
Security News
Crates.io Users Targeted by Phishing Emails
The Rust Security Response WG is warning of phishing emails from rustfoundation.dev targeting crates.io users.
This is a hatch-vcs heavily inspired plugin: it captures values from the build environment (eg. github, pyproject.toml etc.) and it uses these to process files during the build/packaging process.
In a typical project (let's call it foobar):
└── foobar-project
├── pyproject.toml
└── src
└── foobar
└── __init__.py <- __version__ and __hash__ are update during build
With the pyproject.toml set like:
[build-system]
requires = ["hatchling", "hatch-ci"]
build-backend = "hatchling.build"
[project]
dynamic = ["version"]
# the version-file needs to be repeated twice here
[tool.hatch.version]
version-file = "src/package/__init__.py"
[tool.hatch.build.hooks.ci]
version-file = "src/{name}/__init__.py"
# performs these string replacements
process-replace = [
["re:(replace-me)", "[\\\\1]"],
["string-to-replace", "replacement-string"]
]
# before jinja process these
process-paths = [
"src/project/template.jinja2"
]
Building the sdist/wheel package will have the __version__
and __hash__
set
depending on the branch and current commit.
During the wheel build the version is dynamically updated with information taken from
the version-file
field (see "Version source options").
Two variables will be overwritten/modified in version-file
: the version
containing the semgrep version and hash with the git commit for the build.
The version information is augmented with:
The last two steps are mean to be managed in a CI/CD system (github at the moment), to ensure hands-off releases.
In essence this pluging:
Table of Contents
Ensure hatch-ci
is defined within the build-system.requires
field in your pyproject.toml
file.
[build-system]
requires = ["hatchling", "hatch-ci"]
build-backend = "hatchling.build"
The version source plugin name is ci
.
This will enable the hatch-ci pluging:
pyproject.toml
[project]
..
dynamic = ["version"] # this rerieves the version dynamically
..
pyproject.toml
[tool.hatch.version]
source = "ci" # this pulls the version using the hatch-ci hook
# this will put/update __version__ and __hash__ info in version-file
version-file = "src/hatch_ci/__init__.py"
# these files will be jinja2 processed, the environment will
# contains variables as: branch, build, current, ref, runid,
# sha, version, workflow etc.
paths = [ "README.md" ]
# the listed paths will undergo replacement before jinja2 processing and
# the variables 'a' & 'b' listed below wil be replaced with ctx attributes.
fixers = [
{ 'a': '{ctx.workflows}' },
{ 'd': '{ctx.branch}' }
]
The complete list of attributes is available here TEMPLATE.md.
Option | Type | Default | Description |
---|---|---|---|
version-file | str | None | A file where to write version/hash variables |
paths | `list[str] | str` | None |
fixers | list[dict[str,str]] | None | A list of dict, each key is a string to replace with the value |
hatch-ci
is distributed under the terms of the MIT license.
FAQs
Hatch plugin for ci system versioning
We found that hatch-ci demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
The Rust Security Response WG is warning of phishing emails from rustfoundation.dev targeting crates.io users.
Product
Socket now lets you customize pull request alert headers, helping security teams share clear guidance right in PRs to speed reviews and reduce back-and-forth.
Product
Socket's Rust support is moving to Beta: all users can scan Cargo projects and generate SBOMs, including Cargo.toml-only crates, with Rust-aware supply chain checks.