Attach an attested zipapp to releases and propose a Homebrew formula - #10
Open
oxff644 wants to merge 1 commit into
Open
Attach an attested zipapp to releases and propose a Homebrew formula#10oxff644 wants to merge 1 commit into
oxff644 wants to merge 1 commit into
Conversation
agentcov has no runtime dependencies, so the wheel repacks into a ~58KB zipapp that runs on any Python 3.11+. The release build places dist/agentcov.pyz next to the wheel and sdist, so it is covered by the existing provenance attestation and release upload; the PyPI publish step now filters release assets to the wheel and sdist so the zipapp never reaches the index. CI builds and smoke-runs the zipapp so a packaging break fails before a release. packaging/homebrew/ carries a proposed tap formula (installing the pure-Python wheel, since building the sdist needs the uv_build backend) for maintainers to adopt if they want a brew channel. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
agentcov has zero runtime dependencies, which makes it a perfect candidate
for a single-file distribution: the wheel repacks into a ~58 KB zipapp that
runs anywhere Python 3.11+ exists, with no installer at all.
Changes
.github/scripts/build_zipapp.py(stdlib only, same uv-script style as theexisting release script) unpacks the wheel
uv buildproduced and emitsdist/agentcov.pyz, keeping.dist-infosoimportlib.metadataworksinside the archive.
The release build job builds the zipapp into
dist/, so it is covered bythe existing provenance attestation (
subject-path: dist/*) andattached to the GitHub release with the wheel and sdist. Users get:
The PyPI publish step now downloads release assets with
--pattern '*.whl' --pattern '*.tar.gz', because it previously took everyrelease asset and would have handed the
.pyzto the index.CI builds and smoke-runs the zipapp, following the existing rationale that
packaging breaks should fail in CI rather than mid-release.
packaging/homebrew/carries a proposed tap formula (installing thepure-Python wheel, since building the sdist would require the
uv_buildbackend that Homebrew's isolated builds don't provide) plus notes on
automating version bumps. Nothing in the repo consumes it; whether and
where to host a tap is a maintainer decision. A
curl | shinstaller wasconsidered and deliberately not proposed.
README documents
uvx,pipx, and the verified zipapp flow.Test plan
make checkpasses. The zipapp was built locally and smoke-tested both as anexecutable (
./dist/agentcov.pyz --help) and viapython3 agentcov.pyz summaryagainst a real repository; both workflow files parse as YAML and theformula passes
ruby -c.🤖 Generated with Claude Code