Package and ship github-to-sops with pip

[humphd]

We're using sops and GitHub to secure secrets in the repo, and @tarasglek has created a neat Python tool to make it easier to do: https://github.com/tarasglek/github-to-sops. Let's get this packaged so it can be installed with pip

[tarasglek]

https://simonwillison.net/2024/Jan/16/python-lib-pypi/ seems helpful

[humphd]

https://github.com/prefix-dev/rattler-build/blob/main/examples/rich/recipe.yaml for an example of doing this with rattler-build for conda.

[humphd]

tarasglek/github-to-sops#2

[rjwignar]

I'd like to look into Willison's method

[humphd]

@rjwignar awesome, thank you. I would suggest you continue work in the gitub-to-sops repo vs. here, but I'll leave this open as a tracking issue.

Don't pay attention to what I've done for rattler; do what Simon says to do. The rattler build can leverage whatever you do with pip.

[humphd]

We should figure out which pieces of this we can get done by 1.1 (next Friday), even if we can't get it all in by then.

[rjwignar]

I recently made a PR that modifies github-to-sops's directory structure to match that produced by Willison's cookiecutter template.
Among other things, the cookiecutter template also adds a workflow that publishes package releases to PyPI.

Publishing to PyPI first requires filling a Pending Publisher form to use PyPI's Trusted Publishers mechanism. Here's an example form Willison filled out for one of his libraries:

I haven't tried it yet, but I think I'd be able to fill out (using the github-to-sops repo info) and submit the form even though I'm not the repo owner.

[humphd]

@WangGithub0 do you want to review tarasglek/github-to-sops#3 as well, since you did something similar for the TypeScript module?

[WangGithub0]

tarasglek/github-to-sops#3

sure, I'll do it

[humphd]

@rjwignar can we close this now?

[rjwignar]

@humphd Thanks for reminding me.
I hadn't checked this issue in a while and thought it also required shipping github-to-sops to ChatCraft, but I re-read the issue and everything's been completed. We can close it