Secure Python Packaging & Release Using Continuous Deployment
summary
Shows a reproducible Python release pipeline that builds wheels with hatchling, computes and compares SHA256 sums, and uploads to test.pypi via Twine using a two-job build/upload GitHub Actions workflow. Jobs pass artifacts via an artifact action, release tags trigger runs, and an environment with required reviewers and branch/tag restrictions protects PyPI tokens. Demonstrates signing artifacts with Sigstore, committing signatures to the repo, and approving the short upload job so the CI-built artifact matches the signed source before publish.
AI-written summary · about
chapters (16)
- 0:00Start
- 15:18Create a Virtual Environment
- 18:47Install Twine
- 22:51Create a New File inside Github Workflows
- 35:17Install Our Build Dependencies
- 36:15Build Reproducibility
- 44:38Leaking Secrets
- 47:14Required Reviewers
- 49:08Deployment Branch Rule
- 49:38Add a Secret
- 50:20Add Api Token
- 59:55Final Commits
- 1:03:59Future Improvements
- 1:06:23Demo
- 1:09:07Release Script
- 1:15:43Questions
related talks
31mA reliable developmentrelease workflow for open source Python libraries
28mBuilding reproducible Python applications for secured environments
39mA Pythonic Approach to Continuous Delivery
36mPython Packaging from Init to Deploy
23mGitHub Actions & Python
24mShipping your first Python package and automating future publishing
28mModern Python packaging without pain
47mPublishing & Maintaining Opensource Python Packages in PyPI