python-project-lifecycle

python-project-lifecycle is a composite GitHub Action for common Python project lifecycle phases, one phase per run. It standardizes step behavior for Python project automation while leaving workflow topology, permissions, matrices, environments, and deployment approvals in the caller's workflow.

• Usage
• Inputs
• Examples
• Behavior
• Security Notes
• Outputs
• Permissions
• Version Pinning
• License

Build, validate, smoke-test, and upload Python distributions:

- uses: Dagitali/python-project-lifecycle@v0.1.0
  with:
    phase: build-upload
    python-version: '3.13'
    release-artifact-audit-command: python tools/check_release_artifacts.py dist/*
    behavior-smoke-command: '{python} tools/smoke_test_schema_validation.py {python}'
    command-name: my-command
    package-name: my-package
    smoke-commands: |
      my-command --version
      my-command --help

Build Sphinx documentation:

- uses: Dagitali/python-project-lifecycle@v0.1.0
  with:
    phase: docs
    python-version: '3.13'
    docs-builder: html

Run a caller-provided security command:

- uses: Dagitali/python-project-lifecycle@v0.1.0
  with:
    phase: security
    pip-install: 'pip-audit'
    security-command: pip-audit

The Required column reflects the action metadata in action.yml. Some inputs with defaults are still required for specific phases at runtime, as noted in the descriptions below.

Run linting with Ruff:

- uses: Dagitali/python-project-lifecycle@v0.1.0
  with:
    phase: lint
    python-version: '3.13'
    pip-install: ruff
    ruff-args: check src tests

Run tests with an optional setup command:

- uses: Dagitali/python-project-lifecycle@v0.1.0
  with:
    phase: test
    python-version: '3.13'
    pip-install: '-e .[test]'
    meta-test-command: python -m compileall src
    pytest-args: '-q tests/'

Generate an SBOM:

- uses: Dagitali/python-project-lifecycle@v0.1.0
  with:
    phase: sbom
    python-version: '3.13'
    sbom-output-file: sbom.json

Download distribution artifacts in a later job:

- uses: Dagitali/python-project-lifecycle@v0.1.0
  with:
    phase: download-dist
    artifact-name: dist-artifacts
    artifact-path: dist

Deploy with a caller-owned command:

- uses: Dagitali/python-project-lifecycle@v0.1.0
  with:
    phase: deploy
    deploy-command: python tools/deploy.py

Set phase to select exactly one lifecycle operation:

Most command-valued inputs are executed as trusted shell snippets in the configured working-directory. smoke-commands is passed through to the delegated Dagitali/python-installer-smoke action rather than run directly by this action. Empty command inputs are rejected for phases that require a caller-provided command.

The skip-artifact-upload, skip-installer-smoke, and skip-wheel-smoke inputs are validated on every run and must be exactly true or false. The twine-check input must be exactly true or false for build and build-upload.

The action composes pinned public actions for Python bootstrapping, installer smoke testing, artifact upload, and artifact download. It also uses helper scripts in scripts/ through GITHUB_ACTION_PATH.

Treat all command inputs, path and glob inputs, dependency install arguments, and smoke-test command inputs as trusted workflow configuration. Do not build these values from untrusted issue, pull request, or user-supplied text.

The command inputs are shell commands. Keep smoke and validation commands small and deterministic, such as --version, --help, import checks, metadata checks, or lightweight startup behavior checks.

This action pins the public actions it composes by commit SHA. Calling workflows should still pin this action to a release tag or full commit SHA.

Outputs mostly mirror the configured paths. upload-dist and download-dist do not bootstrap Python, so python-version and pip-version reflect whatever Python is already available on the runner, or an empty value if none is found.

The action itself does not require repository or token permissions. Calling workflows should grant only the permissions needed by their own jobs, such as contents: read for checkout, package publishing permissions, or deployment environment permissions.

Prefer a release tag such as Dagitali/python-project-lifecycle@v0.1.0 or an exact version tag for normal use. Pin to a full commit SHA when your workflow requires maximum supply-chain immutability.

Copyright © 2026 Dagitali LLC. All rights reserved.

See LICENSE for details.