Note that in order to train a generator in secure mode (see the documentation for details) the PyTorch extension package csprng must be installed separately. Currently this package's dependencies are not compatible with recent versions of PyTorch (the author's plan on rectifying this - watch this space), so you will need to install it manually, you can do this in your environment by running:
git clone git@github.com:pytorch/csprng.git
cd csprng
@@ -2404,7 +2494,7 @@ Secure Mode
git checkout release
python setup.py install
We use black for code formatting. This is a fairly opinionated formatter, but it is widely used and has a good reputation. We also use ruff to manage imports and lint the code. Both of these tools are run automatically via pre-commit hooks. Ensure you have installed the package with the dev group of dependencies and then run the following command to install the hooks:
pre-commit install
@@ -2466,7 +2556,7 @@ Configuration
Adding Tests
We use the pytest framework for testing. The testing directory structure mirrors that of src. The usual testing practices apply.
Releases
-Version Management
+Version management
The package's version should be updated following the semantic versioning framework. The package is currently in a pre-release state, such that major version 1.0.0 should only be tagged once the package is functionally complete and stable.
To update the package's metadata, we can use Poetry's version command:
poetry version <version>
@@ -2480,7 +2570,7 @@ Version Management
This will create a new release on GitHub, and will automatically generate a changelog based on the commit messages and PR's closed since the last release. This changelog can then be edited to add more detail if necessary.
-Building and Publishing to PyPI
+Building and publishing to PyPI
Poetry offers not only dependency management, but also a simple way to build and distribute the package.
After tagging a release per the section above, we can build the package using Poetry's build command:
poetry build
@@ -2491,13 +2581,13 @@ Building and Publishing to PyPI
This will prompt for PyPI credentials, and then publish the package. Note that this will only work if you have been added as a Maintainer of the package on PyPI.
It might be preferable at some point in the future to set up Trusted Publisher Management via OpenID Connect (OIDC) to allow for automated publishing of the package via a GitHub workflow. See the "Publishing" tab of NHSSynth's project management panel on PyPI to set this up.
GitHub
-Continuous Integration
+Continuous integration
We use GitHub Actions for continuous integration. The different workflows comprising this can be found in the .github/workflows folder. In general, the CI workflow is triggered on every push to the main or a feature branch - as appropriate - and runs tests against all supported versions of Python. It also runs black and ruff to check that the code is formatted correctly, and builds the documentation site.
There are also scripts to update the dynamic badges in the README. These work via a gist associated with the repository. It is not easy to transfer ownership of this process, so if they break please feel free to contact me.
Branching
We encourage the use of the Gitflow branching model for development. This means that the main branch is always in a stable state, and that all development work is done on feature branches. These feature branches are then merged into main via pull requests. The main branch is protected, such that pull requests must be reviewed and approved before they can be merged.
At minimum, the main branches protection should be maintained, and roughly one branch per issue should be used. Ensure that all of the CI checks pass before merging.
-Security and Vulnerability Management
+Security and vulnerability management
The GitHub repository for the package has Dependabot, code scanning, and other security features enabled. These should be monitored continuously and any issues resolved as soon as possible. When issues of this type require a specific version of a dependency to be specified (and it is one that is not already amongst the dependency groups of the package), the version should be referenced as part of the security group of dependencies (i.e. with poetry add <package> --group security) and a new release created (see above).
@@ -2505,7 +2595,7 @@ Security and Vulnerability Manage
Last update:
- October 18, 2023
+ November 1, 2023
@@ -2537,7 +2627,7 @@ Security and Vulnerability Manage