@flowwright/plugin-python

The batteries-included Python CI lifecycle, ready to drop in — typed, composable stage builders that carry you from install → format → lint (Ruff) → typecheck (mypy) → test (pytest) → build (packaging) → publish. It's a reusable shared library that's a normal npm package you can read and pin, and it speaks pip (default), uv, and poetry out of the box. Good defaults get you going; the optional stages (format/typecheck/build/publish) stay off until you want them.

Whole pipeline

import { pythonServicePipeline } from "@flowwright/plugin-python";

export default pythonServicePipeline({
  packageManager: "uv",
  typecheck: true,
});

Compose into your own

Wrap the stages in group("py", …) to namespace their ids so they don't collide with other shared libraries:

import { pipeline, group } from "@flowwright/core";
import { pythonStages } from "@flowwright/plugin-python";

export default pipeline({
  name: "billing",
  stages: [
    ...group("py", pythonStages({
      packageManager: "uv",
      format: true, // ruff format --check
      typecheck: true, // mypy
      build: true, // sdist + wheel → dist artifact
      publish: true, // uv publish, binds a PyPI token
    })),
  ],
});

Options

| Option | Default | Notes | |---|---|---| | packageManager | "pip" | pip (requirements.txt), uv (uv.lock), poetry (poetry.lock) | | cache | true | Caches the in-project .venv keyed by the lockfile (uv/poetry only; pip has none) | | install | true | false to skip, or a string for a custom command | | format | false | ruff format --check . | | lint | true | ruff check . | | typecheck | false | mypy . | | test | true | pytest. For coverage: test: "pytest --cov" | | build | false | python -m build / uv build / poetry build | | artifactPath | "dist" | build output uploaded as an artifact | | publish | — | adds a Publish stage; true or { credential? } |

Every stage toggle accepts true (default command), false (skip), or a string (a custom shell command). Tools run through the package manager's runner (uv run … / poetry run …; bare for pip). Stages carry explicit ids and are wired with needs: checks depend on install, build depends on the checks, and publish depends on build.

Publish auth

The Publish stage binds a PyPI-token credential (default id pypi-token) to the tool's token env var — TWINE_PASSWORD (pip/twine), UV_PUBLISH_TOKEN (uv), or POETRY_PYPI_TOKEN_PYPI (poetry). Credentials are resolved by the server/worker — the local flow run does not inject them.

Combinations that are rejected

An option this configuration cannot honor throws at plan time rather than silently doing nothing. Only an explicitly passed value counts.

| Passed | Why it throws | | --- | --- | | artifactPath with build off | nothing would be produced — and build defaults to false | | cache: true with install: false | there is nothing to cache | | cache: true with packageManager: "pip" | pip has no in-project venv to cache | | name to pythonStages() | only pythonServicePipeline() uses it |

pythonStages({ packageManager: "pip" }) is fine — cache defaults to true, and a default the config can't use is narrowed silently.