How do I install the Python Release skill?

Run npx skillmds@latest add bitwise-media-group/python-release in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Python Release safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Python Release?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Python Release free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under MIT.

Who published Python Release?

bitwise-media-group (@bitwise-media-group) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Python Release by bitwise-media-group

Name: Python Release
Author: bitwise-media-group

Python Release

Release engineering for Python projects on uv — static versioning in pyproject.toml exposed via importlib.metadata, building the sdist and wheel with uv build, publishing to PyPI with uv publish via Trusted Publishing (OIDC, no token), tag-triggered GitHub Actions releases, CI running ruff/ty (or pyright)/pytest with SHA-pinned actions, and Renovate coverage for uv and Actions. Use when releasing or publishing a Python package to PyPI, running uv build to make a wheel and sdist, running uv publish, configuring Trusted Publishing or a tag-triggered release workflow, writing a GitHub Actions CI workflow that runs ruff format/ruff check/ty (or pyright)/pytest for a uv project, versioning a package, or adding Renovate coverage for uv and GitHub Actions to a Python repo.

bitwise-media-group 71a88a6 5 files · 10.2 KB Updated Sep 17, 2026

File contents

Python release engineering

Tag-driven releases: pushing a vX.Y.Z tag builds the sdist and wheel with uv build and publishes them to PyPI with uv publish via Trusted Publishing — no stored token. CI gates every push; Renovate keeps dependencies and the action pins fresh. This layers on the layout and Makefile from the python-project skill. For the publishing and Renovate rationale and the full ecosystem matrix, see reference.md.

For a bitwise-media-group repo, prefer the org's centralized, SHA-pinned CI/security/release/merge callers over the bespoke ci.yaml/release.yaml below — see the actions-reusable-workflows skill. The templates here are for a Python repo outside that org infrastructure.

1. Version statically, read it from metadata

The uv_build backend takes the version from [project] version. Bump that line, commit, then tag vX.Y.Z to match — both the tag and the artifact come from the same source, so they cannot drift. Expose it at runtime from the installed metadata rather than re-declaring it:

from importlib.metadata import version

__version__ = version("myapp")

(To derive the version from git tags instead, see the hatch-vcs note in reference.md.)

2. Build with uv

uv build          # writes the sdist + wheel to dist/

make build wraps this (see python-project); validate a build locally before tagging.

3. CI workflow

Copy templates/ci.yaml to .github/workflows/ci.yaml. Every push and pull request runs ruff format --check, ruff check, ty check, and pytest — a pyright project swaps uv run pyright for the ty check step (see python-typing). Conventions:

astral-sh/setup-uv installs uv; uv sync --locked provisions the interpreter (from .python-version) and the exact locked dependencies, failing if uv.lock is stale.
Every action is pinned to a full commit SHA with the tag in a trailing comment — a moved tag can never change what runs. Renovate keeps the pins fresh.
permissions: contents: read — the default token does nothing else.

4. Release workflow

Copy templates/release.yaml to .github/workflows/release.yaml. It triggers on v* tags, builds, and runs uv publish --trusted-publishing always. Trusted Publishing needs permissions: id-token: write and a one-time publisher config on PyPI (repository, workflow filename, and the environment: the job pins) — no API token in secrets. Cutting a release is exactly: bump [project] version, tag the matching vX.Y.Z, push.

5. Renovate

Copy templates/renovate.json5 to .github/renovate.json5: a 7-day cooldown before any update is proposed, minor + patch bumps grouped into one PR per manager (majors arrive alone). The pep621 rule covers pyproject.toml + uv.lock (runtime and dev-group dependencies); the github-actions rule keeps the workflow SHA pins fresh. For the rationale and the full ecosystem matrix (docker, docker-compose, npm, …), see reference.md.

---name: python-releasedescription: Release engineering for Python projects on uv — static versioning in pyproject.toml exposed via importlib.metadata, building the sdist and wheel with uv build, publishing to PyPI with uv publish via Trusted Publishing (OIDC, no token), tag-triggered GitHub Actions releases, CI running ruff/ty (or pyright)/pytest with SHA-pinned actions, and Renovate coverage for uv and Actions. Use when releasing or publishing a Python package to PyPI, running uv build to make a wheel and sdist, running uv publish, configuring Trusted Publishing or a tag-triggered release workflow, writing a GitHub Actions CI workflow that runs ruff format/ruff check/ty (or pyright)/pytest for a uv project, versioning a package, or adding Renovate coverage for uv and GitHub Actions to a Python repo.license: MIT---# Python release engineeringTag-driven releases: pushing a `vX.Y.Z` tag builds the sdist and wheel with `uv build` andpublishes them to PyPI with `uv publish` via Trusted Publishing — no stored token. CI gates everypush; Renovate keeps dependencies and the action pins fresh. This layers on the layout andMakefile from the `python-project` skill. For the publishing and Renovate rationale and the fullecosystem matrix, see [reference.md](reference.md).For a `bitwise-media-group` repo, prefer the org's centralized, SHA-pinned CI/security/release/mergecallers over the bespoke `ci.yaml`/`release.yaml` below — see the `actions-reusable-workflows`skill. The templates here are for a Python repo outside that org infrastructure.## 1. Version statically, read it from metadataThe `uv_build` backend takes the version from `[project] version`. Bump that line, commit, then tag`vX.Y.Z` to match — both the tag and the artifact come from the same source, so they cannot drift.Expose it at runtime from the installed metadata rather than re-declaring it:```pythonfrom importlib.metadata import version__version__ = version("myapp")```(To derive the version from git tags instead, see the `hatch-vcs` note in [reference.md](reference.md).)## 2. Build with uv```shuv build # writes the sdist + wheel to dist/````make build` wraps this (see `python-project`); validate a build locally before tagging.## 3. CI workflowCopy [templates/ci.yaml](templates/ci.yaml) to `.github/workflows/ci.yaml`. Every push and pullrequest runs `ruff format --check`, `ruff check`, `ty check`, and `pytest` — a pyright projectswaps `uv run pyright` for the `ty check` step (see `python-typing`). Conventions:- `astral-sh/setup-uv` installs uv; `uv sync --locked` provisions the interpreter (from `.python-version`) and the exact locked dependencies, failing if `uv.lock` is stale.- Every action is pinned to a full commit SHA with the tag in a trailing comment — a moved tag can never change what runs. Renovate keeps the pins fresh.- `permissions: contents: read` — the default token does nothing else.## 4. Release workflowCopy [templates/release.yaml](templates/release.yaml) to `.github/workflows/release.yaml`. Ittriggers on `v*` tags, builds, and runs `uv publish --trusted-publishing always`. TrustedPublishing needs `permissions: id-token: write` and a one-time publisher config on PyPI (repository,workflow filename, and the `environment:` the job pins) — no API token in secrets. Cutting a releaseis exactly: bump `[project] version`, tag the matching `vX.Y.Z`, push.## 5. RenovateCopy [templates/renovate.json5](templates/renovate.json5) to `.github/renovate.json5`: a 7-daycooldown before any update is proposed, minor + patch bumps grouped into one PR per manager (majorsarrive alone). The `pep621` rule covers `pyproject.toml` + `uv.lock` (runtime and dev-groupdependencies); the `github-actions` rule keeps the workflow SHA pins fresh. For the rationale andthe full ecosystem matrix (`docker`, `docker-compose`, `npm`, …), see [reference.md](reference.md).

Frequently asked questions