Modernize python package setup - #331
Conversation
3a02cec to
549244d
Compare
|
Yes of course, I would love to! How do you suggest to proceed? Shall we merge this and redo the other one, or vice versa? This change does work in both, poetry and uv; as it depends only on PEP-specified behaviour right now. |
973251f to
fccb68b
Compare
|
@Alicipy You missed the github ci related changes I guess. Some other notes: gitbook support seems to be deprecated. Using a docs dir is the defacto standard compatible with mkdocs and other Python ecosystem static documentation generators. I‘d recommmend to have a look into https://github.com/OWASP/pytm/pull/305/changes#diff-50c86b7ed8ac2cf95bd48334961bf0530cdc77b5a56f852c5c61b89d735fd711 (and the overall PR) which addresses those topics already. |
1cfb4fa to
76b9c4d
Compare
|
I have split the docs out, and integrated the CI work from @fkromer. I kept it tool agnostic for now. While I personally also like uv, I do not want to break any workflow that is preferable by the maintainers currently, but would help migrating further if wanted :) Thanks for the work on pytm so far! |
|
@Alicipy Providing better backwards compatibility is a good idea 😁 the rather oldschool pdoc3 is docs only… not really relevant to me. |
|
Just a thought - I think it would make sense to remove the poetry stuff from CONTRIBUTING.md - we don't need to give instructions for another package that may diverge over time. |
There was a problem hiding this comment.
Formatting does not really need black because ruff provides a black compatible formatter https://docs.astral.sh/ruff/formatter/ and linter https://docs.astral.sh/ruff/faq/#is-the-ruff-linter-compatible-with-black out of the box.
| dev = [ | ||
| "pytest>=8.3.5,<9.0.0", | ||
| "black>=25.9.0,<26.0.0", | ||
| "pdoc3>=0.11.6,<0.12.0", |
There was a problem hiding this comment.
All modern projects use mkdocstings instead. E.g. FastAPI https://github.com/fastapi/fastapi/blob/master/pyproject.toml#L140 which is a good reference.
There was a problem hiding this comment.
I agree, but I would put that in a different PR, as this should only touch the project setup.
There was a problem hiding this comment.
Makes sense… Note: mkdocstrings is deprecated by Zensical in the meanwhile. Relates to #352 .
| description = "A Pythonic framework for threat modeling" | ||
| authors = ["pytm Team <please_use_github_issues@nowhere.com>"] | ||
| license = "MIT License" | ||
| authors = [{ name = "pytm Team", email = "please_use_github_issues@nowhere.com" }] |
There was a problem hiding this comment.
Would make sense to give all contributors contribution by name here as well I guess: https://github.com/OWASP/pytm/pull/305/changes#diff-50c86b7ed8ac2cf95bd48334961bf0530cdc77b5a56f852c5c61b89d735fd711
There was a problem hiding this comment.
I would rather not, and I think there is a better home for it. This is PyPi metadata and ends up in the wheels Metadata on the projecdt page. If at all, then only the main maintainer should have it's mail here.
If @izra wants it, he can put it in, but I would say the CONTRIBUTOR.md file is the beter place for it.
Poetry 1.x rejects a pyproject.toml without [tool.poetry], and 2.0 does not know [dependency-groups] - `--with dev` fails there with "Group(s) not found: dev". Signed-off-by: Stefan Kraus <dev@stefankraus.org>
Lets any packaging tool read the metadata, not just Poetry. The lock file is refreshed because the dependencies moved. Signed-off-by: Stefan Kraus <dev@stefankraus.org>
[dependency-groups] is the standard table for these now, so uv and pip --group can install them without Poetry. Signed-off-by: Stefan Kraus <dev@stefankraus.org>
hatchling is the PyPA-maintained build backend; building a wheel no longer needs Poetry installed, though Poetry stays for the workflow. It ships everything under pytm/, so the packages and include lists Poetry needed go away with it. Signed-off-by: Stefan Kraus <dev@stefankraus.org>
Installing and building both changed with the metadata, so the contributing guide spells the standard commands out. Signed-off-by: Stefan Kraus <dev@stefankraus.org>
efb2e94 to
90de30a
Compare
I hope I removed all references. |
I agree, but adding 'ruff' in this PR would reformat a few files, I would so that in a clean new PR instead. |
|
@izar Hope I fixed everything properly, ready for re-review / merge |
|
Thanks for taking the time to review and improve it @fkromer :) |
3 participants
While starting with pytm, I saw a few things regarding package management that could use improvement, especially as the Python folks use pure pip or uv currently, and maybe wondering why the commands don't work.
This PR includes migration to the default pyproject.toml keys which poetry in version 2 also understands, so nothing breaks. As pip can handle these as well, we can remove a few other files which existed for compatibility reasons (?) as well.