⚠️

重要前提

安装AI Skills的关键前提是：必须科学上网，且开启TUN模式，这一点至关重要，直接决定安装能否顺利完成，在此郑重提醒三遍：科学上网，科学上网，科学上网。查看完整安装教程 →

使用Doppler安全发布Python包到PyPI | 本地发布脚本与凭证管理指南

pypi-doppler by terrylica/cc-skills

58 周安装量

24 GitHub Stars

GitHub

安装命令

npx skills add https://github.com/terrylica/cc-skills --skill pypi-doppler

开发开发运维安全

🇨🇳中文介绍

使用 Doppler 发布到 PyPI（仅限本地）

何时使用此技能

在以下情况下使用此技能：

从本地机器发布 Python 包到 PyPI
为 PyPI 令牌管理设置 Doppler
创建带有 CI 检测防护的本地发布脚本
在发布前验证仓库所有权

工作区范围策略：仅限本地发布

此技能仅支持本地机器发布。

禁止事项

从 GitHub Actions 发布
从任何 CI/CD 流水线发布（GitHub Actions、GitLab CI、Jenkins、CircleCI）
在 semantic-release 配置中使用 publishCmd
在 CI 中构建包（在 prepareCmd 中使用 uv build）
将 PyPI 令牌存储在 GitHub secrets 中

必需事项

在本地机器上使用 scripts/publish-to-pypi.sh
发布脚本中包含 CI 检测防护
每次发布前进行手动批准
使用 Doppler 进行凭证管理（无明文令牌）
仓库验证（防止分支滥用）

理由

安全性：GitHub secrets 中不存储长期有效的 PyPI 令牌
速度：本地 30 秒 vs CI 中的 3-5 分钟

广告位招租

在这里展示您的产品或服务

触达数万 AI 开发者，精准高效

联系我们

脚本	用途
`scripts/publish-to-pypi.sh`	带有 CI 检测防护的本地 PyPI 发布

强制要求：发布前验证版本增量

发布前验证：在发布到 PyPI 之前，验证版本是否已从上一个版本递增。未递增版本就发布是无效的，并且浪费资源。

自动检查序列：

将本地 pyproject.toml 版本与最新的 PyPI 版本进行比较
如果版本匹配——停止——不要继续发布
通知用户："版本未递增。请先运行 semantic-release 或验证提交是否包含 feat: 或 fix: 类型。"

完整的发布工作流

步骤 1：开发与提交（Conventional Commits）：

git add .
git commit -m "feat: add new feature"  # MINOR 版本号提升
git push origin main

步骤 2：自动化版本管理（GitHub Actions - 40-60 秒）：

GitHub Actions 自动：分析提交、确定下一个版本、更新 pyproject.toml/package.json、生成 CHANGELOG、创建 git 标签、创建 GitHub 发布。

PyPI 发布不会在此处发生（根据设计 - 参见 ADR-0027）。

步骤 3：本地 PyPI 发布（30 秒）：

git pull origin main
./scripts/publish-to-pypi.sh

使用捆绑脚本（推荐）

/usr/bin/env bash << 'GIT_EOF'
# 首次：将脚本从技能复制到您的项目（环境无关）
PLUGIN_DIR="${CLAUDE_PLUGIN_ROOT:-$HOME/.claude/plugins/marketplaces/cc-skills/plugins/itp}"
cp "$PLUGIN_DIR/skills/pypi-doppler/scripts/publish-to-pypi.sh" scripts/
chmod +x scripts/publish-to-pypi.sh

# 在 semantic-release 创建 GitHub 发布之后
git pull origin main

# 使用捆绑脚本的本地副本进行发布
./scripts/publish-to-pypi.sh
GIT_EOF

捆绑脚本特性：CI 检测防护、仓库验证、Doppler 集成、构建 + 发布 + 验证工作流、清晰的错误消息。

手动发布（高级）

不使用规范脚本进行手动发布：

/usr/bin/env bash << 'CONFIG_EOF'
# 从 Doppler 检索令牌
PYPI_TOKEN=$(doppler secrets get PYPI_TOKEN \
  --project claude-config \
  --config prd \
  --plain)

# 构建包
uv build

# 发布到 PyPI
UV_PUBLISH_TOKEN="${PYPI_TOKEN}" uv publish
CONFIG_EOF

警告：手动发布会绕过 CI 检测防护和仓库验证。除非有特定原因，否则请使用规范脚本。

主题	参考
CI 检测	CI 检测强制执行
凭证管理	Doppler 与令牌管理
故障排除	故障排除指南
TestPyPI 测试	TestPyPI 测试
mise 任务集成	mise 任务集成

ADR-0027：docs/architecture/decisions/0027-local-only-pypi-publishing.md - 仅限本地发布的架构决策
ADR-0028：docs/architecture/decisions/0028-skills-documentation-alignment.md - 技能与 ADR-0027 的对齐
PUBLISHING.md：docs/development/PUBLISHING.md - 完整的发布工作流指南
semantic-release 技能：semantic-release - 版本管理自动化（无发布）
mise-tasks 技能：mise-tasks - 具有依赖管理的任务编排
发布工作流模式：release-workflow-patterns.md - DAG 模式和反模式
捆绑脚本：scripts/publish-to-pypi.sh - 带有 CI 防护的参考实现

2025-12-03：重构为发现优先、环境无关的方法
- discover_uv() 检查 PATH、直接安装、版本管理器（优先级顺序）
- 支持：curl 安装、Homebrew、cargo、mise、asdf - 不强制任何方法
2025-11-22：创建时与 ADR-0027 对齐（工作区范围的仅限本地策略）
验证：CI 检测防护已测试，Doppler 集成已验证

最后更新：2025-12-03 策略：工作区范围的仅限本地 PyPI 发布（ADR-0027）取代：无（创建时即符合 ADR-0027）

🇺🇸English

PyPI Publishing with Doppler (Local-Only)

When to Use This Skill

Use this skill when:

Publishing Python packages to PyPI from local machine
Setting up Doppler for PyPI token management
Creating local publish scripts with CI detection guards
Validating repository ownership before release

WORKSPACE-WIDE POLICY: LOCAL-ONLY PUBLISHING

This skill supports LOCAL machine publishing ONLY.

FORBIDDEN

Publishing from GitHub Actions
Publishing from any CI/CD pipeline (GitHub Actions, GitLab CI, Jenkins, CircleCI)
publishCmd in semantic-release configuration
Building packages in CI (uv build in prepareCmd)
Storing PyPI tokens in GitHub secrets

REQUIRED

Use scripts/publish-to-pypi.sh on local machine
CI detection guards in publish script
Manual approval before each release
Doppler credential management (no plaintext tokens)
Repository verification (prevents fork abuse)

Rationale

Security : No long-lived PyPI tokens in GitHub secrets
Speed : 30 seconds locally vs 3-5 minutes in CI
Control : Manual approval step before production release
Flexibility : Centralized credential management via Doppler

See : ADR-0027, docs/development/PUBLISHING.md

Overview

This skill provides local-only PyPI publishing using Doppler for secure credential management. It integrates with the workspace-wide release workflow where:

GitHub Actions : Automated versioning ONLY (tags, releases, CHANGELOG)
Local Machine : Manual PyPI publishing with Doppler credentials

Bundled Scripts

Script	Purpose
`scripts/publish-to-pypi.sh`	Local PyPI publishing with CI detection guards

Usage : Copy to your project's scripts/ directory:

/usr/bin/env bash << 'DOPPLER_EOF'
# Environment-agnostic path
PLUGIN_DIR="${CLAUDE_PLUGIN_ROOT:-$HOME/.claude/plugins/marketplaces/cc-skills/plugins/itp}"
cp "$PLUGIN_DIR/skills/pypi-doppler/scripts/publish-to-pypi.sh" scripts/
chmod +x scripts/publish-to-pypi.sh
DOPPLER_EOF

Prerequisites

One-Time Setup

Install Doppler CLI :

brew install dopplerhq/cli/doppler
Authenticate with Doppler :

doppler login
Verify access toclaude-config project:

doppler whoami doppler projects

PyPI Token Setup

Create PyPI API token :
- Visit: https://pypi.org/manage/account/token/
- Enable 2FA if not already enabled (required since 2024)
- Create token with scope: "Entire account" or specific project
- Copy token (starts with pypi-AgEIcHlwaS5vcmc..., ~180 characters)
Store token in Doppler :

doppler secrets set PYPI_TOKEN='pypi-AgEIcHlwaS5vcmc...'
--project claude-config
--config prd
Verify token stored :

doppler secrets get PYPI_TOKEN
--project claude-config
--config prd
--plain

Publishing Workflow

MANDATORY: Verify Version Increment Before Publishing

Pre-publish validation : Before publishing to PyPI, verify that the version has incremented from the previous release. Publishing without a version increment is invalid and wastes resources.

Autonomous check sequence :

Compare local pyproject.toml version against latest PyPI version
If versions match -- STOP - do not proceed with publishing
Inform user: "Version not incremented. Run semantic-release first or verify commits include feat: or fix: types."

Complete Release Workflow

Step 1: Development & Commit (Conventional Commits):

git add .
git commit -m "feat: add new feature"  # MINOR bump
git push origin main

Step 2: Automated Versioning (GitHub Actions - 40-60s):

GitHub Actions automatically: analyzes commits, determines next version, updates pyproject.toml/package.json, generates CHANGELOG, creates git tag, creates GitHub release.

PyPI publishing does NOT happen here (by design - see ADR-0027).

Step 3: Local PyPI Publishing (30 seconds):

git pull origin main
./scripts/publish-to-pypi.sh

Using Bundled Script (Recommended)

/usr/bin/env bash << 'GIT_EOF'
# First time: copy script from skill to your project (environment-agnostic)
PLUGIN_DIR="${CLAUDE_PLUGIN_ROOT:-$HOME/.claude/plugins/marketplaces/cc-skills/plugins/itp}"
cp "$PLUGIN_DIR/skills/pypi-doppler/scripts/publish-to-pypi.sh" scripts/
chmod +x scripts/publish-to-pypi.sh

# After semantic-release creates GitHub release
git pull origin main

# Publish using local copy of bundled script
./scripts/publish-to-pypi.sh
GIT_EOF

Bundled script features : CI detection guards, repository verification, Doppler integration, build + publish + verify workflow, clear error messages.

Manual Publishing (Advanced)

For manual publishing without the canonical script:

/usr/bin/env bash << 'CONFIG_EOF'
# Retrieve token from Doppler
PYPI_TOKEN=$(doppler secrets get PYPI_TOKEN \
  --project claude-config \
  --config prd \
  --plain)

# Build package
uv build

# Publish to PyPI
UV_PUBLISH_TOKEN="${PYPI_TOKEN}" uv publish
CONFIG_EOF

WARNING : Manual publishing bypasses CI detection guards and repository verification. Use canonical script unless you have a specific reason not to.

Reference Documentation

Topic	Reference
CI Detection	CI Detection Enforcement
Credential Management	Doppler & Token Management
Troubleshooting	Troubleshooting Guide
TestPyPI Testing	TestPyPI Testing
mise Task Integration	mise Task Integration

Validation History

2025-12-03 : Refactored to discovery-first, environment-agnostic approach
- discover_uv() checks PATH, direct installs, version managers (priority order)
- Supports: curl install, Homebrew, cargo, mise, asdf - doesn't force any method
2025-11-22 : Created with ADR-0027 alignment (workspace-wide local-only policy)
Validation : CI detection guards tested, Doppler integration verified

Last Updated : 2025-12-03 Policy : Workspace-wide local-only PyPI publishing (ADR-0027) Supersedes : None (created with ADR-0027 compliance from start)

Weekly Installs

Repository

terrylica/cc-skills

GitHub Stars

First Seen

Jan 24, 2026

Security Audits

Gen Agent Trust HubFail SocketPass SnykWarn

Installed on

opencode55

claude-code54

gemini-cli54

codex53

github-copilot52

cursor52

Azure Data Explorer (Kusto) 查询技能：KQL数据分析、日志遥测与时间序列处理

158,400 周安装

release-workflow-patterns.md

Bundled Script : scripts/publish-to-pypi.sh - Reference implementation with CI guards