File size: 54,892 Bytes
c27fdb6 f594d3d 446df3a f594d3d 446df3a f594d3d 2ca530a f594d3d 446df3a f594d3d 446df3a c27fdb6 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 | <!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>Pyproject Release requirements — check pyproject release metadata</title>
<meta name="description" content="This offline browser tool checks pyproject.toml release metadata for end-of-life Python requirements, PEP 639 licence drift, classifier conflicts, and setuptools SPDX support.">
<style>
:root{color-scheme:light}body{margin:0;font:15px/1.55 system-ui,-apple-system,"Segoe UI",sans-serif;background:#faf9f5;color:#1a1512}
.wrap{max-width:960px;margin:0 auto;padding:28px 18px 60px}h1{font-size:26px;margin:0 0 6px}.lede{color:#4a403a;margin:0 0 16px}
textarea{width:100%;min-height:260px;font:13px/1.45 ui-monospace,Menlo,Consolas,monospace;padding:12px;border:1px solid #d9d0c4;border-radius:8px;box-sizing:border-box}
.bar{display:flex;gap:10px;align-items:center;margin:12px 0}button{font:600 15px system-ui;padding:10px 18px;border:0;border-radius:8px;background:#1a1512;color:#fff;cursor:pointer}
input[type=date]{font:14px system-ui;padding:8px;border:1px solid #d9d0c4;border-radius:6px}
table{border-collapse:collapse;width:100%;font-size:14px;margin-top:10px}th,td{text-align:left;padding:8px 10px;border-bottom:1px solid #eee;vertical-align:top}th{font-size:12px;letter-spacing:.06em;text-transform:uppercase;color:#7a6e65}
.sev.error{color:#a8551f;font-weight:700}.sev.warn,.sev.warning{color:#96691f}.ok{color:#2a6446;font-weight:600}.sum{font-weight:600}
.note{font-size:13px;color:#7a6e65;margin-top:18px}#paid{margin-top:22px;padding:14px 16px;border:1px solid #e2d8cb;border-radius:10px;background:#fffdfa}
</style>
<script data-grow-initializer="">!(function(){window.growMe||((window.growMe=function(e){window.growMe._.push(e);}),(window.growMe._=[]));var e=document.createElement("script");(e.type="text/javascript"),(e.src="https://faves.grow.me/main.js"),(e.defer=!0),e.setAttribute("data-grow-faves-site-id","U2l0ZTphZjljMzgyMC0yMmU5LTRhYjgtYTIxNS03OTRhMGY1N2ExYzM=");var t=document.getElementsByTagName("script")[0];t.parentNode.insertBefore(e,t);})();</script>
<!--yj-canon-s101--><link rel="canonical" href="https://getreadystack.com/tools/pyproject-release-gate"></head>
<body>
<div class="wrap">
<h1>Pyproject Release requirements — check pyproject release metadata</h1>
<p class="lede">Catches pyproject.toml metadata that breaks your next release: end-of-life requires-python, PEP 639 licence drift, classifier conflicts, setuptools too old for SPDX. Date-aware, offline. Runs entirely in your browser — nothing is uploaded.</p>
<textarea id="src" spellcheck="false"># pyproject.toml as an assistant wrote it in one pass
[build-system]
requires = ["setuptools>=61.0", "wheel"]
build-backend = "setuptools.build_meta"
[project]
name = "Invoice_Toolkit"
version = "1.4.0"
description = "Helpers for parsing and validating supplier invoices"
requires-python = ">=3.8,<4"
license = "Apache 2.0"
license-files = ["/usr/share/licenses/invoice-toolkit/LICENSE", "../COPYING"]
dynamic = ["version"]
authors = [{ name = "A. Maintainer", email = "a@example.com" }]
dependencies = [
"httpx>=0.27",
"pydantic>=2.6",
]
classifiers = [
"Development Status :: 4 - Beta",
"Programming Language :: Python :: 3.7",
"Programming Language :: Python :: 3.8",
"Programming Language :: Python :: 3.12",
"License :: OSI Approved :: Apache Software License",
"Operating System :: OS Independent",
]</textarea>
<div class="bar"><button id="go">Check</button><label>as of <input type="date" id="today"></label></div>
<div id="out" aria-live="polite"></div>
<div id="paid"><strong>Free here:</strong> Every finding for the pyproject.toml open in your editor, with the line, the spec that changed and the replacement text. <strong>In the editor:</strong> Sweeping every pyproject.toml in a monorepo in one pass and writing a dated report file you keep in the repo — that part asks for a licence key.</div>
<p class="note">Same engine as the VS Code extension, byte for byte.</p>
</div>
<script>var PJ_RULES = {
"meta": {
"id": "pyproject-release-gate",
"rule_set_version": "2026.09",
"scope": "[project] metadata in pyproject.toml (PEP 621 + PEP 639)",
"yardstick": "A packaging consultant reviewing one release manifest bills by the hour; this reads the same file in under a second."
},
"python_eol": {
"3.6": "2021-12-23",
"3.7": "2023-06-27",
"3.8": "2024-10-07",
"3.9": "2025-10-31",
"3.10": "2026-10-31",
"3.11": "2027-10-31",
"3.12": "2028-10-31",
"3.13": "2029-10-31",
"3.14": "2030-10-31"
},
"spdx_replacements": {
"GPL-3.0": "GPL-3.0-only (or GPL-3.0-or-later)",
"GPL-2.0": "GPL-2.0-only (or GPL-2.0-or-later)",
"LGPL-3.0": "LGPL-3.0-only (or LGPL-3.0-or-later)",
"LGPL-2.1": "LGPL-2.1-only (or LGPL-2.1-or-later)",
"AGPL-3.0": "AGPL-3.0-only (or AGPL-3.0-or-later)",
"BSD-2-Clause-FreeBSD": "BSD-2-Clause-Views",
"MIT LICENSE": "MIT",
"MIT LICENCE": "MIT",
"APACHE 2.0": "Apache-2.0",
"APACHE-2": "Apache-2.0",
"APACHE2.0": "Apache-2.0",
"APACHE LICENSE 2.0": "Apache-2.0",
"BSD": "BSD-3-Clause (pick the exact variant)",
"BSD LICENSE": "BSD-3-Clause (pick the exact variant)",
"GPLV3": "GPL-3.0-or-later",
"GPLV2": "GPL-2.0-or-later",
"MPL2.0": "MPL-2.0",
"PUBLIC DOMAIN": "CC0-1.0 or Unlicense"
},
"setuptools_spdx_min": "77.0.0",
"rules": [
{"id": "project_table_missing", "sev": "error", "title": "No [project] table",
"spec": "PEP 621", "fix": "Add a [project] table with name, version, requires-python and license."},
{"id": "build_system_missing", "sev": "error", "title": "No [build-system] requires",
"spec": "PEP 518", "fix": "Add [build-system] with requires = [\"setuptools\u003e=77\"] and build-backend."},
{"id": "requires_python_missing", "sev": "error", "title": "requires-python absent",
"spec": "PEP 621", "fix": "Set requires-python so pip refuses interpreters you do not support."},
{"id": "requires_python_eol", "sev": "error", "title": "requires-python floor is end-of-life",
"spec": "python/devguide release cycle", "fix": "Raise the floor to a version that still gets security fixes."},
{"id": "requires_python_eol_soon", "sev": "warn", "title": "requires-python floor goes end-of-life within a year",
"spec": "python/devguide release cycle", "fix": "Plan the floor bump before that date, not after a CVE."},
{"id": "requires_python_upper_cap", "sev": "warn", "title": "Upper cap on requires-python",
"spec": "PEP 440 / pip resolver", "fix": "Drop the upper cap; a cap makes resolvers skip your package on new Python."},
{"id": "classifier_python_eol", "sev": "warn", "title": "Classifier advertises an end-of-life Python",
"spec": "PyPI trove classifiers", "fix": "Remove the classifier for that version."},
{"id": "classifier_python_mismatch", "sev": "error", "title": "Classifier contradicts requires-python",
"spec": "PEP 621", "fix": "Keep classifiers and requires-python on the same set of versions."},
{"id": "license_table_deprecated", "sev": "error", "title": "license as a table is deprecated",
"spec": "PEP 639", "fix": "Use license = \"\u003cSPDX expression\u003e\" and license-files = [\"LICENSE\"]."},
{"id": "license_classifier_deprecated", "sev": "warn", "title": "License :: classifier is deprecated",
"spec": "PEP 639", "fix": "Delete the License :: classifier; the SPDX expression carries it now."},
{"id": "license_classifier_conflict", "sev": "error", "title": "SPDX expression and License :: classifier together",
"spec": "PEP 639", "fix": "Keep the SPDX expression, delete every License :: classifier."},
{"id": "license_files_invalid_pattern", "sev": "error", "title": "license-files pattern is not a relative glob",
"spec": "PEP 639", "fix": "license-files patterns must be relative and must not contain '..'."},
{"id": "license_expression_not_spdx", "sev": "error", "title": "license is not a valid SPDX identifier",
"spec": "PEP 639 / SPDX licence list", "fix": "Replace it with the current SPDX identifier."},
{"id": "spdx_operator_case", "sev": "error", "title": "SPDX operator is lower-case",
"spec": "PEP 639 / SPDX expression syntax", "fix": "SPDX operators are AND, OR, WITH in upper case."},
{"id": "setuptools_too_old_for_spdx", "sev": "error", "title": "setuptools pin cannot read the SPDX license field",
"spec": "setuptools 77.0.0", "fix": "Raise the build requirement to setuptools\u003e=77."},
{"id": "dynamic_version_conflict", "sev": "error", "title": "Field is both static and dynamic",
"spec": "PEP 621", "fix": "A field listed in dynamic must not also be set statically."},
{"id": "project_name_not_normalized", "sev": "warn", "title": "Distribution name is not in normalised form",
"spec": "PEP 503 / PEP 508", "fix": "Lower-case it and use hyphens so the name you publish is the name people type."},
{"id": "readme_missing", "sev": "warn", "title": "No readme",
"spec": "PEP 621", "fix": "Point readme at your README file so the PyPI page is not blank."},
{"id": "urls_missing", "sev": "info", "title": "No [project.urls]",
"spec": "PEP 621", "fix": "Add Homepage / Source / Issues so the PyPI sidebar has links."}
]
}
;</script>
<script>// pyproject.toml Release Gate — the brain. One file, runs in Node and in the browser.
'use strict';
var DATA = (typeof module !== 'undefined' && module.exports) ? require('./rules.json') : window.PJ_RULES;
var RULES = DATA.rules;
var EOL = DATA.python_eol;
var SPDX_FIX = DATA.spdx_replacements;
var SETUPTOOLS_MIN = DATA.setuptools_spdx_min;
var SPDX_KNOWN = ['MIT', 'MIT-0', 'Apache-2.0', 'BSD-2-Clause', 'BSD-3-Clause', 'BSD-4-Clause', 'ISC', 'MPL-2.0',
'GPL-2.0-only', 'GPL-2.0-or-later', 'GPL-3.0-only', 'GPL-3.0-or-later', 'LGPL-2.1-only', 'LGPL-2.1-or-later',
'LGPL-3.0-only', 'LGPL-3.0-or-later', 'AGPL-3.0-only', 'AGPL-3.0-or-later', 'Unlicense', 'CC0-1.0', 'CC-BY-4.0',
'CC-BY-SA-4.0', 'Zlib', 'PSF-2.0', 'Python-2.0', 'BSL-1.0', 'EPL-2.0', 'Artistic-2.0', 'PostgreSQL', 'OFL-1.1',
'Apache-2.0-WITH-LLVM-exception', 'LicenseRef-Proprietary'];
function byId(id) { for (var i = 0; i < RULES.length; i++) if (RULES[i].id === id) return RULES[i]; return { id: id, sev: 'error', fix: '' }; }
function days(fromISO, toISO) { return Math.round((Date.parse(toISO + 'T00:00:00Z') - Date.parse(fromISO + 'T00:00:00Z')) / 86400000); }
function verKey(v) { var p = String(v).split('.'); return parseInt(p[0], 10) * 1000 + (parseInt(p[1], 10) || 0); }
function eolVersions() { var out = []; for (var k in EOL) if (EOL.hasOwnProperty(k)) out.push(k); out.sort(function (a, b) { return verKey(a) - verKey(b); }); return out; }
// Recommend the lowest listed Python that still has at least a year of upstream security support left.
function recommendFloor(today) {
var vs = eolVersions();
for (var i = 0; i < vs.length; i++) if (days(today, EOL[vs[i]]) >= 365) return vs[i];
return vs[vs.length - 1];
}
// A deliberately line-oriented reader: enough to see every [project] key, small enough to run in a browser tab.
function parse(text) {
var lines = String(text == null ? '' : text).split(/\r?\n/);
var tables = {}; // table name -> { key: {raw, line} }
var order = [];
var table = '';
var pending = null; // multi-line array/inline table being collected
for (var i = 0; i < lines.length; i++) {
var raw = lines[i];
var line = raw.replace(/(^|\s)#(?![^"']*["'][^"']*$).*$/, '').trim();
if (pending) {
pending.raw += ' ' + line;
if (balanced(pending.raw)) { store(pending.table, pending.key, pending.raw, pending.line); pending = null; }
continue;
}
if (!line) continue;
var th = line.match(/^\[\[?([^\]]+)\]\]?/);
if (th) { table = th[1].trim(); if (order.indexOf(table) < 0) order.push(table); if (!tables[table]) tables[table] = { __line: i + 1 }; continue; }
var kv = line.match(/^["']?([A-Za-z0-9_.-]+)["']?\s*=\s*(.*)$/);
if (!kv) continue;
if (!balanced(kv[2])) { pending = { table: table, key: kv[1], raw: kv[2], line: i + 1 }; continue; }
store(table, kv[1], kv[2], i + 1);
}
function store(t, k, v, ln) { if (!tables[t]) { tables[t] = { __line: ln }; if (order.indexOf(t) < 0) order.push(t); } tables[t][k] = { raw: String(v).trim(), line: ln }; }
function balanced(s) {
var d = 0, q = null;
for (var j = 0; j < s.length; j++) {
var c = s[j];
if (q) { if (c === q) q = null; continue; }
if (c === '"' || c === "'") { q = c; continue; }
if (c === '[' || c === '{') d++;
if (c === ']' || c === '}') d--;
}
return d <= 0 && !q;
}
return { tables: tables, order: order, lines: lines };
}
function get(doc, table, key) { var t = doc.tables[table]; return (t && t[key]) ? t[key] : null; }
function strval(cell) { if (!cell) return null; var m = cell.raw.match(/^["'](.*)["']\s*,?$/); return m ? m[1] : null; }
function arrval(cell) {
if (!cell) return [];
var out = [], re = /["']([^"']*)["']/g, m;
while ((m = re.exec(cell.raw))) out.push(m[1]);
return out;
}
function isTable(cell) { return !!cell && /^\{/.test(cell.raw); }
// ">=3.9,<4" -> {floor:"3.9", cap:"4"}
function pyBounds(spec) {
var floor = null, cap = null;
var re = /(>=|>|~=|==|<=|<)\s*([0-9]+(?:\.[0-9]+)?)/g, m;
while ((m = re.exec(spec))) {
var op = m[1], v = m[2];
if (op === '>=' || op === '~=' || op === '==') { if (!floor || verKey(v) < verKey(floor)) floor = v; }
else if (op === '>') { var bumped = bumpMinor(v); if (!floor || verKey(bumped) < verKey(floor)) floor = bumped; }
else if (op === '<' || op === '<=') { if (!cap || verKey(v) > verKey(cap)) cap = v; }
}
return { floor: floor, cap: cap, capOp: /<=?/.test(spec) ? (spec.indexOf('<=') >= 0 ? '<=' : '<') : null };
}
function bumpMinor(v) { var p = String(v).split('.'); return p[0] + '.' + ((parseInt(p[1], 10) || 0) + 1); }
function pinnedSetuptools(reqs) {
for (var i = 0; i < reqs.length; i++) {
var m = reqs[i].match(/^\s*setuptools\s*(?:\[[^\]]*\])?\s*(.*)$/i);
if (!m) continue;
var sp = m[1] || '';
var lo = sp.match(/>=\s*([0-9][0-9.]*)/);
var eq = sp.match(/==\s*([0-9][0-9.]*)/);
var cap = sp.match(/<\s*([0-9][0-9.]*)/);
return { spec: reqs[i].trim(), lo: lo ? lo[1] : (eq ? eq[1] : null), cap: cap ? cap[1] : null, any: !sp.trim() };
}
return null;
}
function major(v) { return parseInt(String(v).split('.')[0], 10) || 0; }
function check(text, opts) {
opts = opts || {};
var today = /^\d{4}-\d{2}-\d{2}$/.test(String(opts.today || '')) ? opts.today : new Date().toISOString().slice(0, 10);
var doc = parse(text);
var F = [];
function add(id, msg, line) { var r = byId(id); F.push({ check: id, sev: r.sev, msg: msg + (r.fix ? ' → ' + r.fix : ''), line: line || 1, spec: r.spec || '' }); }
var proj = doc.tables['project'];
if (!proj) {
add('project_table_missing', 'This pyproject.toml has no [project] table, so the build back end takes its metadata from somewhere else (setup.py, setup.cfg) and nothing here is authoritative.', 1);
return { findings: F, today: today, rule_count: RULES.length };
}
// --- build-system -------------------------------------------------------
var bs = doc.tables['build-system'];
var bsReq = get(doc, 'build-system', 'requires');
if (!bs || !bsReq) add('build_system_missing', 'No [build-system] requires, so pip guesses a legacy setuptools build and your wheel metadata depends on whatever setuptools the machine happens to have.', bs ? bs.__line : 1);
// --- requires-python ----------------------------------------------------
var rpCell = get(doc, 'project', 'requires-python');
var rp = strval(rpCell);
var floorRec = recommendFloor(today);
var bounds = rp ? pyBounds(rp) : { floor: null, cap: null };
if (!rp) {
add('requires_python_missing', 'No requires-python, so pip will install this on interpreters you have never tested, including ones past end of life.', proj.__line);
} else {
if (bounds.floor && EOL[bounds.floor]) {
var d = days(EOL[bounds.floor], today);
if (d > 0) add('requires_python_eol', 'requires-python = "' + rp + '" still promises Python ' + bounds.floor + ', whose upstream security support ended ' + EOL[bounds.floor] + ' — ' + d + ' days before ' + today + '. The lowest floor with a year of support left is ' + floorRec + '.', rpCell.line);
else if (-d <= 365) add('requires_python_eol_soon', 'requires-python = "' + rp + '" floors at Python ' + bounds.floor + ', which reaches end of life ' + EOL[bounds.floor] + ' — ' + (-d) + ' days after ' + today + '.', rpCell.line);
}
if (bounds.cap) add('requires_python_upper_cap', 'requires-python = "' + rp + '" caps the interpreter at ' + bounds.cap + '. On the next Python release, resolvers will silently pick an older version of your package, or none.', rpCell.line);
}
// --- classifiers --------------------------------------------------------
var clsCell = get(doc, 'project', 'classifiers');
var cls = arrval(clsCell);
var licClassifiers = [];
for (var i = 0; i < cls.length; i++) {
var c = cls[i];
var pv = c.match(/^Programming Language :: Python :: ([0-9]+\.[0-9]+)$/);
if (pv) {
var v = pv[1];
if (EOL[v] && days(EOL[v], today) > 0) add('classifier_python_eol', 'Classifier "' + c + '" tells PyPI you support Python ' + v + ', which went end of life ' + EOL[v] + '.', clsCell.line);
if (bounds.floor && verKey(v) < verKey(bounds.floor)) add('classifier_python_mismatch', 'Classifier "' + c + '" advertises Python ' + v + ' but requires-python = "' + rp + '" refuses it, so pip and your PyPI page disagree.', clsCell.line);
}
if (/^License :: /.test(c)) licClassifiers.push(c);
}
if (!clsCell) { /* classifiers are optional; no rule fires */ }
// --- licence (PEP 639) ---------------------------------------------------
var licCell = get(doc, 'project', 'license');
var licStr = strval(licCell);
var lfCell = get(doc, 'project', 'license-files');
if (isTable(licCell)) {
var kind = /file\s*=/.test(licCell.raw) ? 'file' : 'text';
add('license_table_deprecated', 'license = { ' + kind + ' = ... } is the pre-PEP-639 form. setuptools ' + SETUPTOOLS_MIN + ' and later deprecate it, and the wheel it produces carries no SPDX expression for tools to read.', licCell.line);
}
if (licClassifiers.length) {
if (licStr) add('license_classifier_conflict', 'Both license = "' + licStr + '" and ' + licClassifiers.length + ' License :: classifier' + (licClassifiers.length === 1 ? '' : 's') + ' ("' + licClassifiers[0] + '") are present. Under PEP 639 setuptools refuses that combination and the build stops.', clsCell.line);
else add('license_classifier_deprecated', licClassifiers.length + ' License :: classifier' + (licClassifiers.length === 1 ? '' : 's') + ' ("' + licClassifiers[0] + '") carry the licence. PEP 639 deprecates them in favour of an SPDX expression.', clsCell.line);
}
if (licStr) {
var expr = licStr.trim();
if (/(^|\s)(and|or|with)(\s|$)/.test(expr)) add('spdx_operator_case', 'license = "' + expr + '" uses a lower-case operator. SPDX expressions only accept AND, OR and WITH in upper case, so this expression does not parse.', licCell.line);
var atoms = expr.replace(/[()]/g, ' ').split(/\s+(?:AND|OR|WITH|and|or|with)\s+/);
for (var a = 0; a < atoms.length; a++) {
var at = atoms[a].trim().replace(/\+$/, '');
if (!at) continue;
var fixKey = SPDX_FIX[at] ? at : (SPDX_FIX[at.toUpperCase()] ? at.toUpperCase() : null);
if (fixKey) add('license_expression_not_spdx', 'license = "' + expr + '" uses "' + at + '", which is not a current SPDX identifier. Use ' + SPDX_FIX[fixKey] + '.', licCell.line);
else if (SPDX_KNOWN.indexOf(at) < 0 && !/^LicenseRef-[A-Za-z0-9.-]+$/.test(at)) add('license_expression_not_spdx', 'license = "' + expr + '" contains "' + at + '", which is not on the SPDX licence list, so PyPI cannot validate the expression.', licCell.line);
}
}
var lf = arrval(lfCell);
for (var k = 0; k < lf.length; k++) {
if (/^[\\/]/.test(lf[k]) || lf[k].indexOf('..') >= 0 || /^[A-Za-z]:/.test(lf[k])) add('license_files_invalid_pattern', 'license-files entry "' + lf[k] + '" is not a relative glob inside the project. PEP 639 rejects absolute paths and parent traversal.', lfCell.line);
}
if (licStr && bsReq) {
var st = pinnedSetuptools(arrval(bsReq));
if (st && (st.any || (st.lo && major(st.lo) < major(SETUPTOOLS_MIN)) || (st.cap && major(st.cap) <= major(SETUPTOOLS_MIN)))) {
add('setuptools_too_old_for_spdx', 'license = "' + licStr + '" needs setuptools ' + SETUPTOOLS_MIN + '+, but [build-system] requires says "' + st.spec + '". A fresh build box can resolve an older setuptools that drops the field.', bsReq.line);
}
}
// --- dynamic vs static ---------------------------------------------------
var dynCell = get(doc, 'project', 'dynamic');
var dyn = arrval(dynCell);
for (var y = 0; y < dyn.length; y++) {
var f = dyn[y];
if (get(doc, 'project', f)) add('dynamic_version_conflict', '"' + f + '" is listed in dynamic and also set statically on line ' + get(doc, 'project', f).line + '. PEP 621 makes that a hard build error.', dynCell.line);
}
// --- name, readme, urls ---------------------------------------------------
var nameCell = get(doc, 'project', 'name');
var name = strval(nameCell);
if (name) {
var norm = name.toLowerCase().replace(/[-_.]+/g, '-');
if (norm !== name) add('project_name_not_normalized', 'name = "' + name + '" normalises to "' + norm + '" on PyPI, so the page, the install command and your docs can all disagree.', nameCell.line);
}
if (!get(doc, 'project', 'readme')) add('readme_missing', 'No readme, so the project page on PyPI opens with an empty description.', proj.__line);
if (!doc.tables['project.urls']) add('urls_missing', 'No [project.urls], so the PyPI sidebar has no Source, Issues or Changelog link.', proj.__line);
F.sort(function (p, q) { return (p.line || 0) - (q.line || 0); });
return { findings: F, today: today, rule_count: RULES.length };
}
var PJENGINE = { engine: { check: check }, RULES: RULES, RULE_COUNT: RULES.length, parse: parse };
if (typeof module !== 'undefined' && module.exports) module.exports = PJENGINE;
else window.PJENGINE = PJENGINE;
</script>
<script>// ⛔뼈대 — kit/scaffold.py 가 찍는다 (s143). findings [{check,sev,msg,line?}] → 글/HTML. 같은 파일이 Node 와 브라우저에서 산다.
'use strict';
function escapeHtml(s) { return String(s == null ? '' : s).replace(/&/g, '&').replace(/</g, '<').replace(/>/g, '>').replace(/"/g, '"'); }
function summaryLine(res) {
const f = (res && res.findings) || []; const e = f.filter(function (x) { return String(x.sev || 'error').toLowerCase().startsWith('err'); }).length;
return f.length ? (f.length + ' finding' + (f.length === 1 ? '' : 's') + ' (' + e + ' error' + (e === 1 ? '' : 's') + ')') : 'Clean — no findings.';
}
function toText(res, label) {
const f = (res && res.findings) || [];
const lines = ['== ' + (label || '') + ' — ' + summaryLine(res)];
f.forEach(function (x) { lines.push(' ' + String(x.sev || 'error').toUpperCase().slice(0, 4) + ' ' + (x.line ? 'L' + x.line + ' ' : '') + (x.check || x.id || '') + ' ' + (x.msg || x.message || '')); });
return lines.join('\n');
}
function toHtml(res) {
const f = (res && res.findings) || [];
if (!f.length) return '<p class="ok">' + escapeHtml(summaryLine(res)) + '</p>';
const rows = f.map(function (x) { return '<tr><td class="sev ' + escapeHtml(String(x.sev || 'error')) + '">' + escapeHtml(String(x.sev || 'error')) + '</td><td>' + (x.line ? 'L' + escapeHtml(x.line) : '') + '</td><td><code>' + escapeHtml(x.check || x.id || '') + '</code></td><td>' + escapeHtml(x.msg || x.message || '') + '</td></tr>'; }).join('');
return '<p class="sum">' + escapeHtml(summaryLine(res)) + '</p><table><thead><tr><th>Level</th><th>Line</th><th>Check</th><th>What</th></tr></thead><tbody>' + rows + '</tbody></table>';
}
var PJREPORT = { escapeHtml: escapeHtml, summaryLine: summaryLine, toText: toText, toHtml: toHtml };
if (typeof module !== 'undefined' && module.exports) module.exports = PJREPORT;
else window.PJREPORT = PJREPORT;
</script>
<script>
(function(){
var src=document.getElementById('src'), out=document.getElementById('out'), go=document.getElementById('go'), today=document.getElementById('today');
today.value=new Date().toISOString().slice(0,10);
function run(){ try { var res=window.PJENGINE.engine.check(src.value,{today:today.value}); out.innerHTML=window.PJREPORT.toHtml(res); } catch(e){ out.innerHTML='<p class="sev error">Could not run: '+String(e.message||e)+'</p>'; } }
go.onclick=run; if (src.value.trim()) run();
})();
</script>
<section data-yj-install="free" style="margin:2rem auto 1rem;max-width:46rem;padding:1.25rem 1.25rem;border:1px solid #cfe3d6;border-radius:12px;background:#f6fbf8;font:16px/1.6 system-ui,-apple-system,Segoe UI,sans-serif"><h2 style="margin:0 0 .4rem;font-size:1.2rem">Install free</h2><p style="margin:0 0 .8rem;color:#41505f">Free for the file open in your editor - no key, no limit. The workspace sweep and the report ask for a key.</p><a href="https://marketplace.visualstudio.com/items?itemName=ReadyStack.pyproject-release-gate" rel="noopener" data-yj-install-door="mp" onclick="try{navigator.sendBeacon('/api/ev',new Blob([JSON.stringify({t:'install',slug:'pyproject-release-gate',src:'mp',path:location.pathname})],{type:'application/json'}))}catch(e){}" style="display:inline-block;margin:0 .5rem .5rem 0;padding:.6rem 1rem;border-radius:8px;background:#0f7b3f;color:#fff;text-decoration:none;font-weight:600">VS Code Marketplace</a><a href="https://open-vsx.org/extension/readystack/pyproject-release-gate" rel="noopener" data-yj-install-door="ovsx" onclick="try{navigator.sendBeacon('/api/ev',new Blob([JSON.stringify({t:'install',slug:'pyproject-release-gate',src:'ovsx',path:location.pathname})],{type:'application/json'}))}catch(e){}" style="display:inline-block;margin:0 .5rem .5rem 0;padding:.6rem 1rem;border-radius:8px;background:#0f7b3f;color:#fff;text-decoration:none;font-weight:600">Open VSX (Cursor, VSCodium)</a><a href="https://www.npmjs.com/package/@readystack/pyproject-release-gate" rel="noopener" data-yj-install-door="npm" onclick="try{navigator.sendBeacon('/api/ev',new Blob([JSON.stringify({t:'install',slug:'pyproject-release-gate',src:'npm',path:location.pathname})],{type:'application/json'}))}catch(e){}" style="display:inline-block;margin:0 .5rem .5rem 0;padding:.6rem 1rem;border-radius:8px;background:#0f7b3f;color:#fff;text-decoration:none;font-weight:600">npm</a><a href="https://www.npmjs.com/package/@readystack/pyproject-release-gate" rel="noopener" data-yj-install-door="mcp" onclick="try{navigator.sendBeacon('/api/ev',new Blob([JSON.stringify({t:'install',slug:'pyproject-release-gate',src:'mcp',path:location.pathname})],{type:'application/json'}))}catch(e){}" style="display:inline-block;margin:0 .5rem .5rem 0;padding:.6rem 1rem;border-radius:8px;background:#0f7b3f;color:#fff;text-decoration:none;font-weight:600">MCP server (npx)</a><a href="https://hub.docker.com/r/getreadystack/pyproject-release-gate" rel="noopener" data-yj-install-door="docker" onclick="try{navigator.sendBeacon('/api/ev',new Blob([JSON.stringify({t:'install',slug:'pyproject-release-gate',src:'docker',path:location.pathname})],{type:'application/json'}))}catch(e){}" style="display:inline-block;margin:0 .5rem .5rem 0;padding:.6rem 1rem;border-radius:8px;background:#0f7b3f;color:#fff;text-decoration:none;font-weight:600">Docker Hub</a><pre style="margin:.5rem 0 0;padding:.6rem .8rem;background:#f3f5f8;border-radius:8px;font-size:.9rem;overflow:auto">ext install ReadyStack.pyproject-release-gate
npx @readystack/pyproject-release-gate <file>
npx @readystack/pyproject-release-gate --mcp</pre><p style="margin:.6rem 0 0;font-size:.92rem;color:#41505f"><a href="https://getreadystack.com/api/buy/cl/polar_cl_l6iN1uWt0FwWu7tBsczD0jWpP2vxFM54Wdwqb3KPi1G" rel="nofollow" style="color:#0f7b3f;text-decoration:underline">Team? One key for every ReadyStack linter, 5 seats, $149 once</a></p></section>
<section data-yj-alert="rule" style="margin:1rem auto 1.5rem;max-width:46rem;padding:1.1rem 1.25rem;border:1px solid #d9dee6;border-radius:12px;background:#fbfcfd;font:15px/1.55 system-ui,-apple-system,Segoe UI,sans-serif"><b style="font-size:1.05rem">Get the full rule table as a PDF</b><div style="opacity:.78;margin:.35rem 0 .8rem">All 19 rules pyproject.toml Release Gate (PEP 639) checks, each with its source and date, on printable pages you can hand to your team or auditor. We email it now, and once more only if a rule changes. No newsletter.</div><div style="display:flex;gap:8px;flex-wrap:wrap"><input id="yjae" type="email" placeholder="you@example.com" style="flex:1;min-width:210px;padding:11px 13px;border:1px solid rgba(140,150,165,.34);border-radius:8px;background:#fff;color:inherit"><button id="yjab" style="padding:11px 18px;border-radius:8px;border:0;cursor:pointer;background:#0f7b3f;color:#fff;font:600 15px system-ui,sans-serif">Email me the PDF</button></div><div id="yjao" hidden style="margin-top:.6rem;color:#0f7b3f">Sent. It arrives within the hour - check spam too.</div><script>(function(){var b=document.getElementById("yjab"),e=document.getElementById("yjae");if(!b||!e)return;b.addEventListener("click",function(){var v=e.value.trim();if(!/.+@.+\..+/.test(v))return;try{localStorage.setItem("yj_em","1");}catch(_){}fetch(location.origin+"/api/subscribe",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({email:v,slug:"pyproject-release-gate",lang:"en",source:"rule_table"+((b.closest&&b.closest("section")&&b.closest("section").getAttribute("data-yj-moved"))?"_at_result":"")})}).then(function(r){var o=document.getElementById("yjao");o.hidden=false;if(!r.ok){o.textContent="Could not save - please try again.";}}).catch(function(){var o=document.getElementById("yjao");o.hidden=false;o.textContent="Could not save - please try again.";});});})();</script><script>(function(){var e=document.getElementById("yjae"),s=e&&e.closest?e.closest("section"):null,o=document.getElementById("out");if(!s||!o)return;var d=false;function mv(ev){if(d)return;if(ev&&ev.target&&s.contains(ev.target))return;d=true;var b=o;while(b.parentNode&&b.parentNode!==document.body&&b.parentNode.tagName!=="MAIN"&&b.parentNode.tagName!=="ARTICLE")b=b.parentNode;if(!b.parentNode||b===s||b.contains(s))return;try{b.parentNode.insertBefore(s,b.nextSibling);s.setAttribute("data-yj-moved","1");}catch(_){}}document.addEventListener("input",mv,true);document.addEventListener("change",mv,true);})();</script></section>
<section data-yj-cta="paid" style="margin:3rem auto;max-width:46rem;padding:1.5rem 1.25rem;border:1px solid #d8dee9;border-radius:12px;background:#fbfcfe;font:16px/1.6 system-ui,-apple-system,Segoe UI,sans-serif"><h2 style="margin:0 0 .5rem;font-size:1.25rem">Get the complete version <span class="yj-price">$29</span></h2><p style="margin:.25rem 0 1rem;color:#41505f">This page is the working piece. The full pack has everything below.</p><p style="margin:0 0 1rem;color:#41505f">19 date-aware checks on the [project] metadata that decides whether your next release uploads</p><p style="margin:0 0 1rem;color:#5b6b7c;font-size:.94rem">One hour of a senior Python developer's time costs more than the licence, in any market that publishes to PyPI — and without this the review has to happen by hand at every release.</p><a href="https://getreadystack.com/api/buy/cl/polar_cl_Dwv8rDHzgqaWnEsVKKqSDvaTApy7kMa9XNhx70ttYbL" rel="nofollow" style="display:inline-block;padding:.7rem 1.3rem;border-radius:8px;background:#1b64f2;color:#fff;text-decoration:none;font-weight:600">Buy the full version — $29</a></section>
<!--yj-share-s101--><div style="margin:28px 0 8px;text-align:center"><button id="yjcp" type="button" style="font:inherit;padding:10px 18px;border:1px solid #8884;border-radius:10px;background:transparent;cursor:pointer">Copy link</button><button id="yjimg" type="button" style="font:inherit;padding:10px 18px;margin-left:8px;border:1px solid #8884;border-radius:10px;background:transparent;cursor:pointer">Save result as image</button></div><script>(function(){var b=document.getElementById("yjimg");if(!b)return;b.addEventListener("click",function(){var o=document.getElementById("out");var txt=(o&&(o.innerText||o.textContent)||"").trim();if(!txt){b.textContent="(no result yet)";setTimeout(function(){b.textContent="Save result as image";},1500);return;}var lines=txt.split(String.fromCharCode(10)).filter(function(x){return x.trim();}).slice(0,10);var W=1200,P=56,c=document.createElement("canvas");c.width=W;var lh=38,H=P*2+70+lines.length*lh+60;c.height=H;var x=c.getContext("2d");x.fillStyle="#1a1512";x.fillRect(0,0,W,H);x.fillStyle="#f3e9d2";x.font="600 34px system-ui,Segoe UI,Arial";var t=(document.title||"").split("|")[0].trim();x.fillText(t.slice(0,54),P,P+34);x.font="22px ui-monospace,Menlo,Consolas,monospace";x.fillStyle="#e8dcc4";for(var i=0;i<lines.length;i++){x.fillText(lines[i].slice(0,88),P,P+70+i*lh+22);}x.font="600 22px system-ui,Segoe UI,Arial";x.fillStyle="#c9a227";var d=location.hostname.replace("www.","");x.fillText(d,W-P-x.measureText(d).width,H-P+6);c.toBlob(function(bl){var u=URL.createObjectURL(bl),a=document.createElement("a");a.href=u;a.download=(t||"result").replace(/[^a-z0-9]+/gi,"-").toLowerCase()+"-"+d+".png";document.body.appendChild(a);a.click();setTimeout(function(){URL.revokeObjectURL(u);a.remove();},2000);},"image/png");});})();</script><script>(function(){var b=document.getElementById("yjcp");if(!b)return;var t=b.textContent;b.addEventListener("click",function(){var u=location.href.split("#")[0];function d(){b.textContent="Link copied";setTimeout(function(){b.textContent=t;},1800);}if(navigator.clipboard&&navigator.clipboard.writeText){navigator.clipboard.writeText(u).then(d,function(){prompt("",u);});}else{prompt("",u);}});})();</script><div class="yj-home-find"><div class="yj-lgbar"><a href="/" class="yj-lg on">EN</a><a href="/de/" class="yj-lg">DE</a><a href="/ja/" class="yj-lg">JA</a><a href="/es/" class="yj-lg">ES</a><a href="/pt/" class="yj-lg">PT</a></div><section class="yj-find"><h2>Find a tool</h2><input id="yjq" type="search" autocomplete="off" placeholder="Type a product name, format or task"><div id="yjr"></div></section><style>.yj-lgbar{position:absolute;top:14px;right:18px;display:flex;gap:6px;z-index:60}.yj-lg{font:600 12px/1 system-ui,sans-serif;padding:6px 9px;border-radius:4px;text-decoration:none;color:#8b96a3;border:1px solid rgba(140,150,165,.28)}.yj-lg:hover{color:#e8eaed;border-color:rgba(160,175,195,.6)}.yj-lg.on{color:#0e1116;background:#cfd6de;border-color:#cfd6de}.yj-find{max-width:760px;margin:34px auto 8px;padding:0 20px}.yj-find h2{font:600 20px/1.3 system-ui,sans-serif;margin:0 0 10px}#yjq{width:100%;box-sizing:border-box;padding:13px 15px;font:400 15.5px system-ui,sans-serif;border:1px solid rgba(140,150,165,.34);border-radius:8px;background:rgba(255,255,255,.04);color:inherit}#yjq:focus{outline:none;border-color:#7FD1C4}#yjr{margin-top:10px;display:flex;flex-direction:column;gap:6px}#yjr a{display:flex;justify-content:space-between;gap:12px;padding:11px 14px;border:1px solid rgba(140,150,165,.22);border-radius:6px;text-decoration:none;font:400 14.5px/1.4 system-ui,sans-serif;color:inherit}#yjr a:hover{border-color:#7FD1C4}#yjr .pr{font:600 13px system-ui,sans-serif;color:#5fbf9a;white-space:nowrap}</style><script>(function(){var q=document.getElementById("yjq"),r=document.getElementById("yjr"),D=null;function load(){if(D)return Promise.resolve(D);return fetch("/search-index.json").then(function(x){return x.json();}).then(function(j){D=j;return j;}).catch(function(){D=[];return D;});}function esc(t){return String(t).replace(/[&<>"]/g,function(c){return {"&":"&","<":"<",">":">",'"':"""}[c];});}function run(){var v=q.value.trim().toLowerCase();if(v.length<2){r.innerHTML="";return;}load().then(function(j){var w=v.split(/\s+/),o=[];for(var i=0;i<j.length&&o.length<12;i++){var t=j[i].t.toLowerCase();var ok=true;for(var k=0;k<w.length;k++){if(t.indexOf(w[k])<0){ok=false;break;}}if(ok)o.push(j[i]);}r.innerHTML=o.length?o.map(function(x){return "<a href=\""+esc(x.u)+"\">"+"<span>"+esc(x.t)+"</span>"+(x.p?"<span class=\"pr\">$"+x.p+"</span>":"")+"</a>";}).join(""):"";});}q.addEventListener("input",run);q.addEventListener("focus",load);})();</script></div>
<script data-yj="yj-view-beacon">(function(){try{var p=location.pathname;var k='yjv:'+p;if(sessionStorage.getItem(k))return;sessionStorage.setItem(k,'1');fetch('/api/ev',{method:'POST',keepalive:true,headers:{'Content-Type':'application/json'},body:JSON.stringify({path:p,lang:"en",ref:(document.referrer||''),src:(function(){try{return (new URLSearchParams(location.search).get('ref')||'').replace(/[^a-z_]/g,'').slice(0,12)}catch(e){return ''}})()})}).catch(function(){});}catch(e){}})();</script>
<script data-yj="yj-use-beacon">(function(){try{var o=document.getElementById('out');if(!o)return;var p=location.pathname,k='yju:'+p,sent=false;function fire(){if(sent||sessionStorage.getItem(k))return;if(!(o.textContent||'').replace(/\s+/g,'').length)return;sent=true;sessionStorage.setItem(k,'1');fetch('/api/ev',{method:'POST',keepalive:true,headers:{'Content-Type':'application/json'},body:JSON.stringify({path:p,lang:"en",t:'use',src:(function(){try{return (new URLSearchParams(location.search).get('ref')||'').replace(/[^a-z_]/g,'').slice(0,12)}catch(e){return ''}})()})}).catch(function(){});}var mo=new MutationObserver(function(){fire();if(sent)mo.disconnect();});mo.observe(o,{childList:true,characterData:true,subtree:true});}catch(e){}})();</script>
<section data-yj="yj-facts-v1" style="max-width:920px;margin:48px auto 0;padding:0 20px;font-family:system-ui,sans-serif"><style>.yj-article p{font:400 15.5px/1.7 system-ui,sans-serif;color:#26313b;margin:0 0 12px;max-width:72ch}.yj-article h2,.yj-article h3,.yj-article h4{font:600 17px/1.35 system-ui,sans-serif;color:#1b1f24;margin:22px 0 8px}.yj-article table{border-collapse:collapse;margin:10px 0 16px;font:14px/1.45 system-ui,sans-serif}.yj-article th,.yj-article td{border:1px solid #e2e6ea;padding:6px 10px;text-align:left}.yj-article th{background:#f4f6f8}.yj-article pre{background:#0f1720;color:#e6edf3;padding:12px 14px;border-radius:8px;overflow:auto;font:13px/1.5 ui-monospace,Menlo,monospace}.yj-article code{font:13px ui-monospace,Menlo,monospace;background:#f1f3f5;padding:1px 4px;border-radius:3px}.yj-article pre code{background:none;padding:0}.yj-article ul,.yj-article ol{font:15px/1.6 system-ui,sans-serif;color:#26313b}</style><p style="font:400 13px/1.5 system-ui,sans-serif;color:#6b7680;margin:0 0 14px"><time datetime="2026-09-12">Updated 2026-09-12</time> · ReadyStack</p><script type="application/ld+json">{"@context":"https://schema.org","@type":"WebPage","dateModified":"2026-09-12","author":{"@type":"Organization","name":"ReadyStack"}}</script><h2 style="font:600 21px/1.3 system-ui,sans-serif;margin:0 0 6px;color:#1b1f24">Worked example</h2><p style="font:400 14.5px/1.5 system-ui,sans-serif;margin:0 0 16px;color:#5b6570">Real numbers from this tool, line by line.</p><div class="yj-article"><p><img src="https://getreadystack.com/img/promo/sku37307_result_card.jpg" alt="pyproject.toml Release Gate (PEP 639)" loading="lazy" style="max-width:100%;border-radius:6px"></p>
<p>Eight of the fourteen findings in one 26-line pyproject.toml are errors, and the maintainer who wrote it is a Python library author publishing wheels to PyPI from GitHub Actions. Nothing in it is a typo. Every line was correct when it was written.</p>
<p>Packaging metadata goes stale on a calendar, and neither your tests nor your build tools read a calendar.</p>
<p>The manifest, abbreviated:</p>
<p>[build-system] requires = ["setuptools>=61.0", "wheel"]</p>
<p>[project] version = "1.4.0" requires-python = ">=3.8,<4" license = "Apache 2.0" license-files = ["/usr/share/licenses/invoice-toolkit/LICENSE", "../COPYING"] dynamic = ["version"] classifiers = [ "Programming Language :: Python :: 3.7", "License :: OSI Approved :: Apache Software License", ]</p>
<p>Run it through the 19 checks in pyproject.toml Release Gate with today set to 2026-09-11 and you get fourteen findings: eight errors, five warnings, one note.</p>
<p>The licence block accounts for five. PEP 639 replaced the old <code>license = { text = "MIT" }</code> table and the <code>License :: OSI Approved :: ...</code> classifiers with one SPDX expression plus a <code>license-files</code> list, and setuptools implements that from 77.0.0. So <code>license = "Apache 2.0"</code> is not an SPDX identifier — the identifier is <code>Apache-2.0</code>. The <code>License ::</code> classifier sitting next to an SPDX expression is not a warning; that combination is refused and the build stops. Both <code>license-files</code> entries are rejected too, because PEP 639 accepts only relative globs inside the project, so an absolute path and a <code>../</code> escape are out. And <code>setuptools>=61.0</code> is loose enough that a fresh build box can resolve a setuptools that does not know the <code>license</code> field exists — which is how one repo builds correctly on a laptop and wrong in CI.</p>
<p>Then the interpreter. <code>requires-python = ">=3.8,<4"</code> promises Python 3.8, whose upstream security support ended 2024-10-07 — 704 days before the date above. The <code>Python :: 3.7</code> classifier advertises a version the same file's <code>requires-python</code> refuses, so pip and your project page disagree in public. The <code><4</code> cap is its own failure: on the next Python release, resolvers skip your package.</p>
<p>The last error is structural. <code>version = "1.4.0"</code> is static while <code>version</code> is also listed in <code>dynamic</code>. PEP 621 makes that a hard build error, not a preference.</p>
<p>The surprise: <code>python -m build</code> and <code>twine check</code> pass a manifest whose interpreter floor died two years ago, because staleness is not a syntax error. Asking an assistant is worse, because it answers from pre-PEP-639 documentation and has no reliable idea what today's date is — it hands back the same licence table and the same <code>>=3.8</code> floor that caused the problem.</p>
<p>The date matters more than it looks. Take an otherwise clean manifest floored at <code>requires-python = ">=3.10"</code>. On 2026-09-11 that is one warning: Python 3.10 reaches end of life 2026-10-31, fifty days out, so you bump the floor on your own schedule. On 2026-11-15 the same unchanged file is one error. The file did not move. The calendar did.</p>
<p>Finding out late has a price: a version number on PyPI cannot be re-used, so a bad release costs you a version, a changelog entry and an explanation.</p>
<p>The free tier finishes one job completely: all 19 checks on the file open in your editor, with the line, the spec that moved and the replacement text, plus the same engine as a browser page that uploads nothing. The licence changes scope and ownership rather than depth: every pyproject.toml in a monorepo in one pass, written to a dated report file that stays in the repo and goes into the pull request.</p></div><h2 style="font:600 19px/1.3 system-ui,sans-serif;margin:30px 0 10px;color:#1b1f24">15 seconds — what it actually does</h2><video controls muted playsinline preload="none" poster="/img/promo/sku37307_result_card.jpg" style="width:100%;max-width:360px;border-radius:10px;display:block;margin:0 auto"><source src="/media/sku37307_short.mp4" type="video/mp4"></video><h2 style="font:600 21px/1.3 system-ui,sans-serif;margin:34px 0 6px;color:#1b1f24">Questions people ask</h2><details style="border-bottom:1px solid #e6e9ed;padding:10px 0"><summary style="cursor:pointer;font:600 15px/1.4 system-ui,sans-serif;color:#1b1f24">What does pyproject.toml Release Gate actually do?</summary><p style="margin:8px 0 2px;font:400 14.5px/1.6 system-ui,sans-serif;color:#33404b">It reads the [project] and [build-system] tables of a pyproject.toml and reports 19 kinds of metadata that break a release: an interpreter floor past end of life, PEP 639 licence drift, classifiers that contradict requires-python, a setuptools pin too old to read the SPDX license field, and fields that are both static and dynamic. Each finding carries the line, the spec and the replacement text.</p></details><details style="border-bottom:1px solid #e6e9ed;padding:10px 0"><summary style="cursor:pointer;font:600 15px/1.4 system-ui,sans-serif;color:#1b1f24">Who is this for?</summary><p style="margin:8px 0 2px;font:400 14.5px/1.6 system-ui,sans-serif;color:#33404b">Python library maintainers who publish wheels to PyPI from GitHub Actions, and platform engineers who own a monorepo with dozens of pyproject.toml files written by different people in different years. If you tag releases and a failed upload costs you a version number, the checks apply to you.</p></details><details style="border-bottom:1px solid #e6e9ed;padding:10px 0"><summary style="cursor:pointer;font:600 15px/1.4 system-ui,sans-serif;color:#1b1f24">Why is a free tool or a chatbot not enough?</summary><p style="margin:8px 0 2px;font:400 14.5px/1.6 system-ui,sans-serif;color:#33404b">twine check, build and pip all accept a manifest whose interpreter floor died two years ago, because staleness is a calendar fact rather than a syntax error. A chatbot answers from pre-PEP-639 training data and has no reliable sense of today's date, so it returns the same license table and requires-python floor that caused the failure.</p></details><details style="border-bottom:1px solid #e6e9ed;padding:10px 0"><summary style="cursor:pointer;font:600 15px/1.4 system-ui,sans-serif;color:#1b1f24">What is free and what needs a licence?</summary><p style="margin:8px 0 2px;font:400 14.5px/1.6 system-ui,sans-serif;color:#33404b">Free covers one file completely: all 19 checks on the pyproject.toml open in your editor, with line numbers and replacement text, plus the same engine as a browser page. The licence changes scope and ownership, not depth — every manifest in the workspace in one pass, written to a dated report file you keep in the repo.</p></details><details style="border-bottom:1px solid #e6e9ed;padding:10px 0"><summary style="cursor:pointer;font:600 15px/1.4 system-ui,sans-serif;color:#1b1f24">What would this cost without the extension?</summary><p style="margin:8px 0 2px;font:400 14.5px/1.6 system-ui,sans-serif;color:#33404b">You would read PEP 621, PEP 639 and the CPython release cycle yourself, once per release, for every manifest. One hour of a senior Python developer's time costs more than the licence in any market that publishes to PyPI, and a re-used version number cannot be re-uploaded once a bad wheel lands.</p></details><details style="border-bottom:1px solid #e6e9ed;padding:10px 0"><summary style="cursor:pointer;font:600 15px/1.4 system-ui,sans-serif;color:#1b1f24">Why not just ask ChatGPT or another AI chat?</summary><p style="margin:8px 0 2px;font:400 14.5px/1.6 system-ui,sans-serif;color:#33404b">A general AI chat answers from training data with a cutoff date, cannot read your repository and names no rule version. pyproject.toml Release Gate (PEP 639) checks the file you open against 19 rules from a rule set dated 2026-09-20, and points at the exact line with the fix. For a filing, an audit or a client you need that dated result on your own files.</p></details><script type="application/ld+json" data-yj="yj-faq-ld">{"@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [{"@type": "Question", "name": "What does pyproject.toml Release Gate actually do?", "acceptedAnswer": {"@type": "Answer", "text": "It reads the [project] and [build-system] tables of a pyproject.toml and reports 19 kinds of metadata that break a release: an interpreter floor past end of life, PEP 639 licence drift, classifiers that contradict requires-python, a setuptools pin too old to read the SPDX license field, and fields that are both static and dynamic. Each finding carries the line, the spec and the replacement text."}}, {"@type": "Question", "name": "Who is this for?", "acceptedAnswer": {"@type": "Answer", "text": "Python library maintainers who publish wheels to PyPI from GitHub Actions, and platform engineers who own a monorepo with dozens of pyproject.toml files written by different people in different years. If you tag releases and a failed upload costs you a version number, the checks apply to you."}}, {"@type": "Question", "name": "Why is a free tool or a chatbot not enough?", "acceptedAnswer": {"@type": "Answer", "text": "twine check, build and pip all accept a manifest whose interpreter floor died two years ago, because staleness is a calendar fact rather than a syntax error. A chatbot answers from pre-PEP-639 training data and has no reliable sense of today's date, so it returns the same license table and requires-python floor that caused the failure."}}, {"@type": "Question", "name": "What is free and what needs a licence?", "acceptedAnswer": {"@type": "Answer", "text": "Free covers one file completely: all 19 checks on the pyproject.toml open in your editor, with line numbers and replacement text, plus the same engine as a browser page. The licence changes scope and ownership, not depth — every manifest in the workspace in one pass, written to a dated report file you keep in the repo."}}, {"@type": "Question", "name": "What would this cost without the extension?", "acceptedAnswer": {"@type": "Answer", "text": "You would read PEP 621, PEP 639 and the CPython release cycle yourself, once per release, for every manifest. One hour of a senior Python developer's time costs more than the licence in any market that publishes to PyPI, and a re-used version number cannot be re-uploaded once a bad wheel lands."}}, {"@type": "Question", "name": "Why not just ask ChatGPT or another AI chat?", "acceptedAnswer": {"@type": "Answer", "text": "A general AI chat answers from training data with a cutoff date, cannot read your repository and names no rule version. pyproject.toml Release Gate (PEP 639) checks the file you open against 19 rules from a rule set dated 2026-09-20, and points at the exact line with the fix. For a filing, an audit or a client you need that dated result on your own files."}}]}</script><div id="yj-ask" style="margin:36px 0 0;padding:18px 18px 16px;border:1px solid #e2e6ea;border-radius:10px;background:#fbfbfc"><h2 style="font:600 19px/1.3 system-ui,sans-serif;margin:0 0 4px;color:#1b1f24">Ask about this tool</h2><p style="font:400 13.5px/1.5 system-ui,sans-serif;margin:0 0 12px;color:#5b6570">One question, answered by the person who built it. Your email only if you want the answer sent.</p><form onsubmit="return yjAsk(event)" style="display:grid;gap:8px"><textarea name="question" required minlength="10" maxlength="2000" rows="3" placeholder="Your question" style="font:14px/1.5 system-ui,sans-serif;padding:10px;border:1px solid #cfd6dd;border-radius:6px"></textarea><div style="display:flex;gap:8px;flex-wrap:wrap"><input type="email" name="email" placeholder="Email (optional)" style="flex:1;min-width:200px;font:14px system-ui,sans-serif;padding:9px 10px;border:1px solid #cfd6dd;border-radius:6px"><button type="submit" style="font:600 14px system-ui,sans-serif;padding:9px 18px;border:0;border-radius:6px;background:#1b1f24;color:#fff;cursor:pointer">Send</button></div><p id="yj-ask-msg" style="font:13px system-ui,sans-serif;margin:2px 0 0;color:#0a6238;min-height:1em"></p></form><script>function yjAsk(e){e.preventDefault();var f=e.target,m=document.getElementById("yj-ask-msg");m.style.color="#0a6238";fetch(location.origin+"/api/ask",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({sku:37307,slug:"pyproject-release-gate",lang:"en",question:f.question.value,email:f.email.value,page:location.pathname})}).then(function(r){if(!r.ok)throw 0;m.textContent="Thanks \u2014 noted. Answers land on this page and, if you left an email, in your inbox.";f.question.value="";}).catch(function(){m.style.color="#a8551f";m.textContent="Could not send. Please try again in a minute.";});return false;}</script></div></section><section class="yj-related" style="max-width:920px;margin:56px auto 40px;padding:0 20px"><h2 style="font:600 21px/1.3 system-ui,sans-serif;margin:0 0 6px;color:#1b1f24">Same job, next tool</h2><p style="font:400 14.5px/1.5 system-ui,sans-serif;margin:0 0 20px;color:#5b6570">Free in the browser. The full version is a one-time licence.</p><div style="display:grid;grid-template-columns:repeat(auto-fill,minmax(250px,1fr));gap:14px"><a class="yj-rel-c" href="https://getreadystack.com/tools/cargo-publish-gate"><span class="yj-rel-t">Cargo.toml Publish Gate - crates.io</span><span class="yj-rel-p">$29</span></a><a class="yj-rel-c" href="https://getreadystack.com/tools/autohotkey-toml-devicetree-snippets"><span class="yj-rel-t">AutoHotkey v2, TOML and DeviceTree checks for VS Code</span><span class="yj-rel-p">$29</span></a><a class="yj-rel-c" href="https://getreadystack.com/tools/firmware-release-gate"><span class="yj-rel-t">Firmware Release Gate for sdkconfig and prj.conf</span><span class="yj-rel-p">$29</span></a><a class="yj-rel-c" href="https://getreadystack.com/tools/maven-central-publish-gate"><span class="yj-rel-t">Maven Central Publish Gate</span><span class="yj-rel-p">$29</span></a><a class="yj-rel-c" href="https://getreadystack.com/tools/renpy-release-gate"><span class="yj-rel-t">Ren'Py Release Gate</span><span class="yj-rel-p">$29</span></a><a class="yj-rel-c" href="https://getreadystack.com/tools/spdx-license-field-lint"><span class="yj-rel-t">SPDX License Field Lint for package.json, pyproject.toml and Cargo.toml</span><span class="yj-rel-p">$29</span></a></div><style>.yj-rel-c{display:flex;flex-direction:column;gap:8px;padding:15px 16px;border:1px solid #e2e6ea;border-radius:6px;text-decoration:none;background:#fff}.yj-rel-c:hover{border-color:#b9c2cb;background:#fafbfc}.yj-rel-t{font:500 14.5px/1.42 system-ui,sans-serif;color:#1b1f24}.yj-rel-p{font:600 13px system-ui,sans-serif;color:#0a6238}</style></section></body>
</html>
|