[PR #164] [MERGED] [build] Finish the PEP 621 move: hatchling backend, clean metadata, guarded sdist #166

New issue

Closed

opened 2026-10-13 19:48:13 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-13 19:48:13 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Glitchy-Sheep/boosty-downloader/pull/164
Author: @Glitchy-Sheep
Created: 8/19/2026
Status: ✅ Merged
Merged: 8/19/2026
Merged by: @Glitchy-Sheep

Base: main ← Head: chore/pep621-build

📝 Commits (1)

ece9707 chore: Finish the PEP 621 move with hatchling and clean metadata

📊 Changes

2 files changed (+26 additions, -8 deletions)

View changed files

📝 .github/workflows/ci.yaml (+7 -0)
📝 pyproject.toml (+19 -8)

📄 Description

[build] Finish the PEP 621 move: hatchling backend, clean metadata, guarded sdist

Summary

Third cleanup PR (audit этап 2). The build backend moves from poetry-core to hatchling, the metadata gets its missing fields, and the sdist becomes an explicit allowlist - which turned out to matter much more than expected.

The important catch

hatchling's sdist default packs every non-vcs-ignored file into the archive - including untracked local notes. A trial build pulled 15 private working files (analysis notes, PR drafts) and a megabyte of README assets into the tarball that task release would have uploaded to PyPI. The sdist is now only-include = ["boosty_downloader"]: 2.1 MB -> 63 KB, zero private files (verified by listing the archive).

Changes

[build-system]: hatchling replaces poetry-core - the last [tool.poetry] key duplicated what any backend infers from the project name
license = "MIT" + license-files, [project.urls] (Homepage / Issues / Changelog) - the wheel finally carries the license and links
pyyaml dependency spelled in the same style as the other fourteen
CI build job now verifies all 7 Jinja templates land in the wheel: a wheel without them builds silently and crashes at render time

Verification

task build: wheel 101 KB (7/7 templates inside), sdist 63 KB (package + README/LICENSE/pyproject only)
Clean-venv install of the wheel: boosty-downloader --version -> 3.5.0; a render through the installed package proves templates load from the wheel
The release tooling's version regexes are safe: the hatch config adds no second version = line
task check + task test green: 174 passed + 1 xfail
Live task test:api is currently blocked by the known network condition (curl reaches the API in 0.16s, aiohttp TLS gets cut - the anti-bot pattern, heals with a pause); the change touches no runtime code
No changelog entry: packaging only (ci/skip-changelog)

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Glitchy-Sheep/boosty-downloader/pull/164 **Author:** [@Glitchy-Sheep](https://github.com/Glitchy-Sheep) **Created:** 8/19/2026 **Status:** ✅ Merged **Merged:** 8/19/2026 **Merged by:** [@Glitchy-Sheep](https://github.com/Glitchy-Sheep) **Base:** `main` ← **Head:** `chore/pep621-build` --- ### 📝 Commits (1) - [`ece9707`](https://github.com/Glitchy-Sheep/boosty-downloader/commit/ece9707ac95233189a5c67e0c067a0db6e4f9f86) chore: Finish the PEP 621 move with hatchling and clean metadata ### 📊 Changes **2 files changed** (+26 additions, -8 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/ci.yaml` (+7 -0) 📝 `pyproject.toml` (+19 -8) </details> ### 📄 Description # [build] Finish the PEP 621 move: hatchling backend, clean metadata, guarded sdist ## Summary Third cleanup PR (audit этап 2). The build backend moves from poetry-core to hatchling, the metadata gets its missing fields, and the sdist becomes an explicit allowlist - which turned out to matter much more than expected. ## The important catch hatchling's sdist default packs **every non-vcs-ignored file** into the archive - including untracked local notes. A trial build pulled 15 private working files (analysis notes, PR drafts) and a megabyte of README assets into the tarball that `task release` would have uploaded to PyPI. The sdist is now `only-include = ["boosty_downloader"]`: 2.1 MB -> 63 KB, zero private files (verified by listing the archive). ## Changes - `[build-system]`: hatchling replaces poetry-core - the last `[tool.poetry]` key duplicated what any backend infers from the project name - `license = "MIT"` + `license-files`, `[project.urls]` (Homepage / Issues / Changelog) - the wheel finally carries the license and links - `pyyaml` dependency spelled in the same style as the other fourteen - CI build job now verifies all 7 Jinja templates land in the wheel: a wheel without them builds silently and crashes at render time ## Verification - `task build`: wheel 101 KB (7/7 templates inside), sdist 63 KB (package + README/LICENSE/pyproject only) - Clean-venv install of the wheel: `boosty-downloader --version` -> 3.5.0; a render through the installed package proves templates load from the wheel - The release tooling's version regexes are safe: the hatch config adds no second `version =` line - `task check` + `task test` green: 174 passed + 1 xfail - Live `task test:api` is currently blocked by the known network condition (curl reaches the API in 0.16s, aiohttp TLS gets cut - the anti-bot pattern, heals with a pause); the change touches no runtime code - No changelog entry: packaging only (`ci/skip-changelog`) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-13 19:48:13 +00:00