Security News
Fluent Assertions Faces Backlash After Abandoning Open Source Licensing
Fluent Assertions is facing backlash after dropping the Apache license for a commercial model, leaving users blindsided and questioning contributor rights.
.. image:: https://img.shields.io/pypi/v/pytest-runner.svg
:target: PyPI link
_
.. image:: https://img.shields.io/pypi/pyversions/pytest-runner.svg
:target: PyPI link
_
.. _PyPI link: https://pypi.org/project/pytest-runner
.. image:: https://github.com/pytest-dev/pytest-runner/workflows/tests/badge.svg :target: https://github.com/pytest-dev/pytest-runner/actions?query=workflow%3A%22tests%22 :alt: tests
.. image:: https://img.shields.io/badge/code%20style-black-000000.svg :target: https://github.com/psf/black :alt: Code style: Black
.. .. image:: https://readthedocs.org/projects/skeleton/badge/?version=latest .. :target: https://skeleton.readthedocs.io/en/latest/?badge=latest
.. image:: https://img.shields.io/badge/skeleton-2022-informational :target: https://blog.jaraco.com/skeleton
.. image:: https://tidelift.com/badges/package/pypi/pytest-runner :target: https://tidelift.com/subscription/pkg/pypi-pytest-runner?utm_source=pypi-pytest-runner&utm_medium=readme
Setup scripts can use pytest-runner to add setup.py test support for pytest runner.
pytest-runner depends on deprecated features of setuptools and relies on features that break security
mechanisms in pip. For example 'setup_requires' and 'tests_require' bypass pip --require-hashes
.
See also pypa/setuptools#1684 <https://github.com/pypa/setuptools/issues/1684>
_.
It is recommended that you:
'pytest-runner'
from your setup_requires
, preferably removing the setup_requires
option.'pytest'
and any other testing requirements from tests_require
, preferably removing the tests_requires
option.setup.py pytest
.--index-url
to have test requirements downloaded from an alternate
index URL (unnecessary if specified for easy_install in setup.cfg).--addopts
.python setup.py pytest
command (like index-url
)
in the [pytest]
section of setup.cfg
.py.test
run (like addopts
or pep8ignore
) in the [pytest]
section of pytest.ini
or tox.ini
or put them in the [tool:pytest]
section of setup.cfg
. See pytest issue 567 <https://github.com/pytest-dev/pytest/issues/567>
_.test=pytest
in the [aliases]
section of setup.cfg
to cause python setup.py test
to invoke pytest.The most simple usage looks like this in setup.py::
setup(
setup_requires=[
'pytest-runner',
],
tests_require=[
'pytest',
],
)
Additional dependencies require to run the tests (e.g. mock or pytest plugins) may be added to tests_require and will be downloaded and required by the session before invoking pytest.
Follow this search on github <https://github.com/search?utf8=%E2%9C%93&q=filename%3Asetup.py+pytest-runner&type=Code&ref=searchresults>
_
for examples of real-world usage.
This technique is deprecated - if you have standalone scripts
you wish to invoke with dependencies, use pip-run <https://pypi.org/project/pip-run>
_.
Although pytest-runner
is typically used to add pytest test
runner support to maintained packages, pytest-runner
may
also be used to create standalone tests. Consider this example failure <https://gist.github.com/jaraco/d979a558bc0bf2194c23>
,
reported in jsonpickle #117 <https://github.com/jsonpickle/jsonpickle/issues/117>
or this MongoDB test <https://gist.github.com/jaraco/0b9e482f5c0a1300dc9a>
_
demonstrating a technique that works even when dependencies
are required in the test.
Either example file may be cloned or downloaded and simply run on any system with Python and Setuptools. It will download the specified dependencies and run the tests. Afterward, the the cloned directory can be removed and with it all trace of invoking the test. No other dependencies are needed and no system configuration is altered.
Then, anyone trying to replicate the failure can do so easily and with all the power of pytest (rewritten assertions, rich comparisons, interactive debugging, extensibility through plugins, etc).
As a result, the communication barrier for describing and replicating failures is made almost trivially low.
Because it uses Setuptools setup_requires, pytest-runner will install itself on every invocation of setup.py. In some cases, this causes delays for invocations of setup.py that will never invoke pytest-runner. To help avoid this contingency, consider requiring pytest-runner only when pytest is invoked::
needs_pytest = {'pytest', 'test', 'ptr'}.intersection(sys.argv)
pytest_runner = ['pytest-runner'] if needs_pytest else []
# ...
setup(
#...
setup_requires=[
#... (other setup requirements)
] + pytest_runner,
)
Available as part of the Tidelift Subscription.
This project and the maintainers of thousands of other packages are working with Tidelift to deliver one enterprise subscription that covers all of the open source you use.
Learn more <https://tidelift.com/subscription/pkg/pypi-PROJECT?utm_source=pypi-PROJECT&utm_medium=referral&utm_campaign=github>
_.
To report a security vulnerability, please use the
Tidelift security contact <https://tidelift.com/security>
_.
Tidelift will coordinate the fix and disclosure.
FAQs
Invoke py.test as distutils command with dependency resolution
We found that pytest-runner demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Fluent Assertions is facing backlash after dropping the Apache license for a commercial model, leaving users blindsided and questioning contributor rights.
Research
Security News
Socket researchers uncover the risks of a malicious Python package targeting Discord developers.
Security News
The UK is proposing a bold ban on ransomware payments by public entities to disrupt cybercrime, protect critical services, and lead global cybersecurity efforts.