gh-action-pypi-publish
semver
gh-action-pypi-publish | semver | |
---|---|---|
5 | 726 | |
844 | 7,037 | |
2.0% | 0.8% | |
8.1 | 0.6 | |
1 day ago | 16 days ago | |
Python | ||
BSD 3-clause "New" or "Revised" License | - |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
gh-action-pypi-publish
-
PyPI new user and new project registrations temporarily suspended
> Recently I've seen someone on Reddit trying to automate the creation of PyPI projects through GitHub Actions. The person was complaining that the first deployment couldn't use an API key for that project since it didn't exist. So I'm not surprised some people are trying to do the same for malicious purposes.
Sorry for the tangent, but: you can do this now! If you use trusted publishing, you can register a "pending publisher" for a project that doesn't exist yet. When the trusted publisher (like GitHub Actions) is used, it'll create the project[1].
All of this is supported transparently by the official publishing action for GitHub Actions[2].
[1]: https://docs.pypi.org/trusted-publishers/creating-a-project-...
[2]: https://github.com/pypa/gh-action-pypi-publish
-
Publishing to PyPI via GitHub Action
In the documentation example, I see that the action yaml file contains the line uses: pypa/gh-action-pypi-publish@release/v1. I have never done this before and almost went with that, but I am not sure why the example shows v1 hardcoded, so I don't think I actually want this to happen. It doesn't seem to be well explained though, and the pypi-publish action repo was also quiet on this. Is this saying that it will create a release branch in my repo and call the release v1? Or how will this appear after I've done it? Will I have to manually change this v1 to v0.1.1 in the actions file AND the pyproject.toml?
-
"Even with --dry-run pip will execute arbitrary code found in the package's setup.py. In fact, merely asking pip to download a package can execute arbitrary code"
Yeah, you're uploading to PyPi in your pipeline, great. The custom github action still uses twine because the stdlib falls short on BASIC security. https://github.com/pypa/gh-action-pypi-publish/blob/unstable/v1/twine-upload.sh
-
Do you publish pypi source code to Github as well in the same form?
I never bothered with pypi myself but I hope the nudge into github actions helps you. I've found the following promising github action: https://github.com/pypa/gh-action-pypi-publish
- The Python Package Index is now a GitHub secret scanning integrator
semver
-
The right development flow: Better than Agile
We increase the version of our product as specified in SemVer and deploy it to production, preferably following good deployment practices to have no downtime.
-
Git commit helper: add emojis to your commits
Using Conventional Commits β as a standard for your commit messages, makes Semantic Versioning π as easy as can be, with tools like Conventional Changelog π Standard Version π and Semantic Release π¦π
-
Why write a library?
Semantic Versioning: for every update (major, minor, or patch) made, increment the version number according to semantic versioning.
-
Node package managers (npm, yarn, pnpm) - All you need to know
npm automates the process of installing, updating, and managing dependencies, which helps to avoid "dependency hell." It supports semantic versioning (semver) that automatically handles patch and minor updates without breaking the existing code, thus maintaining stability across projects. npm also provides the capability to run scripts and commands defined in package.json, which can automate common tasks such as testing, building, and deployment.
-
Snyk CLI: Introducing Semantic Versioning and release channels
We are pleased to introduce Semantic Versioning and release channels to Snyk CLI from v.1.1291.0 onwards. In this blog post, we will share why we are introducing these changes, what problems these changes solve for our customers, and how our customers can opt-in according to their needs.
-
Master the Art of Writing and Launching Your Own Modern JavaScript and Typescript Library in 2024
Following the Semantic Versioning rules, you should raise the version number every time you need to publish your library. In your "package.json" file, you need to change the version number to reflect whether the changes are major, minor, or patch updates.
-
Using semantic-release to automate releases and changelogs
Semantic Versioning: An established convention for version numbers following the pattern MAJOR.MINOR.PATCH
-
Essential Command Line Tools for Developers
Increases the major of the latest tag and prints it As per the Semver spec, it'll also clear the pre-releaseβ¦
-
Testing Our Tasks
The reason for this is that software libraries and package managers, in general, but specifically here, rely on semantic versioning. Semantic versioning is really useful for distributing packages in a predictable way. What does this look like for our project?
-
What is Semantic Versioning and why you should use it for your software ?
For a more detailed and comprehensive guide on semantic versioning, visit https://semver.org
What are some alternatives?
build - A simple, correct Python build frontend
react-native - A framework for building native applications using React
git-filter-repo - Quickly rewrite git repository history (filter-branch replacement)
semantic-release - :package::rocket: Fully automated version management and package publishing
amplify-preview-actions - This action deploys your AWS Amplify pull request preview for your public repository
standard-version - :trophy: Automate versioning and CHANGELOG generation, with semver.org and conventionalcommits.org
git-repo-sync - Git Repo Sync enables you to synchronize code to other code management platforms, such as GitLab, Gitee, etc.
changesets - π¦ A way to manage your versioning and changelogs with a focus on monorepos
trufflehog - Find and verify secrets
helmfile - Deploy Kubernetes Helm Charts
release - Contains every things needed to release jenkins core from the jenkins infra project
Poetry - Python packaging and dependency management made easy