chore: Restrict the sdist to an allowlist and verify it in CI

[keelerm84]

Summary

pyproject.toml configured only the wheel target, so hatchling fell back to its default for the sdist and shipped every git-tracked file. The published sdist carries 17 files of no use to anyone outside this repository: all of .github/, release-please-config.json, .release-please-manifest.json, CODEOWNERS, .readthedocs.yml, and .codeclimate.yml. Somebody curated the wheel and never came back for the sdist. It surfaced while fixing the identical gap in launchdarkly/python-eventsource#79.

This is hygiene rather than exposure -- every one of those files is already public on a public repo.

Why an allowlist, and why it needs the CI job

The first commit here used an exclude list. That has the wrong default: every new repository file ships unless somebody remembers to exclude it. An allowlist inverts the default so a new CI config can never leak.

But the two directions fail differently. A missed exclude ships a junk file: harmless, and no test can ever catch it, because nothing breaks. A missed include drops a needed file: a real break for downstream redistributors and for pip install --no-binary, and the kind of thing a test can catch. Switching to an allowlist without a check would trade a harmless invisible failure for a harmful one, so the second commit adds both together.

One thing that shrinks the risk: hatchling force-includes pyproject.toml, README.md, LICENSE.txt, PKG-INFO and .gitignore regardless of what the file list says (hatchling/builders/sdist.py, get_default_build_data). An allowlist cannot make the sdist unbuildable or uninstallable. What it can lose is the Makefile, setup.cfg, PROVENANCE.md, the changelog and docs, contract-tests/, and the tests themselves. Everything under /ldclient comes along automatically, including non-Python data files such as ldclient/testing/selfsigned.{key,pem}.

.gitignore is deliberately absent from both lists for the same reason: force_include beats exclude, so an entry for it would silently do nothing.

The new sdist (functional) job

It builds the sdist, unpacks it outside the checkout, and from the unpacked tree runs make test, make lint, and both contract suites.

Two design points worth calling out. It runs from the unpacked tree, not install-the-sdist-then-test-the-checkout, which would test the checkout's files instead. And it enforces a test-count floor: an sdist that shipped half its tests would still pass the tests it did ship and go green having proven nothing, so the job counts collected tests in both places and fails if the sdist collects fewer. The contract-test steps cover the omission the count cannot see, since a missing contract-tests/ directory changes no test count.

One job on one Python version. The existing matrix already covers the checkout on five versions across two platforms. The job starts no database services, so it runs the contract suites with enable_persistence_tests: "false"; the linux job still covers persistence. Keeping the packaging check free of Redis, Consul and DynamoDB keeps its flake surface small.

It does not catch a junk file leaking back in. That is the direction that does not matter.

Judgment call worth a reviewer's eye

.sdk_metadata.json is not in the allowlist, so it no longer ships. It is repository metadata that release tooling reads from a checkout rather than from the built package. Say the word if something does consume it from an installed sdist and I will add it.

Verification

Locally, from the unpacked sdist:

$ uv build --sdist && tar -xzf dist/*.tar.gz -C /tmp/sim --strip-components=1
$ cd /tmp/sim && ls -a
.gitignore  CHANGELOG.md  CONTRIBUTING.md  LICENSE.txt  Makefile  PKG-INFO
PROVENANCE.md  README.md  SECURITY.md  contract-tests  docs  ldclient
pyproject.toml  setup.cfg
$ uv run pytest --collect-only -q | tail -1  -> 1983 tests collected
$ make test                                  -> 1628 passed, 355 skipped in 54.30s
$ make lint                                  -> Success: no issues found in 228 source files

make test sets LD_SKIP_DATABASE_TESTS=1, so the 355 skips are the Redis, DynamoDB and Consul tests that need services CI provides.

• The allowlist produces the same 262-file sdist the exclude list did, down from 280.
• 1,983 tests collect from the sdist, the same as the checkout.
• The wheel is byte-identical to one built from main: same file list, same SHA-256 per entry.
• The guard was checked against a deliberately broken sdist in the companion repo, where it correctly failed rather than passing vacuously.

Related

launchdarkly/python-eventsource#79 is the companion change. SDK-3126 covers that one.

---

Note

Overview
Restricts the published sdist to an explicit Hatch allowlist instead of shipping every git-tracked file (e.g. .github/ and release config). The new [tool.hatch.build.targets.sdist] include list covers ldclient, contract-tests, docs, Makefile, setup.cfg, and selected markdown files.

Adds a sdist (functional) CI job that builds and unpacks the sdist outside the checkout, fails if pytest collects fewer tests than the repo checkout (catching allowlist omissions), then runs make test, make lint, and sync/async contract tests from the unpacked tree (enable_persistence_tests: false, LD_SKIP_FLAKY_TESTS aligned with other jobs).

^{Reviewed by Cursor Bugbot for commit 60a35b3. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit f2a735b. Configure here.}