PyPI publish

PyPI publish

Abstract

The Python distribution name on PyPI is hoox-pyne. After install, the import path stays pynescript; preferred CLIs are pyne / pyne-lsp (aliases: pynescript / pynescript-lsp).

PyPI ownership is the personal account jango-blockchained (not a PyPI organization — org approval is not required). Automation still runs on GitHub hoox-sh/pyne via .github/workflows/publish.yml.

Auth modes (first match wins):

1. API token — repo secret PYPI_API_TOKEN from the personal PyPI account (recommended while no PyPI org is needed).
2. Trusted Publishing (OIDC) — pending publisher created while logged in as jango-blockchained, with GitHub Owner = hoox-sh (where Actions run).

Why not pynescript or pyne on PyPI? pynescript is owned by elbakramer/pynescript; plain pyne/PyNE is an unrelated 0.1.0 process-networking library. We ship as hoox-pyne; the import package stays pynescript.

Install surface

pip install hoox-pyne
pip install "hoox-pyne[lsp]"
pip install "hoox-pyne[pro]"

python -c "import pynescript; print(pynescript.__version__)"
pyne --help
pyne-lsp   # stdio language server (alias: pynescript-lsp)

One-time setup (personal PyPI account)

A. Recommended — API token (no org, no OIDC)

1. Sign in at pypi.org as jango-blockchained (2FA required).
2. Account settings → API tokens → Add API token.
   • Name: e.g. hoox-sh-pyne-gha
   • Scope: Entire account for the first upload of hoox-pyne; after the project exists you can rotate to a project-scoped token.
3. Copy the token (pypi-…) once.
4. On GitHub:

# Environment (optional reviewers / wait timer)
gh api -X PUT repos/hoox-sh/pyne/environments/pypi

# Never commit the token — Actions secret only
gh secret set PYPI_API_TOKEN -R hoox-sh/pyne
# paste pypi-... token

5. First successful tag (or workflow_dispatch with dry_run=false) creates hoox-pyne under your personal account.

B. Optional — Trusted Publishing (OIDC)

Use this when you prefer no long-lived token. Log into PyPI as jango-blockchained (personal user), then:

Leave PYPI_API_TOKEN unset so the publish job uses OIDC.

Do not put jango-blockchained in the GitHub Owner field unless the workflow actually runs under github.com/jango-blockchained/pyne. OIDC is bound to the repo that executes the job (hoox-sh/pyne).

GitHub environment

Repo Settings → Environments → pypi on hoox-sh/pyne. Optional: required reviewers on production uploads.

Cut a release

# 1. Version + changelog on main
#    src/pynescript/__about__.py  →  0.3.14
#    vscode-extension/package.json version (same pin when shipping VSIX)
#    CHANGELOG.md

# 2. Local smoke (no upload)
pip install build twine
rm -rf dist/
python -m build
twine check dist/*
# expect: hoox_pyne-0.3.14-*.whl  and  hoox_pyne-0.3.14.tar.gz

# 3. Push main, then tag
git tag -a v0.3.14 -m "v0.3.14"
git push origin v0.3.14

# 4. Watch Actions → Publish

If a tag already exists and the wheel was never uploaded, re-run:

Actions → Publish → Run workflow → dry_run=false (builds from that workflow’s default branch / checked-out tag context as configured), or retag a new patch version.

Dry-run without upload: Actions → Publish → Run workflow → dry_run=true.

Workflow map

Failure modes

See also

• Release — CLI/LSP binaries + VSIX
• Publish checklist
• CI
• Root CONTRIBUTING.md