The Day I Became the One Being pip Installed: My Pre-Release Checks Caught 3 Leaks
(Translation of my Japanese article on Zenn.) This is part 4 of a series where I keep delegating implementation to AI without being able to read the code, building a vulnerability triage CLI called triage-lens. This installment is about distribution rather than the tool's internals: the tool had been sitting on GitHub, and I published it to PyPI so a single pip install triage-lens brings it in. A…
This article recounts the author's experience releasing a tool called triage-lens to PyPI (Python Package Index) and the struggles they encountered during the process. The tool was initially developed without the author being able to read the code, and the release was handled by AI. However, the release process uncovered three leaks - test code accidentally included in the distribution, the private development repository name appearing in a published artifact, and relative links in the README causing 404 errors on the PyPI page.
To prevent this from happening again, the author implemented a Trusted Publishing (OIDC) system for PyPI authentication, which eliminates the need for long-lived passwords to be stored anywhere. Despite passing pre-release checks, the author experienced two post-release issues: the PyPI page not updating after updating the README, and the post-release smoke check failing with the message "that version does not exist."
These issues highlight the importance of careful checking and verification during the distribution process. The author emphasizes the value of turning verification into a mechanism, as it caught leaks that would have gone unnoticed otherwise. After the release, the author plans to collect download counts and package usage data to gauge the tool's success.
The repository for triage-lens is public, and users can install it with a single command: pip install triage-lens.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
