{"action":"created","issue":{"url":"https://api.github.com/repos/audreyr/cookiecutter-pypackage/issues/64","labels_url":"https://api.github.com/repos/audreyr/cookiecutter-pypackage/issues/64/labels{/name}","comments_url":"https://api.github.com/repos/audreyr/cookiecutter-pypackage/issues/64/comments","events_url":"https://api.github.com/repos/audreyr/cookiecutter-pypackage/issues/64/events","html_url":"https://github.com/audreyr/cookiecutter-pypackage/pull/64","id":107619725,"number":64,"title":"Travis setup for automated pypi deployment","user":{"login":"eliasdorneles","id":37565,"avatar_url":"https://avatars.githubusercontent.com/u/37565?v=3","gravatar_id":"","url":"https://api.github.com/users/eliasdorneles","html_url":"https://github.com/eliasdorneles","followers_url":"https://api.github.com/users/eliasdorneles/followers","following_url":"https://api.github.com/users/eliasdorneles/following{/other_user}","gists_url":"https://api.github.com/users/eliasdorneles/gists{/gist_id}","starred_url":"https://api.github.com/users/eliasdorneles/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eliasdorneles/subscriptions","organizations_url":"https://api.github.com/users/eliasdorneles/orgs","repos_url":"https://api.github.com/users/eliasdorneles/repos","events_url":"https://api.github.com/users/eliasdorneles/events{/privacy}","received_events_url":"https://api.github.com/users/eliasdorneles/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-09-21T23:45:41Z","updated_at":"2015-09-22T23:59:03Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/audreyr/cookiecutter-pypackage/pulls/64","html_url":"https://github.com/audreyr/cookiecutter-pypackage/pull/64","diff_url":"https://github.com/audreyr/cookiecutter-pypackage/pull/64.diff","patch_url":"https://github.com/audreyr/cookiecutter-pypackage/pull/64.patch"},"body":"Hey @audreyr,\r\n\r\nSo, here's a sketch of how the Travis setup would look like for an automated PyPI deployment setup.\r\n\r\nThis change would make Travis deploy the project using the username and password configured, whenever there a new tag is pushed to the Git repo, except I got stuck trying figure out how to implement updating `.travis.yml` with the encrypted password.\r\n\r\nProblem: we can only encrypt the password after the Github repo exists and is configured in Travis.\r\n\r\nThe password encryption work in two steps:\r\n\r\n1) Get the public RSA key from Travis project for the repo configured, through an URL like this: `https://api.travis-ci.org/repos/audreyr/cookiecutter/key`: note that this will only work if the Github repo already exists and is added to Travis!\r\n2) Use that key to encrypt the pypi user password, and put it in `.travis.yml` in the correct place (where now is the string `PLEASE_REPLACE_ME`): this bit is straightforward, can be done in [a few lines of pure Python code](https://github.com/sivel/travis-encrypt/blob/master/python/travis_encrypt.py#L61).\r\n\r\nSo, it's kind of a chicken-and-egg problem, and I'm kinda lost.\r\n\r\nAs far as I can see, there are a few options:\r\n\r\n1. Put the plain-text user PyPI password in the `.travis.yml` file -- this would work, but it would obviously be a huge security hole and I'm only writing it here for the sake of completeness.\r\n\r\n2. Provide a script that the user can run after creating the Github repo and adding it to Travis for updating the .travis.yml (we can print a reminder for this on a post-generate hook)\r\n\r\n3. Leave the whole deploy section commented-out in the `.travis.yml` file, with instructions for how to proceed to enable it\r\n\r\nMaybe there are other options that I'm missing, I dunno.\r\n\r\nThoughts?"},"comment":{"url":"https://api.github.com/repos/audreyr/cookiecutter-pypackage/issues/comments/142456658","html_url":"https://github.com/audreyr/cookiecutter-pypackage/pull/64#issuecomment-142456658","issue_url":"https://api.github.com/repos/audreyr/cookiecutter-pypackage/issues/64","id":142456658,"user":{"login":"eliasdorneles","id":37565,"avatar_url":"https://avatars.githubusercontent.com/u/37565?v=3","gravatar_id":"","url":"https://api.github.com/users/eliasdorneles","html_url":"https://github.com/eliasdorneles","followers_url":"https://api.github.com/users/eliasdorneles/followers","following_url":"https://api.github.com/users/eliasdorneles/following{/other_user}","gists_url":"https://api.github.com/users/eliasdorneles/gists{/gist_id}","starred_url":"https://api.github.com/users/eliasdorneles/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eliasdorneles/subscriptions","organizations_url":"https://api.github.com/users/eliasdorneles/orgs","repos_url":"https://api.github.com/users/eliasdorneles/repos","events_url":"https://api.github.com/users/eliasdorneles/events{/privacy}","received_events_url":"https://api.github.com/users/eliasdorneles/received_events","type":"User","site_admin":false},"created_at":"2015-09-22T23:59:03Z","updated_at":"2015-09-22T23:59:03Z","body":"Hey @audreyr,\r\n\r\nSo, here is an updated proposal for the option 2 discussed above, adding the script to update Travis config file and updated the instructions for next steps in README.\r\n\r\nThere is relatively minor side effect when updating the `.travis.yml` file via the script: the comments are lost and previous ordering isn't preserved (mainly because yaml are like Python dicts).\r\nThis is the resulf of using the [PyYAML](http://pyyaml.org/wiki/PyYAML) library.\r\n\r\nI think options here are:\r\n\r\n1. Implement a state-based line-oriented algorithm (like a sed script) to update the file preserving the previous content.\r\n\r\n2. Try other YAML libraries -- there is [at least one](https://pypi.python.org/pypi/ruamel.yaml) that attempts to handle comments and ordering in YAML, it doesn't seem as battle-tested as PyYAML and bring other dependencies too, but maybe that's okay.\r\n\r\n3. Just leave the current behavior. If we think comments or ordering in `.travis.yml` are important, we can warn the user beforehand or add an option to the script to print to the screen instead of writing to the file.\r\n\r\nImplementing option 1 would be fun (I actually started it), but the resulting code was ugly and looks like a source of bugs, so I just skipped it.\r\n\r\nPS: I left PyYAML out of package's requirements.txt because it isn't a runtime dependency (it's only needed for the script), let me know if you prefer it another way.\r\n\r\nLet me know what you think! :)"}}