DEVELOPMENT.md

Development

python-dotenvx is a mixed Python/Rust project. Maturin compiles the PyO3 extension in rust/lib.rs and places it inside the dotenvx Python package. The extension uses the published dotenvx-primitives crate.

Local setup

python3 -m venv .venv
.venv/bin/python -m pip install maturin pytest
.venv/bin/maturin develop
.venv/bin/pytest

Build a wheel for the current platform:

.venv/bin/maturin build --release

The resulting wheel is written to target/wheels.

Version changes

Cargo.toml is the single source of truth for the package version:

[package]
version = "2.0.1"

Maturin uses that value for the PyPI distribution because pyproject.toml declares version as dynamic. At runtime, dotenvx.__version__ reads the installed distribution metadata. Cargo.lock is generated from Cargo.toml.

After changing the version, refresh the lockfile:

cargo check

The dotenvx-primitives dependency version is independent. Change it only when this package should embed a newer primitives release.

Security audits

Audit Rust dependencies in Cargo.lock with RustSec:

cargo install cargo-audit --locked
cargo audit

Python's equivalent of npm audit is pip-audit:

python -m pip install pip-audit
pip-audit .

This project currently has no runtime Python dependencies, but pip-audit should still be run whenever Python dependencies are added. Native dependencies embedded in the wheel are covered by cargo audit, not pip-audit.

Publishing

Git tags matching v* trigger wheel builds for Linux, macOS, and Windows and publish the collected wheels to PyPI. Before tagging:

.venv/bin/maturin develop
.venv/bin/pytest
.venv/bin/maturin build --release

Then:

git tag v0.0.0
git push origin v0.0.0

The tag version must match Cargo.toml.