alexeygrigorev/setup-pypi-ci
skills/setup-pypi-ci/SKILL.md
Add the standardized CI publish workflow (`.github/workflows/publish.yml` + `make release`) to an existing Python project so PyPI releases happen on tag push. Use when a project still publishes via a local script (`publish.py`, `hatch publish`, `twine upload`) or has no automated publish at all.
$ install --global
skillsauthnpx skillsauth add alexeygrigorev/.claude setup-pypi-ciInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 25, 2026, 3:33 AM9.3s2 files scanned
SKILL.md
- name:
- setup-pypi-ci
- description:
- Add the standardized CI publish workflow (`.github/workflows/publish.yml` + `make release`) to an existing Python project so PyPI releases happen on tag push. Use when a project still publishes via a local script (`publish.py`, `hatch publish`, `twine upload`) or has no automated publish at all.
Setup PyPI CI
After this skill: release = bump version → commit → push → make release. CI builds and uploads.
Steps
- Copy
publish.ymlto.github/workflows/publish.yml. - Merge the targets from
Makefileinto the project's Makefile. Replace<pkg>with the actual package directory (usesrc/<pkg>if applicable). - Set the PyPI token secret:
PYPI_TOKEN=$(grep "^password" ~/.pypirc | head -1 | sed 's/password = //') gh secret set PYPI_API_TOKEN --body "$PYPI_TOKEN" - Commit and push.
Use the release skill to cut the first version.
Related Skills
alexeygrigorev/fetch-google-recorder
development
VerifiedTrustedCommunity
Fetch and transcribe Google Recorder voice notes. Use when the user shares a recorder.google.com link and wants the original audio file, a transcript, or wants to act on a voice note.
6SKILL.mdUpdated May 10, 2026
alexeygrigorev/release
development
VerifiedTrustedCommunity
Release the current project to its package registry and GitHub by bumping the version, pushing a tag, and letting CI publish. Works for any project (Python/PyPI, Rust/crates.io, Node/npm, etc.) that has a CI publish workflow keyed off `v*` tags.
6SKILL.mdUpdated May 4, 2026
alexeygrigorev/init-library
tools
VerifiedTrustedCommunity
Initialize a new Python library with modern tooling, packaging, tests, and optional CLI support. Use when the user wants to scaffold a new Python package.
6SKILL.mdUpdated May 4, 2026
alexeygrigorev/fetch-youtube
content-media
VerifiedTrustedCommunity
Fetch YouTube video transcripts. Use when the user asks to get a YouTube video transcript, subtitles, or captions, or wants to analyze/summarize a YouTube video.
6SKILL.mdUpdated Apr 2, 2026