What changed, and why it matters
This commit is a routine maintenance change to the project's release pipeline. It swaps the Python packaging tool from Poetry to uv (a newer, faster Python package manager) and updates the matching documentation. There is no change to Core Lightning's actual node software, wallet logic, or network protocol, and no security bug is fixed or introduced in the diff.
No security action required. Reviewers may optionally verify that the new uv-based workflow succeeds on the next release and that package names/versions are still produced correctly.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff updates .github/workflows/pypi.yml to replace Poetry commands (poetry build, poetry publish) with equivalent uv build and uv publish commands, and updates environment-variable names from POETRY_PYPI_TOKEN_* to UV_PUBLISH_TOKEN. It also updates release-checklist.md to describe the new uv-based manual release steps. The workflow still uses the same repository secrets (TEST_PYPI_API_TOKEN, PYPI_API_TOKEN) and the same PyPI/TestPyPI publish URLs. No cryptographic, network, or permission changes are present.
Changed components
.github/workflows/pypi.ymldoc/contribute-to-core-lightning/release-checklist.mdInspect captured patch +13 / −21
diff --git a/.github/workflows/pypi.yml b/.github/workflows/pypi.yml
index 9e29e901..b96d3350 100644
--- a/.github/workflows/pypi.yml
+++ b/.github/workflows/pypi.yml
@@ -64,38 +64,30 @@ jobs:
with:
python-version: '3.10'
- - name: Install Poetry
- run: |
- curl -sSL https://install.python-poetry.org | python3 -
- echo "$HOME/.local/bin" >> $GITHUB_PATH
- echo "PATH=$HOME/.local/bin:$PATH"
+ - name: Install uv
+ uses: astral-sh/setup-uv@v5
- name: Publish distribution 📦 to Test PyPI
if: github.repository == 'ElementsProject/lightning' && steps.set-values.outputs.DISTLOCATION == 'test'
env:
- POETRY_PYPI_TOKEN_TESTPYPI: ${{ secrets.TEST_PYPI_API_TOKEN }}
+ UV_PUBLISH_TOKEN: ${{ secrets.TEST_PYPI_API_TOKEN }}
WORKDIR: ${{ matrix.WORKDIR }}
run: |
- echo "POETRY VERSION TEST: $(poetry --version)"
echo "Pyln VERSION: $VERSION"
- cd ${{ env.WORKDIR }}
- python3 -m pip config set global.timeout 150
- poetry config repositories.testpypi https://test.pypi.org/legacy/
- make upgrade-version NEW_VERSION=$VERSION
- poetry build --no-interaction
- poetry publish --repository testpypi --no-interaction --skip-existing
+ uv build --package ${{ matrix.PACKAGE }}
+ uv publish --package ${{ matrix.PACKAGE }} --publish-url https://test.pypi.org/legacy/ --skip-existing
- name: Publish distribution 📦 to PyPI
if: github.repository == 'ElementsProject/lightning' && steps.set-values.outputs.DISTLOCATION == 'prod'
env:
- POETRY_PYPI_TOKEN_PYPI: ${{ secrets.PYPI_API_TOKEN }}
+ UV_PUBLISH_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
WORKDIR: ${{ matrix.WORKDIR }}
run: |
- echo "POETRY VERSION PUBLISH: $(poetry --version)"
+ echo "UV VERSION PUBLISH: $(uv --version)"
cd ${{ env.WORKDIR }}
export VERSION=$(git describe --tags --abbrev=0)
echo "Pyln VERSION: $VERSION"
make upgrade-version NEW_VERSION=$VERSION
- python3 -m pip config set global.timeout 150
- poetry build --no-interaction
- poetry publish --no-interaction
+ cd /github/workspace
+ uv build --package ${{ matrix.PACKAGE }}
+ uv publish --package ${{ matrix.PACKAGE }}
diff --git a/doc/contribute-to-core-lightning/release-checklist.md b/doc/contribute-to-core-lightning/release-checklist.md
index 119df2aa..fd91889d 100644
--- a/doc/contribute-to-core-lightning/release-checklist.md
+++ b/doc/contribute-to-core-lightning/release-checklist.md
@@ -82,10 +82,10 @@ Here's a checklist for the release process.
4. Send your signatures from `release/SHA256SUMS.new` to release captain.
5. Or follow [link](https://docs.corelightning.org/docs/repro#verifying-a-reproducible-build) for manual verification instructions.
10. Append signatures shared by the team into the `SHA256SUMS.asc` file, verify with `gpg --verify SHA256SUMS.asc` and include the file in the draft release.
-11. The GitHub action `Publish Python 🐍 distributions 📦 to PyPI and TestPyPI` should upload the pyln modules to pypi.org. However, this can also be done manually by running `make pyln-release`. This process requires keys for each of the `pyln-client`, `pyln-proto`, and `pyln-testing` modules to be accessible to Poetry. You can configure the Python keyring library with a suitable backend to handle this, or alternatively, set the key as an environment variable and build and publish each pyln release independently:
- - `export POETRY_PYPI_TOKEN_PYPI=<pyln-client token>`
+11. The GitHub action `Publish Python 🐍 distributions 📦 to PyPI and TestPyPI` should upload the pyln modules to pypi.org. However, this can also be done manually by running `make pyln-release`. This process requires keys for each of the `pyln-client`, `pyln-proto`, and `pyln-testing` modules to be accessible to uv. You can set the key as an environment variable and build and publish each pyln release independently:
+ - `export UV_PUBLISH_TOKEN=<pyln-client token>`
- `make pyln-release-client`
- - ... repeat for each pyln package.
+ - ... repeat for each pyln package with the appropriate token.
12. Publish multi-arch Docker images (`elementsproject/lightningd:v${VERSION}` and `elementsproject/lightningd:latest`) to Docker Hub either using the GitHub action `Build and push multi-platform docker images` or by running the `tools/build-release.sh docker` script. Prior to building docker images by `tools/build-release.sh` script, ensure that `multiarch/qemu-user-static` setup is working on your system as described [here](https://docs.corelightning.org/docs/docker-images#setting-up-multiarchqemu-user-static).
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.