Skip to content

Add pip wrapper for clickhousectl via maturin#216

Open
sdairs wants to merge 1 commit into
mainfrom
pip-wrapper
Open

Add pip wrapper for clickhousectl via maturin#216
sdairs wants to merge 1 commit into
mainfrom
pip-wrapper

Conversation

@sdairs
Copy link
Copy Markdown
Collaborator

@sdairs sdairs commented May 24, 2026

Summary

  • Adds pypi/pyproject.toml (maturin, bindings = "bin") so the existing crates/clickhousectl binary can be published as a per-platform Python wheel — mirrors the existing npm wrapper, but using the zizmor / ruff / uv pattern instead of a postinstall downloader (pip doesn't have a clean postinstall hook).
  • Extends .github/workflows/release.yml with two jobs after publish-npm:
    • build-wheels: matrix builds 6 wheels (manylinux x86_64+aarch64, musllinux x86_64+aarch64, macOS x86_64+arm64) via PyO3/maturin-action@v1.51.0 (SHA-pinned).
    • publish-pypi: uploads via pypa/gh-action-pypi-publish@v1.14.0 (SHA-pinned) using OIDC trusted publishing — no API token secret needed.
  • Updates README.md with a ### pip install section next to the npm one.
  • Updates CLAUDE.md to note: wheel version is dynamic from Cargo.toml (no extra lockstep bump), and PyPI trusted-publisher setup is a one-time pypi.org config.

The wheel version is pulled from crates/clickhousectl/Cargo.toml via dynamic = ["version"], and the build job also re-aligns the Cargo version to the tag at publish time (mirroring the existing npm step) — so a single source of truth.

One-time setup needed before first release

Register a trusted publisher on pypi.org for the clickhousectl project:

  • Owner: ClickHouse
  • Repository: clickhousectl
  • Workflow: release.yml
  • Environment: (blank)

Until that's configured, the publish-pypi job will fail at the OIDC handshake. The rest of the release (binaries, npm, crates.io) is unaffected.

Test plan

  • maturin build --release in pypi/ produces clickhousectl-0.2.3-py3-none-macosx_11_0_arm64.whl (5.4 MB, version pulled from Cargo.toml automatically).
  • pip install the resulting wheel; clickhousectl --version prints clickhousectl 0.2.3; clickhousectl local --help shows the full subcommand surface.
  • release.yml parses as valid YAML.
  • Cut a pre-release tag (e.g. v0.2.4-rc1) once trusted publishing is configured, verify the 6 wheels build and publish, then pip install clickhousectl==0.2.4rc1 works in a fresh venv on macOS arm64 + a Linux container.

Out of scope

  • chctl short alias for pip — npm-only for v1 (would need a second cargo bin target or a Python shim).
  • Windows wheels — not in the existing release matrix.

🤖 Generated with Claude Code

Publishes per-platform Python wheels containing the prebuilt
`clickhousectl` binary so users can install via `pip install
clickhousectl` (or pipx / uv tool). Mirrors the existing npm wrapper.

Approach follows zizmor's pattern: a `pypi/pyproject.toml` configured
with `bindings = "bin"` pointing at the existing `crates/clickhousectl`
manifest. Maturin compiles the binary and packages it as the wheel's
script, so no Python shim is needed. The wheel version is pulled
dynamically from `Cargo.toml`, so there's no separate version to
maintain in lockstep.

Release workflow adds two jobs after `publish-npm`:
- `build-wheels`: matrix over manylinux x86_64/aarch64, musllinux
  x86_64/aarch64, and macOS x86_64/arm64 (6 wheels)
- `publish-pypi`: uploads via `pypa/gh-action-pypi-publish` using
  OIDC trusted publishing (no API token secret)

Both action SHAs are pinned. The trusted-publisher relationship needs
a one-time setup on pypi.org before the first tagged release.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@sdairs sdairs requested a review from iskakaushik as a code owner May 24, 2026 09:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant