Repository navigation
Stop extras from installing other people's packages - #18
Coding-Dev-Tools wants to merge 1 commit into
Conversation
None of the DevForge tools is on public PyPI, so bare extras like "deadcode", "envault" and "json2sql" resolved to unrelated packages by other authors (deadcode 2.4.1, envault 0.4.6, json2sql 1.0.0rc1), and [all] failed outright. Each extra now points at its real distribution in its GitHub repo. Also fix the README's recommended command, which pip parsed as a git URL ending in "[all]" and failed to clone. Verified: pip install --dry-run "./devforge-cli[all]" resolves all ten tools to Coding-Dev-Tools repos. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0111byzLrKKTCJ23uTT6PyZq
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e2e355bef3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # These tools are not on public PyPI yet, so each extra points at its GitHub repo. | ||
| # Bare names (e.g. "deadcode", "envault", "json2sql") resolve to unrelated | ||
| # packages owned by other people. Switch to version pins once each tool is published. | ||
| guard = ["api-contract-guardian @ git+https://github.com/Coding-Dev-Tools/api-contract-guardian.git"] |
There was a problem hiding this comment.
When a GitHub Release triggers .github/workflows/publish.yml, these optional dependencies are emitted as Requires-Dist direct URLs and PyPI rejects the upload, so the release workflow cannot publish this project while the Git URLs remain here. Setuptools documents this PyPI restriction.
Useful? React with 👍 / 👎.
Why
No DevForge tool is on public PyPI, so the bare extras in
pyproject.tomlresolved to other people's packages:[deadcode]installed deadcode 2.4.1 (Albertas Gimbutas),[envault]envault 0.4.6 (pratishshr),[sql]json2sql 1.0.0rc1 (fridex).[all]failed outright, and the unregistered names could be claimed by anyone. The README's recommended command also failed, because pip parsed...devforge-cli.git[all]as the git URL.What changes
deadcode-cli @ git+https://github.com/Coding-Dev-Tools/deadcode.git.pip install "devforge-tools[all] @ git+https://github.com/Coding-Dev-Tools/devforge-cli.git".Verified
pip install --dry-run "./devforge-cli[all]"resolves all ten tools to Coding-Dev-Tools repos: api-contract-guardian, apiauth, apighost, click-to-mcp, configdrift, deadcode-cli, deploydiff, json2sql-cli, rh-envault, schemaforge-cli.Later
PyPI rejects direct references in uploaded packages. Once the tools are published (Trusted Publishing), switch these back to version pins on the real names.
Generated by Claude Code