release plugin to publish a python package to PyPI
semantic-release plugin to publish a python package to PyPI
semantic-release-pypi
support two build system interfaces
pyproject.toml
based (Recommended)
setup.py
based (Legacy interface)
setuptools
is required, other packaging tools like Poetry or Hatch are not supported when using this interfaceversion
will be set inside setup.cfg
version
must not be set inside setup.py
Step | Description |
---|---|
verifyConditions |
|
prepare | Update the version in pyproject.toml (legacy: setup.cfg ) and create the distribution packages |
publish | Publish the python package to the specified repository (default: pypi) |
Variable | Description | Required | Default |
---|---|---|---|
PYPI_TOKEN | API token for PyPI | true | |
PYPI_USERNAME | Username for PyPI | false | __token__ |
PYPI_REPO_URL | Repo URL for PyPI | false | See Options |
The plugin can be configured in the **semantic-release ** configuration file. Here is a minimal example:
{
"plugins": [
"@semantic-release/commit-analyzer",
"@semantic-release/release-notes-generator",
"semantic-release-pypi"
]
}
Note that this plugin modifies the version inside of pyproject.toml
(legacy: setup.cfg
).
Make sure to commit pyproject.toml
using the @semantic-release/git
plugin, if you want to save the changes:
{
"plugins": [
"@semantic-release/commit-analyzer",
"@semantic-release/release-notes-generator",
"semantic-release-pypi",
[
"@semantic-release/git",
{
"message": "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}",
"assets": [
"pyproject.toml"
]
}
]
]
}
Working examples using Github Actions can be found here:
Option | Type | Default | Description |
---|---|---|---|
srcDir | str | . | source directory (defaults to current directory) |
distDir | str | dist | directory to put the source distribution archive(s) in, relative to srcDir |
repoUrl | str | https://upload.pypi.org/legacy/ | The repository (package index) to upload the package to. |
repoUsername | str | __token__ | The repository username. |
repoToken | str | The repository token. It's safer to set via PYPI_TOKEN environment variable. | |
pypiPublish | bool | true | Whether to publish the python package to the pypi registry. If false the package version will still be updated. |
gpgSign | bool | false | Whether to sign the package using GPG. A valid PGP key must already be installed and configured on the host. |
gpgIdentity | str | null | When gpgSign is true, set the GPG identify to use when signing files. Leave empty to use the default identity. |
envDir | string | false | .venv | directory to create the virtual environment in, if set to false no environment will be created |
installDeps | bool | true | wether to automatically install python dependencies |
versionCmd | string | undefined | Run a custom command to update the version (e.g. hatch version ${version} ). srcDir is used as working directory. versionCmd is required if the version is set dynamically |
Using release.config.js
you can read repository credentials from environment variables and publish to multiple
repositories.
module.exports = {
"plugins": [
[
"semantic-release-pypi",
{
"repoUrl": process.env['REPOSITORY_1_URL'],
"repoUsername": process.env['REPOSITORY_1_USERNAME'],
"repoToken": process.env['REPOSITORY_1_TOKEN']
}
],
[
"semantic-release-pypi",
{
"repoUrl": process.env['REPOSITORY_2_URL'],
"repoUsername": process.env['REPOSITORY_2_USERNAME'],
"repoToken": process.env['REPOSITORY_2_TOKEN']
}
]
]
}
source init.sh
source init.sh
yarn test
yarn lint
to ensure your code adheres to the linting rulesFAQs
semantic-release plugin to publish a python package to PyPI
The npm package semantic-release-pypi receives a total of 3,363 weekly downloads. As such, semantic-release-pypi popularity was classified as popular.
We found that semantic-release-pypi demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Product
Socket’s new Pull Request Stories give security teams clear visibility into dependency risks and outcomes across scanned pull requests.
Research
/Security News
npm author Qix’s account was compromised, with malicious versions of popular packages like chalk-template, color-convert, and strip-ansi published.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.