Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
semantic-release-pypi
Advanced tools
semantic-release plugin to publish a python package to PyPI
semantic-release plugin to publish a python package to PyPI
semantic-release-pypi
support two build system interfaces
pyproject.toml
based (Recommended)
setup.py
based (Legacy interface)
setuptools
is required, other packaging tools like Poetry or Hatch are not supported when using this interfaceversion
will be set inside setup.cfg
version
must not be set inside setup.py
Step | Description |
---|---|
verifyConditions |
|
prepare | Update the version in pyproject.toml (legacy: setup.cfg ) and create the distribution packages |
publish | Publish the python package to the specified repository (default: pypi) |
Variable | Description | Required | Default |
---|---|---|---|
PYPI_TOKEN | API token for PyPI | true | |
PYPI_USERNAME | Username for PyPI | false | __token__ |
PYPI_REPO_URL | Repo URL for PyPI | false | See Options |
The plugin can be configured in the semantic-release configuration file. Here is a minimal example:
{
"plugins": [
"@semantic-release/commit-analyzer",
"@semantic-release/release-notes-generator",
"semantic-release-pypi",
]
}
Note that this plugin modifies the version inside of pyproject.toml
(legacy: setup.cfg
).
Make sure to commit pyproject.toml
using the @semantic-release/git
plugin, if you want to save the changes:
{
"plugins": [
"@semantic-release/commit-analyzer",
"@semantic-release/release-notes-generator",
"semantic-release-pypi",
[
"@semantic-release/git",
{
"message": "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}",
"assets": ["pyproject.toml"]
}
]
]
}
Working examples using Github Actions can be found here:
Option | Type | Default | Description |
---|---|---|---|
srcDir | str | . | source directory (defaults to current directory) |
distDir | str | dist | directory to put the source distribution archive(s) in, relative to the directory of setup.py |
repoUrl | str | https://upload.pypi.org/legacy/ | The repository (package index) to upload the package to. |
pypiPublish | bool | true | Whether to publish the python package to the pypi registry. If false the package version will still be updated. |
gpgSign | bool | false | Whether to sign the package using GPG. A valid PGP key must already be installed and configured on the host. |
gpgIdentity | str | null | When gpgSign is true, set the GPG identify to use when signing files. Leave empty to use the default identity. |
envDir | string | false | .venv | directory to create the virtual environment in, if set to false no environment will be created |
installDeps | bool | true | wether to automatically install python dependencies |
source init.sh
source init.sh
yarn test
yarn lint
to ensure your code adheres to the linting rulesFAQs
semantic-release plugin to publish a python package to PyPI
The npm package semantic-release-pypi receives a total of 3,231 weekly downloads. As such, semantic-release-pypi popularity was classified as popular.
We found that semantic-release-pypi demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.