PyPI Publishing

pyproject.toml is the canonical release-version source. The private frontend package and its lock file carry the same version so a release commit identifies one application build. Update all three files in the release commit; do not use the frontend package version as an independent release stream.

Use the version:bump devenv task to update pyproject.toml, the frontend manifest and lockfile, and the frontend Nix derivation together. Set VERSION_BUMP to major, minor, patch, or an exact X.Y.Z value:

VERSION_BUMP=patch devenv tasks run version:bump

The make package workflow builds the frontend and Sphinx documentation before creating the wheel and source distribution. Generated frontend files are owned by staticfiles/; generated documentation is owned by static/docs/ for the deployed documentation route. docs/_build/ is disposable local build output and is not committed.

Updating the frontend dependency hash

A commit might add a package to package.json and package-lock.json while the Nix expression still contains the hash for the previous dependency set:

npmDepsHash = "sha256-gFyVehSwVatoPJnel6OSbV2mYRbG3Fbk5/aooeEzzhw=";

Nix downloaded the dependencies described by the new lockfile, calculated their actual hash, and correctly rejected them because reproducibility checks found:

expected: sha256-gFyVehSwVatoPJnel6OSbV2mYRbG3Fbk5/aooeEzzhw=
actual:   sha256-w4+drE6pSUWLrKiGetBqttaomC9mPEMDwm8ElcpLoVY=

Run the dedicated helper after changing the lockfile, then copy its output into frontend/default.nix and rerun make package:

make frontend-npm-deps-hash

For example:

npmDepsHash = "sha256-w4+drE6pSUWLrKiGetBqttaomC9mPEMDwm8ElcpLoVY=";