build: package metadata, CI, and trusted publishing - #8
Merged
Conversation
The project had name, version and dependencies and nothing else — no summary, license, readme, urls or classifiers — so it could not be published anywhere recognisable. Fills those in and pins the SPDX license expression. Adds two workflows, the repo had none: - tests: pytest across 3.11-3.13 on Linux and macOS, plus a build job that runs `python -m build` and `twine check` on every PR. Packaging breaks quietly and is discovered at release time otherwise. - publish: PyPI upload over Trusted Publishing (OIDC) on a published release. No API token is stored anywhere, so there is nothing to leak or rotate. Verified locally: both distributions build and pass `twine check`, and the wheel carries the metadata and both console scripts. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Зачем
В
pyproject.tomlбыли толькоname,versionи зависимости — ни описания, ни лицензии,ни readme, ни ссылок, ни классификаторов. В таком виде пакет нельзя опубликовать так, чтобы
он выглядел прилично. Плюс в репозитории вообще не было CI.
Что внутри
MIT, автор, keywords, 10 классификаторов,ссылки на репозиторий и issues.
tests.yml: pytest на 3.11/3.12/3.13 × Linux/macOS + отдельная job со сборкой(
python -m build+twine check) на каждый PR — чтобы упаковка ломалась на PR, а не вмомент релиза.
publish.yml: публикация на PyPI через Trusted Publishing (OIDC) по событию release.Токенов не существует нигде — нечему утекать и нечего ротировать.
Проверено локально
Метаданные в колесе на месте, оба console scripts (
session-recall,session-recall-mcp)объявлены.
Что нужно сделать руками (я туда не хожу)
На pypi.org завести trusted publisher для проекта
session-recall:owner
AbsoluteMode, репозиторийsession-recall, workflowpublish.yml, environmentpypi.Имя
session-recallна PyPI сейчас свободно.🤖 Generated with Claude Code