narumiruna/python-packaging-uv
skills/python-packaging-uv/SKILL.md
Use when building or publishing Python packages with uv, including dist artifacts and pre-publish checks.
$ install --global
skillsauthnpx skillsauth add narumiruna/agent-skills python-packaging-uvInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 28, 2026, 11:49 AM123.9s2 files scanned
SKILL.md
- name:
- python-packaging-uv
- description:
- Use when building or publishing Python packages with uv, including dist artifacts and pre-publish checks.
Python Packaging with uv
Overview
Use uv build and publish commands to produce wheels/sdists and ship to package indexes. Core principle: build from release-ready sources, verify artifacts, test installation, then publish.
Use When
- Building wheels or source distributions.
- Preparing release artifacts with uv.
- Publishing to Test PyPI or PyPI.
- Verifying package contents or installation behavior before release.
Quick Reference
| Task | Command |
| --- | --- |
| Build wheel+sdist | uv build |
| Build wheel only | uv build --wheel |
| Build for release (ignore local path overrides) | uv build --no-sources |
| Publish to PyPI | uv publish --token $PYPI_TOKEN |
| Publish to Test PyPI | uv publish --publish-url https://test.pypi.org/legacy/ --token $TEST_PYPI_TOKEN |
| Inspect wheel contents | unzip -l dist/<wheel>.whl |
| Test wheel install | uv run --with dist/<wheel>.whl python -c "import <module>" |
Workflow
- Run the repository quality gate before release.
- Build artifacts in
dist/withuv build --no-sources. - Inspect wheel and sdist contents.
- Test install from the built wheel in a fresh uv-managed invocation.
- Publish to Test PyPI for first or risky releases, validate install/import, then publish to PyPI.
Example
prek run -a
uv build --no-sources
unzip -l dist/my_package-1.0.0-py3-none-any.whl
uv run --with dist/my_package-1.0.0-py3-none-any.whl python -c "import my_package"
uv publish --publish-url https://test.pypi.org/legacy/ --token $TEST_PYPI_TOKEN
Common Mistakes
- Publishing before verifying wheel contents.
- Skipping Test PyPI for first release.
- Building release artifacts while local
[tool.uv.sources]overrides are active. - Verifying only the source tree instead of importing from the built wheel.
Red Flags
- Packaging guidance that ignores uv build/publish.
- Publishing commands shown before quality checks and artifact verification.
References
references/packaging.md- Build and publish details
Related Skills
narumiruna/scoring-agent-skills
development
VerifiedTrustedCommunity
Score or compare one or more agent skills across trigger clarity, workflow actionability, safety boundaries, verification rigor, incremental knowledge value, and leanness. Use only when the user explicitly asks for ratings, numerical quality scores, rubric-based scorecards, or scored comparisons; use creating-agent-skills for unscored reviews or revisions.
8SKILL.mdUpdated Jul 29, 2026
narumiruna/improving-codebase-architecture
development
VerifiedTrustedCommunity
Assess or improve an existing codebase's architecture when the user asks about module boundaries, coupling, scattered ownership, testability, change locality, deep modules, seams, or behavior-preserving structural refactoring. Use for cross-module design rather than ordinary diff review or a confirmed edge-case bug fix.
8SKILL.mdUpdated Jul 29, 2026
narumiruna/auditing-code-security
development
VerifiedTrustedCommunity
Perform read-only security audits, vulnerability assessments, or threat-focused reviews of diffs, pull requests, code paths, or explicitly scoped repositories when security is the primary objective or acceptance criterion. Use reviewing-code for ordinary review with baseline security coverage and hardening-code-paths for fixing confirmed findings.
8SKILL.mdUpdated Jul 29, 2026
narumiruna/running-panel-review-loops
development
VerifiedTrustedCommunity
Run iterative multi-reviewer panels over a code diff, verify their findings, apply explicitly authorized fixes, and re-review the updated change until it passes or reaches a stopping condition. Use when the user asks for a panel loop, multi-model code-review consensus, or a review-fix-re-review cycle.
8SKILL.mdUpdated Jul 26, 2026