[{"data":1,"prerenderedAt":1585},["ShallowReactive",2],{"page-\u002Fproject-setup-dependency-management\u002Fci-cd-pipelines-for-python-clis\u002Fpublishing-to-pypi-with-trusted-publishing\u002F":3,"content-directory":1038},{"id":4,"title":5,"body":6,"date":1023,"description":1024,"difficulty":1025,"draft":1026,"extension":1027,"meta":1028,"navigation":256,"path":1029,"seo":1030,"stem":1031,"tags":1032,"updated":1023,"__hash__":1037},"content\u002Fproject-setup-dependency-management\u002Fci-cd-pipelines-for-python-clis\u002Fpublishing-to-pypi-with-trusted-publishing\u002Findex.md","Publishing a CLI to PyPI with Trusted Publishing",{"type":7,"value":8,"toc":1005},"minimark",[9,24,29,54,58,61,65,68,71,75,87,124,135,139,149,167,170,174,185,717,739,759,762,766,777,788,792,795,828,832,835,876,879,910,914,920,924,929,932,936,939,943,951,955,967,971,1001],[10,11,12,13,17,18,23],"p",{},"The classic way to publish from CI is to create a PyPI API token, paste it into a repository secret, and pass it to ",[14,15,16],"code",{},"twine upload",". That token can upload any version of your package, never expires unless you remember to revoke it, and is readable by any workflow in the repository that asks for it — including one modified in a pull request if your settings allow. Trusted publishing removes the token entirely. PyPI trusts a specific repository, workflow and environment on GitHub; each release job proves its identity with a short-lived OpenID Connect token and receives an upload credential valid for a few minutes. This guide sets it up for a CLI project end to end: the PyPI configuration, a workflow that builds once and publishes from a protected environment, a TestPyPI rehearsal, and what to check when it fails. It is part of the ",[19,20,22],"a",{"href":21},"\u002Fproject-setup-dependency-management\u002Fci-cd-pipelines-for-python-clis\u002F","CI\u002FCD pipelines topic",".",[25,26,28],"h2",{"id":27},"prerequisites","Prerequisites",[30,31,32,44,47],"ul",{},[33,34,35,36,39,40,23],"li",{},"A CLI that builds cleanly with ",[14,37,38],{},"uv build"," (or any PEP 517 backend). See ",[19,41,43],{"href":42},"\u002Fproject-setup-dependency-management\u002Fpackaging-python-clis-for-distribution\u002Fbuilding-wheels-and-sdists-for-python-clis\u002F","building wheels and sdists for Python CLIs",[33,45,46],{},"A PyPI account with two-factor authentication, and owner rights on the project — or the ability to create it.",[33,48,49,50,23],{},"A GitHub repository where releases are triggered by version tags, as in ",[19,51,53],{"href":52},"\u002Fproject-setup-dependency-management\u002Fci-cd-pipelines-for-python-clis\u002Fautomating-releases-from-git-tags\u002F","automating releases from git tags",[25,55,57],{"id":56},"how-it-works","How it works",[10,59,60],{},"Trusted publishing is built on OpenID Connect. GitHub Actions can mint a signed identity token (a JWT) for a running job, stating which repository, workflow file, git ref and environment it belongs to. PyPI verifies the signature against GitHub's public keys, checks the claims against the trusted publishers you configured, and, if they match, issues an API token scoped to your project that expires in about fifteen minutes.",[62,63],"inline-diagram",{"name":64},"ci-oidc-sequence",[10,66,67],{},"Nothing long-lived exists at any point. There is no secret to store, to leak into a log, to exfiltrate from a compromised dependency, or to rotate when a maintainer leaves.",[62,69],{"name":70},"ci-token-vs-trusted",[25,72,74],{"id":73},"step-1-configure-the-publisher-on-pypi","Step 1: configure the publisher on PyPI",[10,76,77,78,82,83,86],{},"On PyPI, open your project's ",[79,80,81],"strong",{},"Settings → Publishing"," page (for a project that does not exist yet, use ",[79,84,85],{},"Your account → Publishing → Add a pending publisher",", which reserves the name and creates the project on first upload). Add a GitHub publisher with:",[30,88,89,105,114],{},[33,90,91,94,95,98,99,94,102,23],{},[79,92,93],{},"Owner"," and ",[79,96,97],{},"repository name"," — for example ",[14,100,101],{},"acme",[14,103,104],{},"mytool",[33,106,107,110,111,23],{},[79,108,109],{},"Workflow name"," — the file name only, such as ",[14,112,113],{},"release.yml",[33,115,116,119,120,123],{},[79,117,118],{},"Environment name"," — ",[14,121,122],{},"pypi",". Optional on PyPI's side, but strongly recommended; it is what lets you require approval.",[10,125,126,127,130,131,134],{},"Do the same on ",[79,128,129],{},"test.pypi.org"," with environment ",[14,132,133],{},"testpypi"," if you want a rehearsal target. TestPyPI is a separate service with separate accounts.",[25,136,138],{"id":137},"step-2-create-a-protected-environment","Step 2: create a protected environment",[10,140,141,142,145,146,148],{},"In the GitHub repository, go to ",[79,143,144],{},"Settings → Environments",", create ",[14,147,122],{},", and configure:",[30,150,151,157],{},[33,152,153,156],{},[79,154,155],{},"Required reviewers",": one or two maintainers who must approve each publish.",[33,158,159,162,163,166],{},[79,160,161],{},"Deployment branches and tags",": restrict to tags matching ",[14,164,165],{},"v*",", so no branch workflow can ever deploy to it.",[10,168,169],{},"The environment is where the powerful permission lives. A workflow job that is not in this environment cannot obtain a token PyPI will accept, because the environment name is part of the claims PyPI checks.",[25,171,173],{"id":172},"step-3-the-workflow","Step 3: the workflow",[10,175,176,177,180,181,184],{},"Build and publish run as ",[79,178,179],{},"separate jobs",". The build job runs your build backend and any build-time dependencies — code you did not write — with no special permissions. The publish job has ",[14,182,183],{},"id-token: write",", but runs no build tooling at all: it only downloads the artefacts and uploads them.",[186,187,192],"pre",{"className":188,"code":189,"language":190,"meta":191,"style":191},"language-yaml shiki shiki-themes github-light github-dark","# .github\u002Fworkflows\u002Frelease.yml\nname: release\non:\n  push:\n    tags: [\"v*\"]\n\npermissions:\n  contents: read\n\njobs:\n  build:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n        with:\n          fetch-depth: 0\n      - uses: astral-sh\u002Fsetup-uv@v6\n      - name: Build sdist and wheel\n        run: uv build\n      - name: Check the version matches the tag\n        run: |\n          tag=\"${GITHUB_REF_NAME#v}\"\n          ls dist\u002F | grep -q -- \"-${tag}-py3-none-any.whl\" || {\n            echo \"::error::built version does not match tag ${GITHUB_REF_NAME}\"; ls dist; exit 1; }\n      - uses: actions\u002Fupload-artifact@v4\n        with:\n          name: dist\n          path: dist\u002F\n\n  publish-testpypi:\n    needs: build\n    runs-on: ubuntu-latest\n    environment: testpypi\n    permissions:\n      id-token: write\n    steps:\n      - uses: actions\u002Fdownload-artifact@v4\n        with: { name: dist, path: dist }\n      - uses: pypa\u002Fgh-action-pypi-publish@release\u002Fv1\n        with:\n          repository-url: https:\u002F\u002Ftest.pypi.org\u002Flegacy\u002F\n\n  publish-pypi:\n    needs: publish-testpypi\n    runs-on: ubuntu-latest\n    environment: pypi\n    permissions:\n      id-token: write\n    steps:\n      - uses: actions\u002Fdownload-artifact@v4\n        with: { name: dist, path: dist }\n      - uses: pypa\u002Fgh-action-pypi-publish@release\u002Fv1\n","yaml","",[14,193,194,203,218,228,236,251,258,266,277,282,290,298,309,317,331,339,350,362,374,385,397,408,414,420,426,438,445,456,467,472,480,491,500,511,519,530,537,549,577,589,596,607,612,620,630,639,649,656,665,672,683,706],{"__ignoreMap":191},[195,196,199],"span",{"class":197,"line":198},"line",1,[195,200,202],{"class":201},"sJ8bj","# .github\u002Fworkflows\u002Frelease.yml\n",[195,204,206,210,214],{"class":197,"line":205},2,[195,207,209],{"class":208},"s9eBZ","name",[195,211,213],{"class":212},"sVt8B",": ",[195,215,217],{"class":216},"sZZnC","release\n",[195,219,221,225],{"class":197,"line":220},3,[195,222,224],{"class":223},"sj4cs","on",[195,226,227],{"class":212},":\n",[195,229,231,234],{"class":197,"line":230},4,[195,232,233],{"class":208},"  push",[195,235,227],{"class":212},[195,237,239,242,245,248],{"class":197,"line":238},5,[195,240,241],{"class":208},"    tags",[195,243,244],{"class":212},": [",[195,246,247],{"class":216},"\"v*\"",[195,249,250],{"class":212},"]\n",[195,252,254],{"class":197,"line":253},6,[195,255,257],{"emptyLinePlaceholder":256},true,"\n",[195,259,261,264],{"class":197,"line":260},7,[195,262,263],{"class":208},"permissions",[195,265,227],{"class":212},[195,267,269,272,274],{"class":197,"line":268},8,[195,270,271],{"class":208},"  contents",[195,273,213],{"class":212},[195,275,276],{"class":216},"read\n",[195,278,280],{"class":197,"line":279},9,[195,281,257],{"emptyLinePlaceholder":256},[195,283,285,288],{"class":197,"line":284},10,[195,286,287],{"class":208},"jobs",[195,289,227],{"class":212},[195,291,293,296],{"class":197,"line":292},11,[195,294,295],{"class":208},"  build",[195,297,227],{"class":212},[195,299,301,304,306],{"class":197,"line":300},12,[195,302,303],{"class":208},"    runs-on",[195,305,213],{"class":212},[195,307,308],{"class":216},"ubuntu-latest\n",[195,310,312,315],{"class":197,"line":311},13,[195,313,314],{"class":208},"    steps",[195,316,227],{"class":212},[195,318,320,323,326,328],{"class":197,"line":319},14,[195,321,322],{"class":212},"      - ",[195,324,325],{"class":208},"uses",[195,327,213],{"class":212},[195,329,330],{"class":216},"actions\u002Fcheckout@v4\n",[195,332,334,337],{"class":197,"line":333},15,[195,335,336],{"class":208},"        with",[195,338,227],{"class":212},[195,340,342,345,347],{"class":197,"line":341},16,[195,343,344],{"class":208},"          fetch-depth",[195,346,213],{"class":212},[195,348,349],{"class":223},"0\n",[195,351,353,355,357,359],{"class":197,"line":352},17,[195,354,322],{"class":212},[195,356,325],{"class":208},[195,358,213],{"class":212},[195,360,361],{"class":216},"astral-sh\u002Fsetup-uv@v6\n",[195,363,365,367,369,371],{"class":197,"line":364},18,[195,366,322],{"class":212},[195,368,209],{"class":208},[195,370,213],{"class":212},[195,372,373],{"class":216},"Build sdist and wheel\n",[195,375,377,380,382],{"class":197,"line":376},19,[195,378,379],{"class":208},"        run",[195,381,213],{"class":212},[195,383,384],{"class":216},"uv build\n",[195,386,388,390,392,394],{"class":197,"line":387},20,[195,389,322],{"class":212},[195,391,209],{"class":208},[195,393,213],{"class":212},[195,395,396],{"class":216},"Check the version matches the tag\n",[195,398,400,402,404],{"class":197,"line":399},21,[195,401,379],{"class":208},[195,403,213],{"class":212},[195,405,407],{"class":406},"szBVR","|\n",[195,409,411],{"class":197,"line":410},22,[195,412,413],{"class":216},"          tag=\"${GITHUB_REF_NAME#v}\"\n",[195,415,417],{"class":197,"line":416},23,[195,418,419],{"class":216},"          ls dist\u002F | grep -q -- \"-${tag}-py3-none-any.whl\" || {\n",[195,421,423],{"class":197,"line":422},24,[195,424,425],{"class":216},"            echo \"::error::built version does not match tag ${GITHUB_REF_NAME}\"; ls dist; exit 1; }\n",[195,427,429,431,433,435],{"class":197,"line":428},25,[195,430,322],{"class":212},[195,432,325],{"class":208},[195,434,213],{"class":212},[195,436,437],{"class":216},"actions\u002Fupload-artifact@v4\n",[195,439,441,443],{"class":197,"line":440},26,[195,442,336],{"class":208},[195,444,227],{"class":212},[195,446,448,451,453],{"class":197,"line":447},27,[195,449,450],{"class":208},"          name",[195,452,213],{"class":212},[195,454,455],{"class":216},"dist\n",[195,457,459,462,464],{"class":197,"line":458},28,[195,460,461],{"class":208},"          path",[195,463,213],{"class":212},[195,465,466],{"class":216},"dist\u002F\n",[195,468,470],{"class":197,"line":469},29,[195,471,257],{"emptyLinePlaceholder":256},[195,473,475,478],{"class":197,"line":474},30,[195,476,477],{"class":208},"  publish-testpypi",[195,479,227],{"class":212},[195,481,483,486,488],{"class":197,"line":482},31,[195,484,485],{"class":208},"    needs",[195,487,213],{"class":212},[195,489,490],{"class":216},"build\n",[195,492,494,496,498],{"class":197,"line":493},32,[195,495,303],{"class":208},[195,497,213],{"class":212},[195,499,308],{"class":216},[195,501,503,506,508],{"class":197,"line":502},33,[195,504,505],{"class":208},"    environment",[195,507,213],{"class":212},[195,509,510],{"class":216},"testpypi\n",[195,512,514,517],{"class":197,"line":513},34,[195,515,516],{"class":208},"    permissions",[195,518,227],{"class":212},[195,520,522,525,527],{"class":197,"line":521},35,[195,523,524],{"class":208},"      id-token",[195,526,213],{"class":212},[195,528,529],{"class":216},"write\n",[195,531,533,535],{"class":197,"line":532},36,[195,534,314],{"class":208},[195,536,227],{"class":212},[195,538,540,542,544,546],{"class":197,"line":539},37,[195,541,322],{"class":212},[195,543,325],{"class":208},[195,545,213],{"class":212},[195,547,548],{"class":216},"actions\u002Fdownload-artifact@v4\n",[195,550,552,554,557,559,561,564,567,570,572,574],{"class":197,"line":551},38,[195,553,336],{"class":208},[195,555,556],{"class":212},": { ",[195,558,209],{"class":208},[195,560,213],{"class":212},[195,562,563],{"class":216},"dist",[195,565,566],{"class":212},", ",[195,568,569],{"class":208},"path",[195,571,213],{"class":212},[195,573,563],{"class":216},[195,575,576],{"class":212}," }\n",[195,578,580,582,584,586],{"class":197,"line":579},39,[195,581,322],{"class":212},[195,583,325],{"class":208},[195,585,213],{"class":212},[195,587,588],{"class":216},"pypa\u002Fgh-action-pypi-publish@release\u002Fv1\n",[195,590,592,594],{"class":197,"line":591},40,[195,593,336],{"class":208},[195,595,227],{"class":212},[195,597,599,602,604],{"class":197,"line":598},41,[195,600,601],{"class":208},"          repository-url",[195,603,213],{"class":212},[195,605,606],{"class":216},"https:\u002F\u002Ftest.pypi.org\u002Flegacy\u002F\n",[195,608,610],{"class":197,"line":609},42,[195,611,257],{"emptyLinePlaceholder":256},[195,613,615,618],{"class":197,"line":614},43,[195,616,617],{"class":208},"  publish-pypi",[195,619,227],{"class":212},[195,621,623,625,627],{"class":197,"line":622},44,[195,624,485],{"class":208},[195,626,213],{"class":212},[195,628,629],{"class":216},"publish-testpypi\n",[195,631,633,635,637],{"class":197,"line":632},45,[195,634,303],{"class":208},[195,636,213],{"class":212},[195,638,308],{"class":216},[195,640,642,644,646],{"class":197,"line":641},46,[195,643,505],{"class":208},[195,645,213],{"class":212},[195,647,648],{"class":216},"pypi\n",[195,650,652,654],{"class":197,"line":651},47,[195,653,516],{"class":208},[195,655,227],{"class":212},[195,657,659,661,663],{"class":197,"line":658},48,[195,660,524],{"class":208},[195,662,213],{"class":212},[195,664,529],{"class":216},[195,666,668,670],{"class":197,"line":667},49,[195,669,314],{"class":208},[195,671,227],{"class":212},[195,673,675,677,679,681],{"class":197,"line":674},50,[195,676,322],{"class":212},[195,678,325],{"class":208},[195,680,213],{"class":212},[195,682,548],{"class":216},[195,684,686,688,690,692,694,696,698,700,702,704],{"class":197,"line":685},51,[195,687,336],{"class":208},[195,689,556],{"class":212},[195,691,209],{"class":208},[195,693,213],{"class":212},[195,695,563],{"class":216},[195,697,566],{"class":212},[195,699,569],{"class":208},[195,701,213],{"class":212},[195,703,563],{"class":216},[195,705,576],{"class":212},[195,707,709,711,713,715],{"class":197,"line":708},52,[195,710,322],{"class":212},[195,712,325],{"class":208},[195,714,213],{"class":212},[195,716,588],{"class":216},[10,718,719,720,723,724,726,727,730,731,734,735,738],{},"The ",[14,721,722],{},"pypa\u002Fgh-action-pypi-publish"," action handles the OIDC exchange automatically when ",[14,725,183],{}," is granted, validates the distributions with ",[14,728,729],{},"twine check",", uploads them, and — by default for trusted publishing — generates and uploads ",[79,732,733],{},"attestations",": signed statements linking each file to this repository and workflow run, which PyPI displays and tools can verify. If you prefer to stay entirely within uv, ",[14,736,737],{},"uv publish"," also supports trusted publishing from GitHub Actions with no configuration beyond the permission.",[10,740,741,742,745,746,749,750,753,754,758],{},"The version check in the build job is a cheap guard for projects whose version is written in ",[14,743,744],{},"pyproject.toml"," rather than derived from the tag: publishing ",[14,747,748],{},"1.4.0"," from tag ",[14,751,752],{},"v1.5.0"," is a mistake that is tedious to undo, because PyPI never allows a filename to be reused. The adjacent guides on ",[19,755,757],{"href":756},"\u002Fproject-setup-dependency-management\u002Fmanaging-cli-versioning-changelogs\u002Fderiving-versions-from-git-tags-with-hatch-vcs\u002F","deriving versions from git tags with hatch-vcs"," remove the possibility altogether.",[62,760],{"name":761},"ci-publish-checklist",[25,763,765],{"id":764},"what-attestations-give-your-users","What attestations give your users",[10,767,768,769,773,774,776],{},"Attestations are easy to overlook because nothing breaks without them, but they change what a user can know about the tool they are installing. Each uploaded file gets a signed statement, following the PEP 740 format, recording the repository, the workflow file and the commit that produced it. PyPI shows this on the file's page as its provenance, and verification tools can check that the wheel a user downloaded was built by ",[770,771,772],"em",{},"your"," pipeline from ",[770,775,772],{}," repository — not uploaded by someone who obtained a maintainer's password.",[10,778,779,780,783,784,787],{},"For a CLI, which users typically install with ",[14,781,782],{},"pipx"," or ",[14,785,786],{},"uv tool install"," and then run with their own credentials and filesystem access, that provenance is a meaningful security property. It costs nothing to keep: attestations are generated automatically by the publish action when trusted publishing is used. The one thing that disables them is falling back to a stored API token \"just for this release\", which is another reason to delete old tokens once the new pipeline works.",[25,789,791],{"id":790},"ux-considerations","UX considerations",[10,793,794],{},"For a CLI's maintainers and users, a few practices make releases smoother:",[30,796,797,803,813,822],{},[33,798,799,802],{},[79,800,801],{},"Rehearse on TestPyPI."," The first trusted-publishing setup nearly always has a typo in a workflow or environment name. Publishing to TestPyPI first surfaces it without burning a real version number. Once the process is routine, some teams keep TestPyPI as a permanent first stage; others remove it.",[33,804,805,808,809,812],{},[79,806,807],{},"Install from TestPyPI to check the artefact."," ",[14,810,811],{},"uv tool install --index-url https:\u002F\u002Ftest.pypi.org\u002Fsimple\u002F --index-strategy unsafe-best-match --extra-index-url https:\u002F\u002Fpypi.org\u002Fsimple\u002F mytool==1.5.0"," resolves your package from TestPyPI and its dependencies from PyPI, which is a realistic install check.",[33,814,815,818,819,821],{},[79,816,817],{},"Approve deliberately."," Required reviewers on the ",[14,820,122],{}," environment give a last chance to notice \"wait, that tag was on the wrong commit\". Keep the reviewer list short so releases are not blocked on availability.",[33,823,824,827],{},[79,825,826],{},"Keep the release notes near the artefact."," Creating a GitHub release with the changelog section and the wheel attached, after publishing, gives users one place to read what changed.",[25,829,831],{"id":830},"testing-the-behaviour","Testing the behaviour",[10,833,834],{},"You cannot unit-test OIDC, but you can verify every other part before the first real release:",[30,836,837,847,856,866],{},[33,838,839,842,843,846],{},[79,840,841],{},"Validate distributions locally"," with ",[14,844,845],{},"uvx twine check dist\u002F*",", which catches README rendering problems that PyPI would reject.",[33,848,849,842,852,855],{},[79,850,851],{},"Lint the workflow",[14,853,854],{},"actionlint",", which catches misspelled keys, bad expressions and shell errors.",[33,857,858,861,862,865],{},[79,859,860],{},"Dry-run the build job"," on a branch by temporarily adding ",[14,863,864],{},"workflow_dispatch:"," to the triggers; the publish jobs will not run because the environments only accept tags.",[33,867,868,871,872,875],{},[79,869,870],{},"Push a pre-release tag"," such as ",[14,873,874],{},"v1.5.0rc1"," for the first end-to-end run. Pre-releases are not installed by default, so a mistake reaches almost nobody.",[10,877,878],{},"When the publish step fails, the error message from PyPI is usually specific. The common causes, in order:",[30,880,881,891,897,903],{},[33,882,883,886,887,890],{},[14,884,885],{},"invalid-publisher"," — the repository, workflow file name or environment does not exactly match the PyPI configuration. Check capitalisation and that the workflow name is the file name, not the ",[14,888,889],{},"name:"," field.",[33,892,893,894,896],{},"Missing ",[14,895,183],{}," — the permission must be on the job (or workflow) that runs the publish action.",[33,898,899,902],{},[14,900,901],{},"File already exists"," — that version was uploaded before. Versions are immutable on PyPI; bump the version.",[33,904,905,906,909],{},"A reusable workflow — trusted publishing from reusable workflows needs the publisher configured for the ",[770,907,908],{},"calling"," workflow; keep the publish job in the top-level workflow to avoid the confusion.",[25,911,913],{"id":912},"conclusion","Conclusion",[10,915,916,917,919],{},"Trusted publishing turns the most sensitive credential in a Python project into something that does not exist. Configure a publisher on PyPI, put the publish job in a protected environment restricted to version tags, build in one job and publish in another with only ",[14,918,183],{},", and rehearse on TestPyPI. Releases become a tag push and an approval click, and there is no token left to lose.",[25,921,923],{"id":922},"frequently-asked-questions","Frequently asked questions",[925,926,928],"h3",{"id":927},"can-i-use-trusted-publishing-from-gitlab-or-other-ci-systems","Can I use trusted publishing from GitLab or other CI systems?",[10,930,931],{},"PyPI supports trusted publishers for GitHub Actions, GitLab CI\u002FCD, Google Cloud Build and ActiveState, with more added over time. The configuration differs per provider, but the model — short-lived identity tokens exchanged for upload tokens — is the same.",[925,933,935],{"id":934},"do-i-still-need-an-api-token-for-anything","Do I still need an API token for anything?",[10,937,938],{},"Not for publishing from CI. Keep your account's two-factor authentication on, and delete any old project-scoped tokens once trusted publishing works, so the only way to upload is the audited pipeline.",[925,940,942],{"id":941},"what-about-publishing-standalone-binaries-alongside-the-wheel","What about publishing standalone binaries alongside the wheel?",[10,944,945,946,950],{},"Binaries built with PyInstaller or Nuitka are not uploaded to PyPI; attach them to the GitHub release in a later job. ",[19,947,949],{"href":948},"\u002Fproject-setup-dependency-management\u002Fdistributing-clis-as-standalone-binaries\u002Fbuilding-cross-platform-release-binaries-in-ci\u002F","Building cross-platform release binaries in CI"," shows the matrix for building them.",[925,952,954],{"id":953},"should-the-publish-job-run-tests-again","Should the publish job run tests again?",[10,956,957,958,962,963,966],{},"No — it should publish exactly the artefacts that were already tested. Run tests and the ",[19,959,961],{"href":960},"\u002Fproject-setup-dependency-management\u002Fci-cd-pipelines-for-python-clis\u002Fsmoke-testing-the-built-wheel-in-ci\u002F","wheel smoke test"," in jobs that the publish job ",[14,964,965],{},"needs",", and never rebuild in the publish job.",[25,968,970],{"id":969},"related","Related",[30,972,973,979,984,989,995],{},[33,974,975,976],{},"Up: ",[19,977,978],{"href":21},"CI\u002FCD pipelines for Python CLIs",[33,980,981],{},[19,982,983],{"href":52},"Automating releases from git tags",[33,985,986],{},[19,987,988],{"href":960},"Smoke-testing the built wheel in CI",[33,990,991],{},[19,992,994],{"href":993},"\u002Fproject-setup-dependency-management\u002Fpackaging-python-clis-for-distribution\u002Fpublishing-a-python-cli-to-pypi\u002F","Publishing a Python CLI to PyPI",[33,996,997],{},[19,998,1000],{"href":999},"\u002Fcli-runtime-systems-integration\u002Fsecrets-and-credentials-in-python-clis\u002Freading-secrets-from-env-and-files\u002F","Reading secrets from env and files",[1002,1003,1004],"style",{},"html pre.shiki code .sJ8bj, html code.shiki .sJ8bj{--shiki-default:#6A737D;--shiki-dark:#6A737D}html pre.shiki code .s9eBZ, html code.shiki .s9eBZ{--shiki-default:#22863A;--shiki-dark:#85E89D}html pre.shiki code .sVt8B, html code.shiki .sVt8B{--shiki-default:#24292E;--shiki-dark:#E1E4E8}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .szBVR, html code.shiki .szBVR{--shiki-default:#D73A49;--shiki-dark:#F97583}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":191,"searchDepth":205,"depth":205,"links":1006},[1007,1008,1009,1010,1011,1012,1013,1014,1015,1016,1022],{"id":27,"depth":205,"text":28},{"id":56,"depth":205,"text":57},{"id":73,"depth":205,"text":74},{"id":137,"depth":205,"text":138},{"id":172,"depth":205,"text":173},{"id":764,"depth":205,"text":765},{"id":790,"depth":205,"text":791},{"id":830,"depth":205,"text":831},{"id":912,"depth":205,"text":913},{"id":922,"depth":205,"text":923,"children":1017},[1018,1019,1020,1021],{"id":927,"depth":220,"text":928},{"id":934,"depth":220,"text":935},{"id":941,"depth":220,"text":942},{"id":953,"depth":220,"text":954},{"id":969,"depth":205,"text":970},"2026-09-18","Publish a Python CLI to PyPI from GitHub Actions with no API token: configure a trusted publisher, a protected environment, separate build and publish jobs, and TestPyPI.","intermediate",false,"md",{},"\u002Fproject-setup-dependency-management\u002Fci-cd-pipelines-for-python-clis\u002Fpublishing-to-pypi-with-trusted-publishing",{"title":5,"description":1024},"project-setup-dependency-management\u002Fci-cd-pipelines-for-python-clis\u002Fpublishing-to-pypi-with-trusted-publishing\u002Findex",[122,1033,1034,1035,1036],"trusted-publishing","github-actions","security","release","2Zt3ZXfODKauQlLUdhObdx9EAQx7FEf6RsXRz8snTxM",[1039,1042,1045,1048,1051,1054,1057,1060,1063,1066,1069,1072,1075,1078,1081,1084,1087,1090,1093,1096,1099,1102,1105,1108,1111,1114,1117,1120,1123,1126,1129,1132,1135,1138,1141,1144,1147,1150,1153,1156,1159,1162,1165,1168,1171,1174,1177,1180,1183,1186,1189,1192,1195,1198,1201,1204,1207,1210,1213,1216,1219,1222,1225,1228,1231,1234,1237,1240,1243,1246,1249,1252,1255,1258,1261,1264,1267,1270,1273,1276,1279,1282,1285,1288,1291,1294,1297,1300,1303,1306,1309,1312,1315,1318,1321,1324,1327,1330,1333,1336,1339,1342,1345,1348,1351,1354,1357,1360,1363,1366,1369,1372,1375,1378,1381,1384,1387,1390,1393,1396,1399,1402,1405,1408,1411,1414,1417,1420,1423,1426,1429,1432,1435,1438,1441,1444,1447,1450,1451,1454,1457,1460,1463,1466,1469,1472,1475,1478,1481,1484,1487,1490,1493,1496,1499,1502,1505,1508,1511,1514,1517,1520,1523,1526,1529,1531,1534,1537,1540,1543,1546,1549,1552,1555,1558,1561,1564,1567,1570,1573,1576,1579,1582],{"path":1040,"title":1041},"\u002Fabout","About Python CLI Toolcraft",{"path":1043,"title":1044},"\u002Fadvanced-input-parsing-user-experience\u002Fadvanced-argument-validation-strategies","Advanced Argument Validation Strategies",{"path":1046,"title":1047},"\u002Fadvanced-input-parsing-user-experience\u002Fadvanced-argument-validation-strategies\u002Fparsing-nested-json-arguments-in-python-clis","Parsing Nested JSON Args in Python CLIs",{"path":1049,"title":1050},"\u002Fadvanced-input-parsing-user-experience\u002Fadvanced-argument-validation-strategies\u002Fvalidating-dependent-and-conflicting-options","Validating Dependent and Conflicting CLI Options",{"path":1052,"title":1053},"\u002Fadvanced-input-parsing-user-experience\u002Fadvanced-argument-validation-strategies\u002Fvalidating-file-and-directory-paths-in-clis","Validating File and Directory Paths in CLIs",{"path":1055,"title":1056},"\u002Fadvanced-input-parsing-user-experience\u002Fadvanced-argument-validation-strategies\u002Fwriting-custom-click-parameter-types","Writing Custom Click Parameter Types",{"path":1058,"title":1059},"\u002Fadvanced-input-parsing-user-experience\u002Fbuilding-terminal-uis-with-textual\u002Fbuilding-your-first-textual-app","Building Your First Textual App for a Python CLI",{"path":1061,"title":1062},"\u002Fadvanced-input-parsing-user-experience\u002Fbuilding-terminal-uis-with-textual\u002Fchoosing-between-a-cli-a-prompt-flow-and-a-tui","Choosing Between a CLI, a Prompt Flow and a TUI",{"path":1064,"title":1065},"\u002Fadvanced-input-parsing-user-experience\u002Fbuilding-terminal-uis-with-textual","Building Terminal UIs with Textual for Python CLIs",{"path":1067,"title":1068},"\u002Fadvanced-input-parsing-user-experience\u002Fbuilding-terminal-uis-with-textual\u002Ftesting-textual-apps-with-pilot","Testing Textual Apps with Pilot",{"path":1070,"title":1071},"\u002Fadvanced-input-parsing-user-experience\u002Fcli-help-output-and-documentation\u002Fadding-examples-and-epilogs-to-help-output","Adding Examples and Epilogs to Help Output",{"path":1073,"title":1074},"\u002Fadvanced-input-parsing-user-experience\u002Fcli-help-output-and-documentation\u002Fgenerating-man-pages-and-docs-from-a-cli","Generating Man Pages and Docs from a CLI",{"path":1076,"title":1077},"\u002Fadvanced-input-parsing-user-experience\u002Fcli-help-output-and-documentation","CLI Help Output and Documentation",{"path":1079,"title":1080},"\u002Fadvanced-input-parsing-user-experience\u002Fcli-help-output-and-documentation\u002Fversioning-and-deprecating-cli-flags","Versioning and Deprecating CLI Flags",{"path":1082,"title":1083},"\u002Fadvanced-input-parsing-user-experience\u002Fcli-help-output-and-documentation\u002Fwriting-help-text-users-actually-read","Writing Help Text Users Actually Read",{"path":1085,"title":1086},"\u002Fadvanced-input-parsing-user-experience\u002Fcross-platform-terminal-compatibility\u002Fadapting-output-to-terminal-width","Adapting Python CLI Output to Terminal Width",{"path":1088,"title":1089},"\u002Fadvanced-input-parsing-user-experience\u002Fcross-platform-terminal-compatibility\u002Fdetecting-ci-environments-and-non-interactive-shells","Detecting CI Environments and Non-Interactive Shells",{"path":1091,"title":1092},"\u002Fadvanced-input-parsing-user-experience\u002Fcross-platform-terminal-compatibility\u002Ffixing-unicode-and-encoding-errors-on-windows","Fixing Unicode and Encoding Errors on Windows in Python CLIs",{"path":1094,"title":1095},"\u002Fadvanced-input-parsing-user-experience\u002Fcross-platform-terminal-compatibility","Cross-Platform Terminal Compatibility for Python CLIs",{"path":1097,"title":1098},"\u002Fadvanced-input-parsing-user-experience\u002Fcross-platform-terminal-compatibility\u002Frespecting-no-color-and-force-color","Respecting NO_COLOR and FORCE_COLOR in Python CLIs",{"path":1100,"title":1101},"\u002Fadvanced-input-parsing-user-experience\u002Ferror-handling-and-exit-codes\u002Fchoosing-exit-codes-for-cli-tools","Choosing Exit Codes for CLI Tools",{"path":1103,"title":1104},"\u002Fadvanced-input-parsing-user-experience\u002Ferror-handling-and-exit-codes\u002Fdesigning-an-exception-hierarchy-for-a-cli","Designing an Exception Hierarchy for a Python CLI",{"path":1106,"title":1107},"\u002Fadvanced-input-parsing-user-experience\u002Ferror-handling-and-exit-codes\u002Ffriendly-error-messages-and-tracebacks","Friendly Error Messages and Tracebacks",{"path":1109,"title":1110},"\u002Fadvanced-input-parsing-user-experience\u002Ferror-handling-and-exit-codes\u002Fhandling-keyboard-interrupt-cleanly","Handling Keyboard Interrupt Cleanly",{"path":1112,"title":1113},"\u002Fadvanced-input-parsing-user-experience\u002Ferror-handling-and-exit-codes","Error Handling and Exit Codes for CLIs",{"path":1115,"title":1116},"\u002Fadvanced-input-parsing-user-experience\u002Ferror-handling-and-exit-codes\u002Freporting-machine-readable-errors-in-json-mode","Reporting Machine-Readable Errors in JSON Mode",{"path":1118,"title":1119},"\u002Fadvanced-input-parsing-user-experience\u002Fhandling-configuration-files-env-vars\u002Fconfig-precedence-flags-env-files-defaults","Config Precedence: Flags, Env, Files, Defaults",{"path":1121,"title":1122},"\u002Fadvanced-input-parsing-user-experience\u002Fhandling-configuration-files-env-vars\u002Fdiscovering-project-config-files-by-walking-up-directories","Discovering Project Config Files by Walking Up Directories",{"path":1124,"title":1125},"\u002Fadvanced-input-parsing-user-experience\u002Fhandling-configuration-files-env-vars","Handling Config Files and Env Vars in CLIs",{"path":1127,"title":1128},"\u002Fadvanced-input-parsing-user-experience\u002Fhandling-configuration-files-env-vars\u002Floading-yaml-configs-safely-in-cli-apps","Loading YAML configs safely in CLI apps",{"path":1130,"title":1131},"\u002Fadvanced-input-parsing-user-experience\u002Fhandling-configuration-files-env-vars\u002Freading-toml-config-with-tomllib","Reading TOML Config with tomllib in Python CLIs",{"path":1133,"title":1134},"\u002Fadvanced-input-parsing-user-experience\u002Fhandling-configuration-files-env-vars\u002Ftyped-settings-with-pydantic-settings","Typed Settings with pydantic-settings in Python CLIs",{"path":1136,"title":1137},"\u002Fadvanced-input-parsing-user-experience","Advanced Input Parsing for Python CLIs",{"path":1139,"title":1140},"\u002Fadvanced-input-parsing-user-experience\u002Finteractive-terminal-ui-with-rich\u002Fadding-progress-bars-and-spinners-to-python-clis","Progress Bars and Spinners for Python CLIs",{"path":1142,"title":1143},"\u002Fadvanced-input-parsing-user-experience\u002Finteractive-terminal-ui-with-rich\u002Fbuilding-interactive-prompts-and-menus","Building Interactive Prompts and Menus in Python CLIs",{"path":1145,"title":1146},"\u002Fadvanced-input-parsing-user-experience\u002Finteractive-terminal-ui-with-rich","Interactive Terminal UI with Rich",{"path":1148,"title":1149},"\u002Fadvanced-input-parsing-user-experience\u002Finteractive-terminal-ui-with-rich\u002Flive-dashboards-with-rich-live","Live Dashboards with Rich Live in Python CLIs",{"path":1151,"title":1152},"\u002Fadvanced-input-parsing-user-experience\u002Finteractive-terminal-ui-with-rich\u002Frendering-tables-and-json-with-rich","Rendering Tables and JSON with Rich",{"path":1154,"title":1155},"\u002Fadvanced-input-parsing-user-experience\u002Finteractive-terminal-ui-with-rich\u002Ftheming-rich-output-consistently","Theming Rich Output Consistently in Python CLIs",{"path":1157,"title":1158},"\u002Fadvanced-input-parsing-user-experience\u002Fshell-completion-for-python-clis\u002Fdynamic-completion-values-from-apis-and-files","Dynamic Completion Values from APIs and Files",{"path":1160,"title":1161},"\u002Fadvanced-input-parsing-user-experience\u002Fshell-completion-for-python-clis\u002Fenabling-tab-completion-in-click-and-typer","Enabling Tab Completion in Click and Typer",{"path":1163,"title":1164},"\u002Fadvanced-input-parsing-user-experience\u002Fshell-completion-for-python-clis","Shell Completion for Python CLIs",{"path":1166,"title":1167},"\u002Fadvanced-input-parsing-user-experience\u002Fshell-completion-for-python-clis\u002Finstalling-shell-completion-for-bash-zsh-fish","Installing Shell Completion for bash, zsh, fish",{"path":1169,"title":1170},"\u002Fadvanced-input-parsing-user-experience\u002Fshell-completion-for-python-clis\u002Ftesting-shell-completion-in-python-clis","Testing Shell Completion in Python CLIs",{"path":1172,"title":1173},"\u002Fadvanced-input-parsing-user-experience\u002Fstructured-logging-for-cli-apps\u002Fadding-trace-ids-and-context-to-cli-logs","Adding Trace IDs and Context to Python CLI Logs",{"path":1175,"title":1176},"\u002Fadvanced-input-parsing-user-experience\u002Fstructured-logging-for-cli-apps\u002Fadding-verbose-and-quiet-logging-flags","Adding Verbose and Quiet Logging Flags",{"path":1178,"title":1179},"\u002Fadvanced-input-parsing-user-experience\u002Fstructured-logging-for-cli-apps","Structured Logging for CLI Apps",{"path":1181,"title":1182},"\u002Fadvanced-input-parsing-user-experience\u002Fstructured-logging-for-cli-apps\u002Fstructured-json-logging-in-python-clis","Structured JSON Logging in Python CLIs",{"path":1184,"title":1185},"\u002Fadvanced-input-parsing-user-experience\u002Fstructured-logging-for-cli-apps\u002Fwriting-rotating-log-files-from-a-cli","Writing Rotating Log Files from a Python CLI",{"path":1187,"title":1188},"\u002Fadvanced-input-parsing-user-experience\u002Fworking-with-stdin-stdout-and-pipes\u002Fdetecting-tty-and-adapting-output","Detecting a TTY and Adapting Output",{"path":1190,"title":1191},"\u002Fadvanced-input-parsing-user-experience\u002Fworking-with-stdin-stdout-and-pipes\u002Femitting-json-output-for-scripting","Emitting JSON Output for Scripting",{"path":1193,"title":1194},"\u002Fadvanced-input-parsing-user-experience\u002Fworking-with-stdin-stdout-and-pipes\u002Fhandling-broken-pipe-and-sigpipe","Handling Broken Pipe and SIGPIPE",{"path":1196,"title":1197},"\u002Fadvanced-input-parsing-user-experience\u002Fworking-with-stdin-stdout-and-pipes","Working with stdin, stdout and Pipes",{"path":1199,"title":1200},"\u002Fadvanced-input-parsing-user-experience\u002Fworking-with-stdin-stdout-and-pipes\u002Fprocessing-large-files-and-ndjson-streams","Processing Large Files and NDJSON Streams in Python CLIs",{"path":1202,"title":1203},"\u002Fadvanced-input-parsing-user-experience\u002Fworking-with-stdin-stdout-and-pipes\u002Freading-piped-input-in-python-clis","Reading Piped Input in Python CLIs",{"path":1205,"title":1206},"\u002Fcli-runtime-systems-integration\u002Fcalling-http-apis-from-python-clis\u002Fbuilding-an-api-client-cli-with-httpx","Building an API Client CLI with httpx",{"path":1208,"title":1209},"\u002Fcli-runtime-systems-integration\u002Fcalling-http-apis-from-python-clis\u002Fdownloading-files-with-progress-in-python","Downloading Files with Progress in Python CLIs",{"path":1211,"title":1212},"\u002Fcli-runtime-systems-integration\u002Fcalling-http-apis-from-python-clis","Calling HTTP APIs from Python CLIs",{"path":1214,"title":1215},"\u002Fcli-runtime-systems-integration\u002Fcalling-http-apis-from-python-clis\u002Foauth-device-flow-login-for-clis","OAuth Device Flow Login for Python CLIs",{"path":1217,"title":1218},"\u002Fcli-runtime-systems-integration\u002Fcalling-http-apis-from-python-clis\u002Fpaginating-api-results-in-a-cli","Paginating API Results in a Python CLI",{"path":1220,"title":1221},"\u002Fcli-runtime-systems-integration\u002Fcalling-http-apis-from-python-clis\u002Fretries-and-backoff-for-cli-http-calls","Retries and Backoff for CLI HTTP Calls",{"path":1223,"title":1224},"\u002Fcli-runtime-systems-integration\u002Fconcurrency-and-async-in-python-clis\u002Fcancelling-async-tasks-on-ctrl-c","Cancelling Async Tasks on Ctrl+C in Python CLIs",{"path":1226,"title":1227},"\u002Fcli-runtime-systems-integration\u002Fconcurrency-and-async-in-python-clis","Concurrency and Async in Python CLIs",{"path":1229,"title":1230},"\u002Fcli-runtime-systems-integration\u002Fconcurrency-and-async-in-python-clis\u002Fmultiprocessing-for-cpu-bound-cli-tasks","Multiprocessing for CPU-Bound CLI Tasks",{"path":1232,"title":1233},"\u002Fcli-runtime-systems-integration\u002Fconcurrency-and-async-in-python-clis\u002Fparallelising-cli-work-with-thread-pools","Parallelising CLI Work with Thread Pools",{"path":1235,"title":1236},"\u002Fcli-runtime-systems-integration\u002Fconcurrency-and-async-in-python-clis\u002Frate-limiting-concurrent-requests-in-clis","Rate-Limiting Concurrent Requests in Python CLIs",{"path":1238,"title":1239},"\u002Fcli-runtime-systems-integration\u002Fconcurrency-and-async-in-python-clis\u002Frunning-async-code-in-typer-and-click","Running Async Code in Typer and Click",{"path":1241,"title":1242},"\u002Fcli-runtime-systems-integration\u002Ffilesystem-paths-and-atomic-writes\u002Fcross-platform-paths-with-pathlib","Cross-Platform Paths with pathlib in CLIs",{"path":1244,"title":1245},"\u002Fcli-runtime-systems-integration\u002Ffilesystem-paths-and-atomic-writes\u002Ffile-locking-for-concurrent-cli-runs","File Locking for Concurrent CLI Runs in Python",{"path":1247,"title":1248},"\u002Fcli-runtime-systems-integration\u002Ffilesystem-paths-and-atomic-writes","Filesystem Paths and Atomic Writes for CLIs",{"path":1250,"title":1251},"\u002Fcli-runtime-systems-integration\u002Ffilesystem-paths-and-atomic-writes\u002Fsafe-temporary-files-and-directories","Safe Temporary Files and Directories in CLIs",{"path":1253,"title":1254},"\u002Fcli-runtime-systems-integration\u002Ffilesystem-paths-and-atomic-writes\u002Fstoring-app-data-with-platformdirs","Storing CLI App Data with platformdirs",{"path":1256,"title":1257},"\u002Fcli-runtime-systems-integration\u002Ffilesystem-paths-and-atomic-writes\u002Fwriting-files-atomically-in-python-clis","Writing Files Atomically in Python CLIs",{"path":1259,"title":1260},"\u002Fcli-runtime-systems-integration","CLI Runtime & Systems Integration for Python",{"path":1262,"title":1263},"\u002Fcli-runtime-systems-integration\u002Flong-running-and-watch-mode-clis\u002Fbuilding-a-watch-mode-with-watchfiles","Building a Watch Mode with watchfiles in Python",{"path":1265,"title":1266},"\u002Fcli-runtime-systems-integration\u002Flong-running-and-watch-mode-clis\u002Fhandling-sigterm-and-graceful-shutdown","Handling SIGTERM and Graceful Shutdown in CLIs",{"path":1268,"title":1269},"\u002Fcli-runtime-systems-integration\u002Flong-running-and-watch-mode-clis\u002Fhealth-checks-and-heartbeats-for-long-running-clis","Health Checks and Heartbeats for Long-Running CLIs",{"path":1271,"title":1272},"\u002Fcli-runtime-systems-integration\u002Flong-running-and-watch-mode-clis","Long-Running and Watch-Mode Python CLIs",{"path":1274,"title":1275},"\u002Fcli-runtime-systems-integration\u002Flong-running-and-watch-mode-clis\u002Frunning-a-cli-on-a-schedule-with-cron-and-systemd","Running a Python CLI on a Schedule with cron and systemd",{"path":1277,"title":1278},"\u002Fcli-runtime-systems-integration\u002Frunning-subprocesses-from-python-clis\u002Favoiding-shell-injection-in-python-clis","Avoiding Shell Injection in Python CLIs",{"path":1280,"title":1281},"\u002Fcli-runtime-systems-integration\u002Frunning-subprocesses-from-python-clis\u002Fcalling-external-commands-safely-with-subprocess","Calling External Commands Safely with subprocess",{"path":1283,"title":1284},"\u002Fcli-runtime-systems-integration\u002Frunning-subprocesses-from-python-clis\u002Fhandling-subprocess-timeouts-and-exit-codes","Handling Subprocess Timeouts and Exit Codes",{"path":1286,"title":1287},"\u002Fcli-runtime-systems-integration\u002Frunning-subprocesses-from-python-clis","Running Subprocesses from Python CLIs",{"path":1289,"title":1290},"\u002Fcli-runtime-systems-integration\u002Frunning-subprocesses-from-python-clis\u002Fstreaming-subprocess-output-in-real-time","Streaming Subprocess Output in Real Time",{"path":1292,"title":1293},"\u002Fcli-runtime-systems-integration\u002Frunning-subprocesses-from-python-clis\u002Fwrapping-git-and-other-tools-from-a-python-cli","Wrapping git and Other Tools from a Python CLI",{"path":1295,"title":1296},"\u002Fcli-runtime-systems-integration\u002Fsecrets-and-credentials-in-python-clis","Secrets and Credentials in Python CLIs",{"path":1298,"title":1299},"\u002Fcli-runtime-systems-integration\u002Fsecrets-and-credentials-in-python-clis\u002Fprompting-for-passwords-securely","Prompting for Passwords Securely in Python CLIs",{"path":1301,"title":1302},"\u002Fcli-runtime-systems-integration\u002Fsecrets-and-credentials-in-python-clis\u002Freading-secrets-from-env-and-files","Reading Secrets from Env Vars and Files in CLIs",{"path":1304,"title":1305},"\u002Fcli-runtime-systems-integration\u002Fsecrets-and-credentials-in-python-clis\u002Fredacting-secrets-from-cli-output-and-logs","Redacting Secrets from CLI Output and Logs",{"path":1307,"title":1308},"\u002Fcli-runtime-systems-integration\u002Fsecrets-and-credentials-in-python-clis\u002Fstoring-tokens-with-keyring","Storing CLI Tokens Securely with keyring",{"path":1310,"title":1311},"\u002Fcli-runtime-systems-integration\u002Fsecrets-and-credentials-in-python-clis\u002Fsupporting-multiple-profiles-and-accounts","Supporting Multiple Profiles and Accounts in CLIs",{"path":1313,"title":1314},"\u002F","Python CLI Toolcraft",{"path":1316,"title":1317},"\u002Fmodern-python-cli-frameworks-architecture\u002Fcli-startup-performance-and-lazy-loading\u002Fcaching-expensive-work-between-cli-runs","Caching Expensive Work Between Python CLI Runs",{"path":1319,"title":1320},"\u002Fmodern-python-cli-frameworks-architecture\u002Fcli-startup-performance-and-lazy-loading","CLI Startup Performance and Lazy Loading",{"path":1322,"title":1323},"\u002Fmodern-python-cli-frameworks-architecture\u002Fcli-startup-performance-and-lazy-loading\u002Flazy-loading-subcommands-for-faster-startup","Lazy Loading Subcommands for Faster Startup",{"path":1325,"title":1326},"\u002Fmodern-python-cli-frameworks-architecture\u002Fcli-startup-performance-and-lazy-loading\u002Fprofiling-python-cli-startup-time","Profiling Python CLI Startup Time",{"path":1328,"title":1329},"\u002Fmodern-python-cli-frameworks-architecture\u002Fcli-startup-performance-and-lazy-loading\u002Freducing-cli-dependency-weight","Reducing CLI Dependency Weight",{"path":1331,"title":1332},"\u002Fmodern-python-cli-frameworks-architecture\u002Fcommand-line-parsing-with-argparse\u002Fargparse-subparsers-for-subcommands","argparse Subparsers for Subcommands",{"path":1334,"title":1335},"\u002Fmodern-python-cli-frameworks-architecture\u002Fcommand-line-parsing-with-argparse\u002Fargparse-vs-click-vs-typer-comparison","argparse vs Click vs Typer Compared",{"path":1337,"title":1338},"\u002Fmodern-python-cli-frameworks-architecture\u002Fcommand-line-parsing-with-argparse","Command-Line Parsing with argparse",{"path":1340,"title":1341},"\u002Fmodern-python-cli-frameworks-architecture\u002Fcommand-line-parsing-with-argparse\u002Fmigrating-from-argparse-to-typer","Migrating from argparse to Typer",{"path":1343,"title":1344},"\u002Fmodern-python-cli-frameworks-architecture\u002Fcommand-line-parsing-with-argparse\u002Fmutually-exclusive-options-in-argparse","Mutually Exclusive Options in argparse",{"path":1346,"title":1347},"\u002Fmodern-python-cli-frameworks-architecture\u002Fcommand-line-parsing-with-argparse\u002Fwriting-custom-argparse-actions","Writing Custom argparse Actions in Python",{"path":1349,"title":1350},"\u002Fmodern-python-cli-frameworks-architecture\u002Fdesigning-cli-interfaces-and-conventions\u002Fadding-dry-run-and-confirmation-to-destructive-commands","Adding Dry-Run and Confirmation to Destructive Commands",{"path":1352,"title":1353},"\u002Fmodern-python-cli-frameworks-architecture\u002Fdesigning-cli-interfaces-and-conventions\u002Ffollowing-posix-and-gnu-argument-conventions","Following POSIX and GNU Argument Conventions in Python",{"path":1355,"title":1356},"\u002Fmodern-python-cli-frameworks-architecture\u002Fdesigning-cli-interfaces-and-conventions\u002Fglobal-options-vs-per-command-options","Global Options vs Per-Command Options in Python CLIs",{"path":1358,"title":1359},"\u002Fmodern-python-cli-frameworks-architecture\u002Fdesigning-cli-interfaces-and-conventions","Designing CLI Interfaces and Conventions in Python",{"path":1361,"title":1362},"\u002Fmodern-python-cli-frameworks-architecture\u002Fdesigning-cli-interfaces-and-conventions\u002Fnaming-commands-and-flags-consistently","Naming Commands and Flags Consistently in Python CLIs",{"path":1364,"title":1365},"\u002Fmodern-python-cli-frameworks-architecture","Python CLI Frameworks and Architecture",{"path":1367,"title":1368},"\u002Fmodern-python-cli-frameworks-architecture\u002Fplugin-architectures-for-extensible-clis\u002Fdiscovering-plugins-with-entry-points","Discovering Plugins with Entry Points in Python CLIs",{"path":1370,"title":1371},"\u002Fmodern-python-cli-frameworks-architecture\u002Fplugin-architectures-for-extensible-clis\u002Fhook-based-plugins-with-pluggy","Hook-Based Plugins for Python CLIs with pluggy",{"path":1373,"title":1374},"\u002Fmodern-python-cli-frameworks-architecture\u002Fplugin-architectures-for-extensible-clis","Plugin Architectures for Extensible CLIs",{"path":1376,"title":1377},"\u002Fmodern-python-cli-frameworks-architecture\u002Fplugin-architectures-for-extensible-clis\u002Fversioning-a-plugin-api","Versioning a Plugin API for a Python CLI",{"path":1379,"title":1380},"\u002Fmodern-python-cli-frameworks-architecture\u002Fplugin-architectures-for-extensible-clis\u002Fwriting-a-plugin-for-an-existing-cli","Writing a Plugin for an Existing CLI",{"path":1382,"title":1383},"\u002Fmodern-python-cli-frameworks-architecture\u002Fstructuring-multi-command-python-clis\u002Fbest-practices-for-python-cli-entry-points","Best practices for Python CLI entry points",{"path":1385,"title":1386},"\u002Fmodern-python-cli-frameworks-architecture\u002Fstructuring-multi-command-python-clis\u002Fdependency-injection-patterns-for-cli-commands","Dependency Injection Patterns for CLI Commands",{"path":1388,"title":1389},"\u002Fmodern-python-cli-frameworks-architecture\u002Fstructuring-multi-command-python-clis\u002Fhow-to-structure-a-large-python-cli-project","Structuring a Large Python CLI Project",{"path":1391,"title":1392},"\u002Fmodern-python-cli-frameworks-architecture\u002Fstructuring-multi-command-python-clis","Structuring Multi-Command Python CLIs",{"path":1394,"title":1395},"\u002Fmodern-python-cli-frameworks-architecture\u002Fstructuring-multi-command-python-clis\u002Fsharing-common-options-across-commands","Sharing Common Options Across Python CLI Commands",{"path":1397,"title":1398},"\u002Fmodern-python-cli-frameworks-architecture\u002Fstructuring-multi-command-python-clis\u002Fsharing-state-with-click-context-objects","Sharing State with Click Context Objects",{"path":1400,"title":1401},"\u002Fmodern-python-cli-frameworks-architecture\u002Ftesting-python-cli-applications\u002Fend-to-end-testing-an-installed-cli","End-to-End Testing an Installed Python CLI",{"path":1403,"title":1404},"\u002Fmodern-python-cli-frameworks-architecture\u002Ftesting-python-cli-applications","Testing Python CLI Applications",{"path":1406,"title":1407},"\u002Fmodern-python-cli-frameworks-architecture\u002Ftesting-python-cli-applications\u002Fmeasuring-cli-test-coverage","Measuring CLI Test Coverage",{"path":1409,"title":1410},"\u002Fmodern-python-cli-frameworks-architecture\u002Ftesting-python-cli-applications\u002Fmocking-filesystem-and-network-in-cli-tests","Mocking the Filesystem and Network in CLI Tests",{"path":1412,"title":1413},"\u002Fmodern-python-cli-frameworks-architecture\u002Ftesting-python-cli-applications\u002Fproperty-based-testing-cli-arguments-with-hypothesis","Property-Based Testing CLI Arguments with Hypothesis",{"path":1415,"title":1416},"\u002Fmodern-python-cli-frameworks-architecture\u002Ftesting-python-cli-applications\u002Fsnapshot-testing-cli-output","Snapshot Testing CLI Output",{"path":1418,"title":1419},"\u002Fmodern-python-cli-frameworks-architecture\u002Ftesting-python-cli-applications\u002Ftesting-click-commands-with-clirunner","Testing Click Commands with CliRunner",{"path":1421,"title":1422},"\u002Fmodern-python-cli-frameworks-architecture\u002Ftesting-python-cli-applications\u002Ftesting-interactive-prompts-and-stdin","Testing Interactive Prompts and stdin",{"path":1424,"title":1425},"\u002Fmodern-python-cli-frameworks-architecture\u002Ftyper-vs-click-when-to-use-each\u002Fbuilding-a-cli-with-subcommands-in-click","Building a CLI with subcommands in Click",{"path":1427,"title":1428},"\u002Fmodern-python-cli-frameworks-architecture\u002Ftyper-vs-click-when-to-use-each\u002Fbuilding-dynamic-commands-in-click","Building Dynamic Commands in Click",{"path":1430,"title":1431},"\u002Fmodern-python-cli-frameworks-architecture\u002Ftyper-vs-click-when-to-use-each\u002Fconverting-a-click-app-to-typer","Converting a Click App to Typer",{"path":1433,"title":1434},"\u002Fmodern-python-cli-frameworks-architecture\u002Ftyper-vs-click-when-to-use-each","Typer vs Click: When to Use Each",{"path":1436,"title":1437},"\u002Fmodern-python-cli-frameworks-architecture\u002Ftyper-vs-click-when-to-use-each\u002Ftyper-callback-functions-explained","Typer callback functions explained",{"path":1439,"title":1440},"\u002Fmodern-python-cli-frameworks-architecture\u002Ftyper-vs-click-when-to-use-each\u002Fusing-annotated-options-in-typer","Using Annotated Options in Typer",{"path":1442,"title":1443},"\u002Fproject-setup-dependency-management\u002Fci-cd-pipelines-for-python-clis\u002Fautomating-releases-from-git-tags","Automating Python CLI Releases from Git Tags",{"path":1445,"title":1446},"\u002Fproject-setup-dependency-management\u002Fci-cd-pipelines-for-python-clis\u002Fcaching-uv-dependencies-in-ci","Caching uv Dependencies in CI for Python CLIs",{"path":1448,"title":1449},"\u002Fproject-setup-dependency-management\u002Fci-cd-pipelines-for-python-clis","CI\u002FCD Pipelines for Python CLIs",{"path":1029,"title":5},{"path":1452,"title":1453},"\u002Fproject-setup-dependency-management\u002Fci-cd-pipelines-for-python-clis\u002Fsmoke-testing-the-built-wheel-in-ci","Smoke-Testing the Built Wheel of a Python CLI in CI",{"path":1455,"title":1456},"\u002Fproject-setup-dependency-management\u002Fci-cd-pipelines-for-python-clis\u002Ftesting-a-cli-across-python-versions-with-github-actions","Testing a CLI Across Python Versions in GitHub Actions",{"path":1458,"title":1459},"\u002Fproject-setup-dependency-management\u002Fcli-project-scaffolding-with-cookiecutter\u002Fbuilding-a-cookiecutter-template-for-typer-clis","Building a Cookiecutter Template for Typer CLIs",{"path":1461,"title":1462},"\u002Fproject-setup-dependency-management\u002Fcli-project-scaffolding-with-cookiecutter\u002Fcopier-vs-cookiecutter-for-cli-templates","Copier vs Cookiecutter for CLI Templates",{"path":1464,"title":1465},"\u002Fproject-setup-dependency-management\u002Fcli-project-scaffolding-with-cookiecutter","CLI Project Scaffolding with Cookiecutter",{"path":1467,"title":1468},"\u002Fproject-setup-dependency-management\u002Fcli-project-scaffolding-with-cookiecutter\u002Fpost-generation-hooks-in-cli-templates","Post-Generation Hooks in Python CLI Templates",{"path":1470,"title":1471},"\u002Fproject-setup-dependency-management\u002Fdistributing-clis-as-standalone-binaries\u002Fbuilding-cross-platform-release-binaries-in-ci","Building Cross-Platform Release Binaries in CI",{"path":1473,"title":1474},"\u002Fproject-setup-dependency-management\u002Fdistributing-clis-as-standalone-binaries\u002Fbundling-a-python-cli-with-pyinstaller","Bundling a Python CLI with PyInstaller",{"path":1476,"title":1477},"\u002Fproject-setup-dependency-management\u002Fdistributing-clis-as-standalone-binaries\u002Fhomebrew-and-scoop-packaging-for-python-clis","Homebrew and Scoop Packaging for Python CLIs",{"path":1479,"title":1480},"\u002Fproject-setup-dependency-management\u002Fdistributing-clis-as-standalone-binaries","Distributing CLIs as Standalone Binaries",{"path":1482,"title":1483},"\u002Fproject-setup-dependency-management\u002Fdistributing-clis-as-standalone-binaries\u002Fnuitka-vs-pyinstaller-for-python-clis","Nuitka vs PyInstaller for Python CLI Binaries",{"path":1485,"title":1486},"\u002Fproject-setup-dependency-management\u002Fdistributing-clis-as-standalone-binaries\u002Fshipping-a-cli-as-a-zipapp-with-shiv","Shipping a CLI as a Zipapp with shiv",{"path":1488,"title":1489},"\u002Fproject-setup-dependency-management","Project Setup & Dependency Management",{"path":1491,"title":1492},"\u002Fproject-setup-dependency-management\u002Flinting-and-type-checking-cli-code\u002Fconfiguring-ruff-for-a-cli-project","Configuring Ruff for a Python CLI Project",{"path":1494,"title":1495},"\u002Fproject-setup-dependency-management\u002Flinting-and-type-checking-cli-code\u002Fenforcing-import-boundaries-in-a-cli-codebase","Enforcing Import Boundaries in a Python CLI Codebase",{"path":1497,"title":1498},"\u002Fproject-setup-dependency-management\u002Flinting-and-type-checking-cli-code","Linting and Type-Checking Python CLI Code",{"path":1500,"title":1501},"\u002Fproject-setup-dependency-management\u002Flinting-and-type-checking-cli-code\u002Ftype-checking-click-and-typer-code-with-mypy","Type-Checking Click and Typer Code with mypy",{"path":1503,"title":1504},"\u002Fproject-setup-dependency-management\u002Fmanaging-cli-versioning-changelogs\u002Fautomating-changelogs-with-conventional-commits","Automating Changelogs with Conventional Commits",{"path":1506,"title":1507},"\u002Fproject-setup-dependency-management\u002Fmanaging-cli-versioning-changelogs\u002Fderiving-versions-from-git-tags-with-hatch-vcs","Deriving CLI Versions from Git Tags with hatch-vcs",{"path":1509,"title":1510},"\u002Fproject-setup-dependency-management\u002Fmanaging-cli-versioning-changelogs\u002Fexposing-version-info-and-build-metadata","Exposing Version Info and Build Metadata",{"path":1512,"title":1513},"\u002Fproject-setup-dependency-management\u002Fmanaging-cli-versioning-changelogs","Managing CLI Versioning & Changelogs",{"path":1515,"title":1516},"\u002Fproject-setup-dependency-management\u002Fmanaging-cli-versioning-changelogs\u002Fsemantic-versioning-policy-for-cli-tools","A Semantic Versioning Policy for CLI Tools",{"path":1518,"title":1519},"\u002Fproject-setup-dependency-management\u002Fpackaging-python-clis-for-distribution\u002Fbuilding-wheels-and-sdists-for-python-clis","Building Wheels and sdists for Python CLIs",{"path":1521,"title":1522},"\u002Fproject-setup-dependency-management\u002Fpackaging-python-clis-for-distribution\u002Fbundling-data-files-with-importlib-resources","Bundling Data Files with importlib.resources in CLIs",{"path":1524,"title":1525},"\u002Fproject-setup-dependency-management\u002Fpackaging-python-clis-for-distribution","Packaging Python CLIs for Distribution",{"path":1527,"title":1528},"\u002Fproject-setup-dependency-management\u002Fpackaging-python-clis-for-distribution\u002Finstalling-and-distributing-clis-with-pipx","Installing and Distributing CLIs with pipx",{"path":1530,"title":994},"\u002Fproject-setup-dependency-management\u002Fpackaging-python-clis-for-distribution\u002Fpublishing-a-python-cli-to-pypi",{"path":1532,"title":1533},"\u002Fproject-setup-dependency-management\u002Fpackaging-python-clis-for-distribution\u002Fwriting-pyproject-toml-metadata-for-a-cli","Writing pyproject.toml Metadata for a Python CLI",{"path":1535,"title":1536},"\u002Fproject-setup-dependency-management\u002Fpoetry-workflows-for-cli-development","Poetry Workflows for CLI Development",{"path":1538,"title":1539},"\u002Fproject-setup-dependency-management\u002Fpoetry-workflows-for-cli-development\u002Fmigrating-a-cli-from-poetry-to-uv","Migrating a Python CLI from Poetry to uv",{"path":1541,"title":1542},"\u002Fproject-setup-dependency-management\u002Fpoetry-workflows-for-cli-development\u002Fpoetry-dependency-groups-for-cli-tooling","Poetry Dependency Groups for CLI Tooling",{"path":1544,"title":1545},"\u002Fproject-setup-dependency-management\u002Fpoetry-workflows-for-cli-development\u002Fpoetry-entry-points-and-scripts-for-clis","Poetry Entry Points and Scripts for CLIs",{"path":1547,"title":1548},"\u002Fproject-setup-dependency-management\u002Fpre-commit-hooks-for-cli-projects","Pre-commit Hooks for CLI Projects",{"path":1550,"title":1551},"\u002Fproject-setup-dependency-management\u002Fpre-commit-hooks-for-cli-projects\u002Fsetting-up-pre-commit-for-python-cli-repos","Setting up pre-commit for Python CLI repos",{"path":1553,"title":1554},"\u002Fproject-setup-dependency-management\u002Fpre-commit-hooks-for-cli-projects\u002Fshipping-your-cli-as-a-pre-commit-hook","Shipping Your Python CLI as a pre-commit Hook",{"path":1556,"title":1557},"\u002Fproject-setup-dependency-management\u002Fpre-commit-hooks-for-cli-projects\u002Fwriting-local-pre-commit-hooks-in-python","Writing Local pre-commit Hooks in Python",{"path":1559,"title":1560},"\u002Fproject-setup-dependency-management\u002Fuv-for-python-cli-dependency-management","uv for Python CLI Dependency Management",{"path":1562,"title":1563},"\u002Fproject-setup-dependency-management\u002Fuv-for-python-cli-dependency-management\u002Frunning-one-off-cli-scripts-with-uv-run","Running One-Off CLI Scripts with uv run and PEP 723",{"path":1565,"title":1566},"\u002Fproject-setup-dependency-management\u002Fuv-for-python-cli-dependency-management\u002Fuv-init-vs-poetry-init-for-cli-tools","uv init vs poetry init for CLI tools",{"path":1568,"title":1569},"\u002Fproject-setup-dependency-management\u002Fuv-for-python-cli-dependency-management\u002Fuv-tool-install-vs-pipx-for-clis","uv tool install vs pipx for CLIs",{"path":1571,"title":1572},"\u002Fproject-setup-dependency-management\u002Fuv-for-python-cli-dependency-management\u002Fuv-workspaces-for-multi-package-clis","uv Workspaces for Multi-Package Python CLIs",{"path":1574,"title":1575},"\u002Fproject-setup-dependency-management\u002Fvirtual-environments-isolation-best-practices","Python CLI Env Isolation Best Practices",{"path":1577,"title":1578},"\u002Fproject-setup-dependency-management\u002Fvirtual-environments-isolation-best-practices\u002Fmanaging-virtual-environments-for-cross-platform-clis","Managing Python CLI Virtual Environments",{"path":1580,"title":1581},"\u002Fproject-setup-dependency-management\u002Fvirtual-environments-isolation-best-practices\u002Fpinning-the-python-version-for-a-cli","Pinning the Python Version for a CLI",{"path":1583,"title":1584},"\u002Fproject-setup-dependency-management\u002Fvirtual-environments-isolation-best-practices\u002Fsupporting-multiple-python-versions-with-nox","Supporting Multiple Python Versions with nox",1789736907470]