# phylum-ci
[](https://pypi.org/project/phylum/)
[](https://pypi.org/project/phylum/)
[][license]
[][issues]
[![GitHub Workflow Status (branch)][workflow_shield]][workflow_test]
[][CoC]
[][pre-commit]
[][poetry]
[][black]
[][downloads]
[][discord_invite]
Utilities for integrating Phylum into CI pipelines (and beyond)
[license]: https://github.com/phylum-dev/phylum-ci/blob/main/LICENSE
[issues]: https://github.com/phylum-dev/phylum-ci/issues
[workflow_shield]: https://img.shields.io/github/actions/workflow/status/phylum-dev/phylum-ci/test.yml?branch=main&label=tests&logo=GitHub
[workflow_test]: https://github.com/phylum-dev/phylum-ci/actions/workflows/test.yml
[CoC]: https://github.com/phylum-dev/phylum-ci/blob/main/CODE_OF_CONDUCT.md
[pre-commit]: https://github.com/pre-commit/pre-commit
[poetry]: https://python-poetry.org/
[black]: https://github.com/psf/black
[downloads]: https://pepy.tech/project/phylum
[discord_invite]: https://discord.gg/Fe6pr5eW6p
## Installation and usage
### Installation
The `phylum` Python package is pip installable for the environment of your choice:
```sh
pip install phylum
```
It can also be installed in an isolated environment with the excellent [`pipx` tool](https://pypa.github.io/pipx/):
```sh
# Globally install the app(s) on your system in an isolated virtual environment for the package
pipx install phylum
# Use the apps from the package in an ephemeral environment
pipx run --spec phylum phylum-init <options>
pipx run --spec phylum phylum-ci <options>
```
These installation methods require Python 3.9+ to run.
For a self contained environment, consider using the Docker image as described below.
### Usage
The `phylum` Python package exposes its functionality with a command line interface (CLI).
To view the options available from the CLI, print the help message from one of the scripts provided as entry points:
```sh
phylum-init -h
phylum-ci -h
```
The functionality can also be accessed by calling the module:
```sh
python -m phylum.init -h
python -m phylum.ci -h
```
The functionality is also exposed in the form of a Docker image:
```sh
# Get the `latest` tagged image
docker pull phylumio/phylum-ci
# View the help
docker run --rm phylumio/phylum-ci phylum-ci --help
# Export a Phylum token (e.g., from `phylum auth token`)
export PHYLUM_API_KEY=$(phylum auth token)
# Run it from a git repo directory containing at least one supported lockfile or manifest
docker run -it --rm -e PHYLUM_API_KEY --mount type=bind,src=$(pwd),dst=/phylum -w /phylum phylumio/phylum-ci
```
The default Docker image contains `git` and the installed `phylum` Python package.
It also contains an installed version of the Phylum CLI and all required tools needed for [lockfile generation].
An advantage of using the default Docker image is that the complete environment is packaged and made available with
components that are known to work together.
One disadvantage to the default image is it's size. It can take a while to download and may provide more tools than
required for your specific use case. Special `slim` tags of the `phylum-ci` image are provided as an alternative.
These tags differ from the default image in that they do not contain the required tools needed for [lockfile generation]
(with the exception of the `pip` tool). The `slim` tags are significantly smaller and will allow integrations relying
on them to complete faster. They are useful for those instances where *no* manifest files are present and/or *only*
lockfiles are used.
```sh
# Get the "latest" `slim` tagged image
docker pull phylumio/phylum-ci:slim
```
When using the `latest` tagged image, the version of the Phylum CLI is the `latest` available.
There are additional image tag options available to specify a specific release of the `phylum-ci` project and a specific
version of the Phylum CLI, in the form of `<phylum-ci version>-CLIv<Phylum CLI version>`.
Each of these also has a `-slim` variant that does not support [lockfile generation]. Here are image tag examples:
```sh
# Get the most current release of *both* `phylum-ci` and the Phylum CLI
docker pull phylumio/phylum-ci:latest
# Get the image with `phylum-ci` version 0.35.2 and Phylum CLI version 5.7.1
docker pull phylumio/phylum-ci:0.35.2-CLIv5.7.1
# Get the `slim` image with `phylum-ci` version 0.36.0 and Phylum CLI version 5.7.1
docker pull phylumio/phylum-ci:0.36.0-CLIv5.7.1-slim
```
[lockfile generation]: https://docs.phylum.io/cli/lockfile_generation
#### `phylum-init` Script Entry Point
The `phylum-init` script can be used to fetch and install the Phylum CLI.
It will attempt to install the latest released version of the CLI but can be specified to fetch a specific version.
It will attempt to automatically determine the correct CLI release, based on the platform where the script is run, but
a specific release target can be specified.
It will accept a Phylum token from an environment variable or specified as an option, but will also function in the case
that no token is provided. This can be because there is already a token set that should continue to be used or because
no token exists and one will need to be manually created or set, after the CLI is installed.
The options for `phylum-init`, automatically updated to be current for the latest release:
> **HINT:** Click on the image to bring up the SVG file, which should allow for search and copy/paste functionality.
#### `phylum-ci` Script Entry Point
The `phylum-ci` script is for analyzing dependency file (lockfiles and manifests) changes.
The script can be used locally or from within a Continuous Integration (CI) environment.
It will attempt to detect the CI platform based on the environment from which it is run and act accordingly.
The current CI platforms/environments supported are:
|Platform/Environment|Information Link|
|--------------------|---------------------|
|GitHub Actions|[Documentation][github_docs]|
|GitLab CI|[Documentation][gitlab_docs]|
|Azure Pipelines|[Documentation][azure_docs]|
|Bitbucket Pipelines|[Documentation][bb_pipelines_docs]|
|Git `pre-commit` Hooks|[Documentation][precommit_docs]|
There is also support for local use. This is the "fall-through" case used when no other environment is detected.
This can be useful to analyze dependency files locally, prior to or after submitting a pull/merge request (PR/MR) to a
CI system. It can also help in establishing a successful submission prior to submitting a PR/MR to a CI system.
Additionally, local use can aid troubleshooting after submitting a PR/MR to a CI system and getting unexpected results.
The options for `phylum-ci`, automatically updated to be current for the latest release:
> **HINT:** Click on the image to bring up the SVG file, which should allow for search and copy/paste functionality.
[github_docs]: https://docs.phylum.io/phylum-ci/github_actions
[gitlab_docs]: https://docs.phylum.io/phylum-ci/gitlab_ci
[azure_docs]: https://docs.phylum.io/phylum-ci/azure_pipelines
[bb_pipelines_docs]: https://docs.phylum.io/phylum-ci/bitbucket_pipelines
[precommit_docs]: https://docs.phylum.io/phylum-ci/git_precommit
## License
Copyright (C) 2022 Phylum, Inc.
This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public
License as published by the Free Software Foundation, either version 3 of the License or any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License along with this program.
If not, see <https://www.gnu.org/licenses/gpl.html> or write to `phylum@phylum.io` or `engineering@phylum.io`
## Contributing
Suggestions and help are welcome. Feel free to open an issue or otherwise contribute.
More information is available on the [contributing documentation][contributing] page.
[contributing]: https://github.com/phylum-dev/phylum-ci/blob/main/CONTRIBUTING.md
## Code of Conduct
Everyone participating in the `phylum-ci` project, and in particular in the issue tracker and pull requests, is
expected to treat other people with respect and more generally to follow the guidelines articulated in the
[Code of Conduct][CoC].
## Security Disclosures
Found a security issue in this repository? See the [security policy][security]
for details on coordinated disclosure.
[security]: https://github.com/phylum-dev/phylum-ci/blob/main/docs/security.md
## Change log
All notable changes to this project are documented in the [CHANGELOG][changelog].
The format of the change log is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
The entries in the changelog are primarily automatically generated through the use of
[conventional commits](https://www.conventionalcommits.org) and the
[Python Semantic Release](https://python-semantic-release.readthedocs.io/en/latest/index.html) tool.
However, some entries may be manually edited, where it helps for clarity and understanding.
[changelog]: https://github.com/phylum-dev/phylum-ci/blob/main/CHANGELOG.md
Raw data
{
"_id": null,
"home_page": "https://phylum.io/",
"name": "phylum",
"maintainer": null,
"docs_url": null,
"requires_python": "<3.13,>=3.9",
"maintainer_email": null,
"keywords": "dependency, security, CI, integration",
"author": "Phylum, Inc.",
"author_email": "engineering@phylum.io",
"download_url": "https://files.pythonhosted.org/packages/0f/fa/3f283f4e3febf6df4ecc5632567e92a6e7493df3dcffd2fc661141cd41f2/phylum-0.44.0.tar.gz",
"platform": null,
"description": "# phylum-ci\n[](https://pypi.org/project/phylum/)\n\n[](https://pypi.org/project/phylum/)\n[][license]\n[][issues]\n\n[![GitHub Workflow Status (branch)][workflow_shield]][workflow_test]\n[][CoC]\n[][pre-commit]\n[][poetry]\n[][black]\n[][downloads]\n[][discord_invite]\n\nUtilities for integrating Phylum into CI pipelines (and beyond)\n\n[license]: https://github.com/phylum-dev/phylum-ci/blob/main/LICENSE\n[issues]: https://github.com/phylum-dev/phylum-ci/issues\n[workflow_shield]: https://img.shields.io/github/actions/workflow/status/phylum-dev/phylum-ci/test.yml?branch=main&label=tests&logo=GitHub\n[workflow_test]: https://github.com/phylum-dev/phylum-ci/actions/workflows/test.yml\n[CoC]: https://github.com/phylum-dev/phylum-ci/blob/main/CODE_OF_CONDUCT.md\n[pre-commit]: https://github.com/pre-commit/pre-commit\n[poetry]: https://python-poetry.org/\n[black]: https://github.com/psf/black\n[downloads]: https://pepy.tech/project/phylum\n[discord_invite]: https://discord.gg/Fe6pr5eW6p\n\n## Installation and usage\n\n### Installation\n\nThe `phylum` Python package is pip installable for the environment of your choice:\n\n```sh\npip install phylum\n```\n\nIt can also be installed in an isolated environment with the excellent [`pipx` tool](https://pypa.github.io/pipx/):\n\n```sh\n# Globally install the app(s) on your system in an isolated virtual environment for the package\npipx install phylum\n\n# Use the apps from the package in an ephemeral environment\npipx run --spec phylum phylum-init <options>\npipx run --spec phylum phylum-ci <options>\n```\n\nThese installation methods require Python 3.9+ to run.\nFor a self contained environment, consider using the Docker image as described below.\n\n### Usage\n\nThe `phylum` Python package exposes its functionality with a command line interface (CLI).\nTo view the options available from the CLI, print the help message from one of the scripts provided as entry points:\n\n```sh\nphylum-init -h\nphylum-ci -h\n```\n\nThe functionality can also be accessed by calling the module:\n\n```sh\npython -m phylum.init -h\npython -m phylum.ci -h\n```\n\nThe functionality is also exposed in the form of a Docker image:\n\n```sh\n# Get the `latest` tagged image\ndocker pull phylumio/phylum-ci\n\n# View the help\ndocker run --rm phylumio/phylum-ci phylum-ci --help\n\n# Export a Phylum token (e.g., from `phylum auth token`)\nexport PHYLUM_API_KEY=$(phylum auth token)\n\n# Run it from a git repo directory containing at least one supported lockfile or manifest\ndocker run -it --rm -e PHYLUM_API_KEY --mount type=bind,src=$(pwd),dst=/phylum -w /phylum phylumio/phylum-ci\n```\n\nThe default Docker image contains `git` and the installed `phylum` Python package.\nIt also contains an installed version of the Phylum CLI and all required tools needed for [lockfile generation].\nAn advantage of using the default Docker image is that the complete environment is packaged and made available with\ncomponents that are known to work together.\n\nOne disadvantage to the default image is it's size. It can take a while to download and may provide more tools than\nrequired for your specific use case. Special `slim` tags of the `phylum-ci` image are provided as an alternative.\nThese tags differ from the default image in that they do not contain the required tools needed for [lockfile generation]\n(with the exception of the `pip` tool). The `slim` tags are significantly smaller and will allow integrations relying\non them to complete faster. They are useful for those instances where *no* manifest files are present and/or *only*\nlockfiles are used.\n\n```sh\n# Get the \"latest\" `slim` tagged image\ndocker pull phylumio/phylum-ci:slim\n```\n\nWhen using the `latest` tagged image, the version of the Phylum CLI is the `latest` available.\nThere are additional image tag options available to specify a specific release of the `phylum-ci` project and a specific\nversion of the Phylum CLI, in the form of `<phylum-ci version>-CLIv<Phylum CLI version>`.\nEach of these also has a `-slim` variant that does not support [lockfile generation]. Here are image tag examples:\n\n```sh\n# Get the most current release of *both* `phylum-ci` and the Phylum CLI\ndocker pull phylumio/phylum-ci:latest\n\n# Get the image with `phylum-ci` version 0.35.2 and Phylum CLI version 5.7.1\ndocker pull phylumio/phylum-ci:0.35.2-CLIv5.7.1\n\n# Get the `slim` image with `phylum-ci` version 0.36.0 and Phylum CLI version 5.7.1\ndocker pull phylumio/phylum-ci:0.36.0-CLIv5.7.1-slim\n```\n\n[lockfile generation]: https://docs.phylum.io/cli/lockfile_generation\n\n#### `phylum-init` Script Entry Point\n\nThe `phylum-init` script can be used to fetch and install the Phylum CLI.\nIt will attempt to install the latest released version of the CLI but can be specified to fetch a specific version.\nIt will attempt to automatically determine the correct CLI release, based on the platform where the script is run, but\na specific release target can be specified.\nIt will accept a Phylum token from an environment variable or specified as an option, but will also function in the case\nthat no token is provided. This can be because there is already a token set that should continue to be used or because\nno token exists and one will need to be manually created or set, after the CLI is installed.\n\nThe options for `phylum-init`, automatically updated to be current for the latest release:\n\n> **HINT:** Click on the image to bring up the SVG file, which should allow for search and copy/paste functionality.\n\n\n\n#### `phylum-ci` Script Entry Point\n\nThe `phylum-ci` script is for analyzing dependency file (lockfiles and manifests) changes.\nThe script can be used locally or from within a Continuous Integration (CI) environment.\nIt will attempt to detect the CI platform based on the environment from which it is run and act accordingly.\nThe current CI platforms/environments supported are:\n\n|Platform/Environment|Information Link|\n|--------------------|---------------------|\n|GitHub Actions|[Documentation][github_docs]|\n|GitLab CI|[Documentation][gitlab_docs]|\n|Azure Pipelines|[Documentation][azure_docs]|\n|Bitbucket Pipelines|[Documentation][bb_pipelines_docs]|\n|Git `pre-commit` Hooks|[Documentation][precommit_docs]|\n\nThere is also support for local use. This is the \"fall-through\" case used when no other environment is detected.\nThis can be useful to analyze dependency files locally, prior to or after submitting a pull/merge request (PR/MR) to a\nCI system. It can also help in establishing a successful submission prior to submitting a PR/MR to a CI system.\nAdditionally, local use can aid troubleshooting after submitting a PR/MR to a CI system and getting unexpected results.\n\nThe options for `phylum-ci`, automatically updated to be current for the latest release:\n\n> **HINT:** Click on the image to bring up the SVG file, which should allow for search and copy/paste functionality.\n\n\n\n[github_docs]: https://docs.phylum.io/phylum-ci/github_actions\n[gitlab_docs]: https://docs.phylum.io/phylum-ci/gitlab_ci\n[azure_docs]: https://docs.phylum.io/phylum-ci/azure_pipelines\n[bb_pipelines_docs]: https://docs.phylum.io/phylum-ci/bitbucket_pipelines\n[precommit_docs]: https://docs.phylum.io/phylum-ci/git_precommit\n\n## License\n\nCopyright (C) 2022 Phylum, Inc.\n\nThis program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public\nLicense as published by the Free Software Foundation, either version 3 of the License or any later version.\n\nThis program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied\nwarranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.\n\nYou should have received a copy of the GNU General Public License along with this program.\nIf not, see <https://www.gnu.org/licenses/gpl.html> or write to `phylum@phylum.io` or `engineering@phylum.io`\n\n## Contributing\n\nSuggestions and help are welcome. Feel free to open an issue or otherwise contribute.\nMore information is available on the [contributing documentation][contributing] page.\n\n[contributing]: https://github.com/phylum-dev/phylum-ci/blob/main/CONTRIBUTING.md\n\n## Code of Conduct\n\nEveryone participating in the `phylum-ci` project, and in particular in the issue tracker and pull requests, is\nexpected to treat other people with respect and more generally to follow the guidelines articulated in the\n[Code of Conduct][CoC].\n\n## Security Disclosures\n\nFound a security issue in this repository? See the [security policy][security]\nfor details on coordinated disclosure.\n\n[security]: https://github.com/phylum-dev/phylum-ci/blob/main/docs/security.md\n\n## Change log\n\nAll notable changes to this project are documented in the [CHANGELOG][changelog].\n\nThe format of the change log is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),\nand this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).\nThe entries in the changelog are primarily automatically generated through the use of\n[conventional commits](https://www.conventionalcommits.org) and the\n[Python Semantic Release](https://python-semantic-release.readthedocs.io/en/latest/index.html) tool.\nHowever, some entries may be manually edited, where it helps for clarity and understanding.\n\n[changelog]: https://github.com/phylum-dev/phylum-ci/blob/main/CHANGELOG.md\n",
"bugtrack_url": null,
"license": "GPL-3.0-or-later",
"summary": "Utilities for integrating Phylum into CI pipelines (and beyond)",
"version": "0.44.0",
"project_urls": {
"CI": "https://github.com/phylum-dev/phylum-ci/actions",
"Documentation": "https://docs.phylum.io/",
"Homepage": "https://phylum.io/",
"Issue Tracker": "https://github.com/phylum-dev/phylum-ci/issues",
"Repository": "https://github.com/phylum-dev/phylum-ci"
},
"split_keywords": [
"dependency",
" security",
" ci",
" integration"
],
"urls": [
{
"comment_text": "",
"digests": {
"blake2b_256": "84ad451be11b19a28647d2c4b3f47497459934705d455d59e6d38775a9e819de",
"md5": "205c74f570156fd5351f12978aa9b423",
"sha256": "ef377966f87328a23a7e326d2e0d6262bd7897aa2227db3f3f7fdb54c14c562a"
},
"downloads": -1,
"filename": "phylum-0.44.0-py3-none-any.whl",
"has_sig": false,
"md5_digest": "205c74f570156fd5351f12978aa9b423",
"packagetype": "bdist_wheel",
"python_version": "py3",
"requires_python": "<3.13,>=3.9",
"size": 85027,
"upload_time": "2024-04-04T20:33:10",
"upload_time_iso_8601": "2024-04-04T20:33:10.161523Z",
"url": "https://files.pythonhosted.org/packages/84/ad/451be11b19a28647d2c4b3f47497459934705d455d59e6d38775a9e819de/phylum-0.44.0-py3-none-any.whl",
"yanked": false,
"yanked_reason": null
},
{
"comment_text": "",
"digests": {
"blake2b_256": "0ffa3f283f4e3febf6df4ecc5632567e92a6e7493df3dcffd2fc661141cd41f2",
"md5": "bb910ed0446c81ebd2b2d5804db5a58a",
"sha256": "867ad1333046299e2af8167cd8f083abc5c3db2d5d0588cf4b5e35f46580e290"
},
"downloads": -1,
"filename": "phylum-0.44.0.tar.gz",
"has_sig": false,
"md5_digest": "bb910ed0446c81ebd2b2d5804db5a58a",
"packagetype": "sdist",
"python_version": "source",
"requires_python": "<3.13,>=3.9",
"size": 78713,
"upload_time": "2024-04-04T20:33:12",
"upload_time_iso_8601": "2024-04-04T20:33:12.414731Z",
"url": "https://files.pythonhosted.org/packages/0f/fa/3f283f4e3febf6df4ecc5632567e92a6e7493df3dcffd2fc661141cd41f2/phylum-0.44.0.tar.gz",
"yanked": false,
"yanked_reason": null
}
],
"upload_time": "2024-04-04 20:33:12",
"github": true,
"gitlab": false,
"bitbucket": false,
"codeberg": false,
"github_user": "phylum-dev",
"github_project": "phylum-ci",
"travis_ci": false,
"coveralls": false,
"github_actions": true,
"tox": true,
"lcname": "phylum"
}
JSON
