CodeVetter · Repo Unpack · Data flow
pypa/hatch
CLI arguments and environment variables first select application configuration, project location, and execution environment. Project metadata and environment settings are evaluated lazily and transformed into installer requirements or shell commands. Filesystem state records configuration, dependency hashes, interpreter installations, and build artifacts. Build helpers exchange JSON across subprocess boundaries, while publishing transforms archive metadata into authenticated HTTP requests.
- Root CLI inputs become Application state: active-environment inheritance applies only when --env retains its default source; configuration supplies data/cache directories unless CLI options override them.
- Project.find_project_root walks parents for pyproject.toml or setup.py; raw_config parses the detected TOML and synthesizes a project name when metadata is absent, then ProjectMetadata feeds ProjectConfig.
- Source tables normalize dependency names, reject normalization collisions, and replace inherited entries by normalized name; path and Git sources render file:// and git+ direct-reference URLs.
- run partitions environment/matrix selectors before env run resolves selected environments; runner_context yields an ExecutionContext for command population, then prepares and executes it after the caller resumes iteration.
- dependency_hash hashes all complex dependencies; Project compares it with persisted metadata, conditionally generates a lockfile and synchronizes installations, then writes the resulting hash to environment JSON.
- BuildFrontend writes generated helper scripts into an environment filesystem context, executes Python there, synchronizes output locally, reads output.json, and moves the returned wheel or sdist into the destination.
- WheelBuilder streams selected source files into WheelArchive, records SHA-256 hashes and sizes, writes distribution data and RECORD, then replaces the temporary archive with the final tagged wheel.
- Publishing reads wheel METADATA or sdist PKG-INFO into upload fields; PackageIndex adds protocol fields and three digests before multipart POST, and prompted credentials persist as cached usernames plus keyring passwords.