Package Health Score

65 / 100

security
No known security issues
popularity
Small
maintenance
Sustainable
community
Limited

Explore Similar Packages

Security

No known security issues

All security vulnerabilities belong to production dependencies of direct and indirect packages.

Security and license risk for significant versions

Version				Vulnerabilities	License Risk
4.1.1	\|	12/2024		0 C 0 H 0 M 0 L	0 H 0 M 0 L
4.0.3	\|	10/2024	Popular	0 C 0 H 0 M 0 L	0 H 0 M 0 L
3.0.2	\|	06/2024		0 C 0 H 0 M 0 L	0 H 0 M 0 L
2.5.2	\|	08/2023		0 C 0 H 0 M 0 L	0 H 0 M 0 L
2.4.3	\|	10/2021		0 C 0 H 0 M 0 L	0 H 0 M 0 L

License

MIT

Security Policy

Is your project affected by vulnerabilities?

Scan your projects for vulnerabilities. Fix quickly with automated fixes. Get started with Snyk for free.

Get started free

Popularity

Small

Weekly Downloads (4,093)

GitHub Stars: 27
Forks: 11
Contributors: -

Direct Usage Popularity

The npm package semantic-release-pypi receives a total of 4,093 downloads a week. As such, we scored semantic-release-pypi popularity level to be Small.

Based on project statistics from the GitHub repository for the npm package semantic-release-pypi, we found that it has been starred 27 times.

Downloads are calculated as moving averages for a period of the last 12 months, excluding weekends and known missing data points.

Community

Limited

Readme.md: Yes
Contributing.md: No
Code of Conduct: No
Contributors: 0
Funding: No

This project has seen only 10 or less contributors.

We found a way for you to contribute to the project! Looks like semantic-release-pypi is missing a Code of Conduct.

Embed Package Health Score Badge

Maintenance

Sustainable

Commit Frequency

Open Issues: 1
Open PR: 0
Last Release: 15 days ago
Last Commit: 15 days ago

Further analysis of the maintenance status of semantic-release-pypi based on released npm versions cadence, the repository activity, and other data points determined that its maintenance is Sustainable.

We found that semantic-release-pypi demonstrates a positive version release cadence with at least one new version released in the past 3 months.

As a healthy sign for on-going project maintenance, we found that the GitHub repository had at least 1 pull request or issue interacted with by the community.

Keep your project healthy

Check your package.json

Ensure all the packages you're using are healthy and well-maintained

Snyk Vulnerability Scanner

Get health score & security insights directly in your IDE

Package

Node.js Compatibility: not defined

Age: 4 years
Dependencies: 5 Direct
Versions: 30
Install Size: 41.8 kB
Dist-tags: 2
# of Files: 27
Maintainers: 1
TS Typings: No

semantic-release-pypi has more than a single and default latest tag published for the npm package. This means, there may be other tags available for this package, such as next to indicate future releases, or stable to indicate stable releases.

Readme

📦🐍 semantic-release-pypi

semantic-release plugin to publish a python package to PyPI

CI environment

Node.js >= 18.0.0
Python >= 3.8

Build System Interfaces

semantic-release-pypi support two build system interfaces

pyproject.toml based (Recommended)
- version will be set inside pyproject.toml - PEP 621
- The build backend can be specified inside pyproject.toml (defaults to setuptools) - PEP 518

setup.py based (Legacy interface)
- setuptools is required, other packaging tools like Poetry or Hatch are not supported when using this interface
- version will be set inside setup.cfg
- version must not be set inside setup.py

Steps

Step	Description
`verifyConditions`	verify the environment variable `PYPI_TOKEN` verify `PYPI_TOKEN` is authorized to publish on the specified repository check if the packages `setuptools`, `wheel` and `twine` are installed
`prepare`	Update the version in `pyproject.toml` (legacy: `setup.cfg`) and create the distribution packages
`publish`	Publish the python package to the specified repository (default: pypi)

Environment variables

Variable	Description	Required	Default
`PYPI_TOKEN`	API token for PyPI	true
`PYPI_USERNAME`	Username for PyPI	false	`__token__`
`PYPI_REPO_URL`	Repo URL for PyPI	false	See Options

Usage

The plugin can be configured in the semantic-release configuration file. Here is a minimal example:

{
  "plugins": [
    "@semantic-release/commit-analyzer",
    "@semantic-release/release-notes-generator",
    "semantic-release-pypi",
  ]
}

Note that this plugin modifies the version inside of pyproject.toml (legacy: setup.cfg). Make sure to commit pyproject.toml using the @semantic-release/git plugin, if you want to save the changes:

{
  "plugins": [
    "@semantic-release/commit-analyzer",
    "@semantic-release/release-notes-generator",
    "semantic-release-pypi",
    [
      "@semantic-release/git",
      {
          "message": "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}",
          "assets": ["pyproject.toml"]
      }
    ]
  ]
}

Working examples using Github Actions can be found here:

Options

Option	Type	Default	Description
`srcDir`	str	`.`	source directory (defaults to current directory)
`distDir`	str	`dist`	directory to put the source distribution archive(s) in, relative to the directory of `setup.py`
`repoUrl`	str	`https://upload.pypi.org/legacy/`	The repository (package index) to upload the package to.
`pypiPublish`	bool	`true`	Whether to publish the python package to the pypi registry. If false the package version will still be updated.
`gpgSign`	bool	`false`	Whether to sign the package using GPG. A valid PGP key must already be installed and configured on the host.
`gpgIdentity`	str	`null`	When `gpgSign` is true, set the GPG identify to use when signing files. Leave empty to use the default identity.
`envDir`	string \| `false`	`.venv`	directory to create the virtual environment in, if set to `false` no environment will be created
`installDeps`	bool	`true`	wether to automatically install python dependencies
`versionCmd`	string	`undefined`	Run a custom command to update the version (e.g. `hatch version ${version}`). `srcDir` is used as working directory. `versionCmd` is required if the version is set dynamically

Development

Pre-requisites

pyenv >= 2.1.0

source init.sh

Contribute

Fork from this repository
Run source init.sh
Add your changes
Make sure your code passes all unit tests by running yarn test
Run yarn lint to ensure your code adheres to the linting rules
Issue a PR

Alternatives

Python Semantic Release

semantic-release-pypi dependencies

execa form-data got lodash smol-toml

semantic-release-pypi development dependencies

@semantic-release/git @types/lodash @types/node @types/uuid @typescript-eslint/eslint-plugin @typescript-eslint/parser copyfiles eslint eslint-config-prettier eslint-plugin-prettier fs-extra prettier rimraf semantic-release typescript uuid vitest

FAQs

What is semantic-release-pypi?

semantic-release plugin to publish a python package to PyPI. Visit Snyk Advisor to see a full health score report for semantic-release-pypi, including popularity, security, maintenance & community analysis.

Is semantic-release-pypi popular?

The npm package semantic-release-pypi receives a total of 4,093 weekly downloads. As such, semantic-release-pypi popularity was classified as small. Visit the popularity section on Snyk Advisor to see the full health analysis.

Is semantic-release-pypi well maintained?

We found indications that semantic-release-pypi maintenance is sustainable demonstrating some project activity. We saw a total of 0 open source contributors collaborating on the project. See the full package health analysis to learn more about the package maintenance status.

Is semantic-release-pypi safe to use?

The npm package semantic-release-pypi was scanned for known vulnerabilities and missing license, and no issues were found. Thus the package was deemed as safe to use. See the full health analysis review.

Last updated on 19 December-2024, at 09:20 (UTC).

Build a secure application checklist

Select a recommended open source package

Minimize your risk by selecting secure & well maintained open source packages

DONE

Scan your app for vulnerabilities

Scan your application to find vulnerabilities in your: source code, open source dependencies, containers and configuration files

SCAN NOW

Fix identified vulnerabilities

Easily fix your code by leveraging automatically generated PRs

AUTO FIX

Monitor for new issues

New vulnerabilities are discovered every day. Get notified if your application is affected

MONITOR APP