github-hosted-pypi

This project provides a Github-hosted PyPi index, enabling users to centralize access to all private packages while adhering to PEP 503. It facilitates the seamless installation of packages via pip, similar to how one would install publicly available packages.

Key Features

• Github-hosted: Utilize Github Pages to manage your PyPi index.
• Template Ready for Deployment: Quickly set up your own package index.
• User-friendly: Integrated with Github Actions for ease of use.
• Security Measures: Alerts users if their packages are vulnerable to supply chain attacks.

Installation and Usage

To install packages indexed in this repository, execute:

pip install public-hello --extra-index-url https://astariul.github.io/github-hosted-pypi/

This will also automatically install its dependency, mydependency.

To use the package in Python:

from public_hello import hi
print(hi())

To install a specific version of a package:

pip install public-hello==0.1 --extra-index-url https://astariul.github.io/github-hosted-pypi/

Note: Private packages such as private-hello require proper authentication to access:

pip install private-hello --extra-index-url https://astariul.github.io/github-hosted-pypi/

This installation will fail due to access restrictions.

Getting Started

To create your own repository using this template:

1. Navigate to the Settings tab of your new repository and enable Github Pages.
2. Customize the index.html and pkg_template.html files to fit your needs.
3. Access your PyPi index via <user>.github.io/<repo_name>.

Managing Indexed Packages

After setting up your index, register, update, or delete packages with Github Actions:

• Go to the Actions tab.
• Select the appropriate workflow (register, update, delete) and trigger it manually.
• Follow the prompts to submit your changes.

FAQs

• Is it secure? The index contains links to other Github repositories. Access to private packages is only available with proper authentication, minimizing exposure.
• What happens during installation? The process checks both the public PyPi index and your private index to install packages accordingly.
• What about package name collisions? If a package name conflicts with a public one, simply register it under a different name.
• Best Practices: Utilize Github releases and follow semantic versioning for package management.

Security Considerations

The project addresses potential supply chain attacks by verifying package authenticity through alerts when installing packages that duplicate names with higher versions in the public index.

Contribution

Open to contributions, feedback, and suggestions. For any ideas or queries, please create an issue or pull request.

References

Inspired by this repository, it aims to enhance user experience with cleaner layouts and automated workflows.