Packaging, Testing & Shipping to Production

Writing tests isn't just about avoiding bugs—it's about having the confidence to refactor and deploy code on a Friday afternoon. pytest has become the gold standard in Python because of its expressive assertions, dependency injection via fixtures, and powerful parametrization.

@pytest.fixture
def api_client(monkeypatch):
    """Clean isolated mock without real network sockets."""
    mock = MockClient()
    monkeypatch.setattr("billing.service.http", mock)
    return mock

The Python packaging ecosystem has undergone a massive modernization. The days of dangerous setup.py scripts and fragile requirements.txt files have been superseded by PEP 621 (pyproject.toml) and blazing-fast tools like uv and hatch.

[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[project]
name = "hyperflux"
version = "1.4.0"
description = "High-throughput streaming engine for distributed logs"
readme = "README.md"
requires-python = ">=3.11"
authors = [{ name = "DevOps Engineering", email = "ops@company.io" }]
dependencies = [
    "httpx>=0.27.0",
    "pydantic>=2.8.0",
]

[project.optional-dependencies]
dev = [
    "pytest>=8.3.0",
    "ruff>=0.5.0",
    "mypy>=1.11.0",
]

[project.scripts]
hyperflux-cli = "hyperflux.cli:main"

# Instant build with modern build frontend:
$ uv build
# Or python -m build

# Creates in dist/:
# dist/my_app-1.0.0-py3-none-any.whl

# Creates cryptographically pinned lockfile:
$ uv lock

# Synchronize virtual environment deterministically:
$ uv sync --frozen

Before code merges into main, continuous integration must enforce code style, static type safety, and test passes across supported Python runtimes.

Deploying Python services to Kubernetes or cloud servers requires lean, secure container images. Default Python images weigh over 1 GB and run as the root user—a major security liability.

# Stage 1: Builder
FROM python:3.12-slim AS builder
RUN apt-get update && apt-get install -y --no-install-recommends gcc
RUN python -m venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH"
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

# Stage 2: Hardened Runtime
FROM python:3.12-slim AS runner
COPY --from=builder /opt/venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH"
RUN groupadd -r appgroup && useradd -r -g appgroup appuser
WORKDIR /app
COPY --chown=appuser:appgroup . /app
USER appuser
CMD ["hyperflux-cli", "serve"]

Review the four anti-patterns that most commonly cause catastrophic deployment failures, credential breaches, or silent regressions in live production clusters.

# Dockerfile without USER directive:
FROM python:3.12-slim
COPY . /app
CMD ["python", "app.py"]
# Attacker who achieves RCE has root OS kernel access!

# Hardened production container:
RUN groupadd -r appgroup && useradd -r -g appgroup appuser
USER appuser
# Drops all root privileges before socket listen!

Test your mastery of pytest dependency injection, pyproject.toml packaging, multi-stage container hardening, deterministic lockfiles, and CI quality gates. Score 5/5 to complete Chapter 11!

def normalize_name(name):
    return name.strip().title()

assert normalize_name("  ada lovelace ") == "Ada Lovelace"
print("All checks passed")

1def normalize_name(name):
2    return name.strip().title()
3 
4assert normalize_name("  ada lovelace ") == "Ada Lovelace"
5print("All checks passed")

Run the code to see its output.

Run and extend the domain model and assertion test suite in the Python Playground (code preloaded).

• pytest & Fixtures: Use clean assertions and dependency injection fixtures for isolated, reproducible testing.
• pyproject.toml: Standardize project metadata, build backends, and CLI entry points in one declarative file.
• Deterministic Lockfiles: Never ship floating dependencies; use uv lock or poetry.lock for SHA-pinned builds.
• CI Gatekeepers: Combine ruff (lint/format), mypy (type check), and matrix testing on GitHub Actions.
• Multi-Stage Docker: Build in a heavy compiler container, then copy compiled wheels into a python:slim runner as a non-root user.