gh-117829: add --include and --exclude flag to zipapp

Doc/library/zipapp.rst

@@ -94,6 +94,24 @@ The following options are understood:
    this case, any other options are ignored and SOURCE must be an archive, not a
    directory.
 
+.. option:: --include pattern
+
+   Include only files and directories that match the given glob pattern(s).
+   Patterns use standard globbing as implemented by :class:`pathlib.PurePath.match`.
+
+   If this option is not specified, all files in the given directory are included by
+   default (subject to any :option:`--exclude` patterns).
+
+.. option:: --exclude pattern
+
+   Exclude files and directories that match the given glob pattern(s).
+   Patterns use standard globbing as implemented by :class:`pathlib.PurePath.match`.
+
+   If both :option:`--include` and :option:`--exclude` are specified, the set of
+   files to be included is picked first. Then any to be excluded are removed from
+   that set. The order of the options does not affect how they are processed.
+
+
 .. option:: -h, --help
 
    Print a short usage message and exit.
@@ -229,6 +247,53 @@ fits in memory::
    >>> with open('myapp.pyz', 'wb') as f:
    >>>     f.write(temp.getvalue())
 
+To filter which files go into the archive, use :option:`--include` or
+:option:`--exclude` with standard glob patterns (as implemented by
+:class:`pathlib.PurePath.match`).
+
+Including only specific files:
+
+.. code-block:: shell-session
+
+   $ ls myapp
+   __main__.py  helper.py  data.txt
+
+   # Keep only Python sources; anything not matched is implicitly excluded
+   $ python -m zipapp myapp -o myapp.pyz --include "*.py"
+   $ unzip myapp.pyz -d extracted_myapp
+   Archive:  myapp.pyz
+    extracting: extracted_myapp/__main__.py
+    extracting: extracted_myapp/helper.py
+
+Excluding a subtree or file type:
+
+.. code-block:: shell-session
+
+   $ ls -R myapp
+   myapp:
+   __main__.py  helper.py  tests/  build/
+
+   myapp/tests:
+   test_helper.py
+
+   myapp/build:
+   scratch.txt
+
+   # Add everything except the tests/ directory items and *.pyc files
+   $ python -m zipapp myapp -o myapp.pyz --exclude "tests/**" --exclude "*.pyc"
+   $ unzip myapp.pyz -d extracted_myapp
+   Archive:  myapp.pyz
+    extracting: extracted_myapp/__main__.py
+      creating: extracted_myapp/build/
+    extracting: extracted_myapp/build/scratch.txt
+    extracting: extracted_myapp/helper.py
+      creating: extracted_myapp/tests/
+
+.. note::
+
+   * Patterns follow :class:`pathlib.PurePath.match`. To match all of a
+     directory contents, use ``dir/**``.
+
 
 .. _zipapp-specifying-the-interpreter:
 

Lib/test/test_zipapp.py

@@ -396,6 +396,12 @@ def make_archive(self):
         zipapp.create_archive(source, target)
         return target
 
+    def _make_tree(self, root: pathlib.Path, files: list[str]) -> None:
+        for rel in files:
+            p = root / rel
+            p.parent.mkdir(parents=True, exist_ok=True)
+            p.touch()
+
     def test_cmdline_create(self):
         # Test the basic command line API.
         source = self.tmpdir / 'source'
@@ -454,6 +460,98 @@ def test_info_error(self):
         # Program should exit with a non-zero return code.
         self.assertTrue(cm.exception.code)
 
+    def test_cmdline_include_then_exclude(self):
+        source = self.tmpdir / 'source'
+        source.mkdir()
+        self._make_tree(source, [
+            '__main__.py',
+            'foo/a.py',
+            'foo/b.pyc',
+            'bar/c.txt',
+        ])
+
+        # Include 'foo' (directory implies subtree), then exclude *.pyc
+        args = [
+            str(source),
+            '--include', '*.py',
+            '--include', 'foo',
+            '--exclude', '**/*.pyc']
+        zipapp.main(args)
+
+        target = source.with_suffix('.pyz')
+        with zipfile.ZipFile(target, 'r') as z:
+            names = set(z.namelist())
+            # Always contains __main__.py unless overridden by -m
+            self.assertIn('__main__.py', names)
+            self.assertIn('foo/', names)
+            self.assertIn('foo/a.py', names)
+            # Excluded by pattern
+            self.assertNotIn('foo/b.pyc', names)
+            # Not included at all since include restricted to 'foo'
+            self.assertNotIn('bar/', names)
+            self.assertNotIn('bar/c.txt', names)
+
+    def test_cmdline_multiple_includes_commas_and_extend(self):
+        source = self.tmpdir / 'src'
+        source.mkdir()
+        self._make_tree(source, [
+            '__main__.py',
+            'pkg/x.py',
+            'pkg/y.txt',
+            'data/readme.txt',
+            'data/keep.bin',
+        ])
+
+        args = [
+            str(source),
+            '--include', 'pkg/**',
+            '--include', 'data/*.txt',
+            '--include', 'data/keep.bin',
+        ]
+        zipapp.main(args)
+
+        target = source.with_suffix('.pyz')
+        with zipfile.ZipFile(target, 'r') as z:
+            names = set(z.namelist())
+            # did not include root files
+            self.assertNotIn('__main__.py', names)
+            # from "pkg"
+            self.assertIn('pkg/x.py', names)
+            self.assertIn('pkg/y.txt', names)
+            # from "data/*.txt"
+            self.assertIn('data/readme.txt', names)
+            # from the second --include
+            self.assertIn('data/keep.bin', names)
+
+    def test_cmdline_exclude_directory_over_included_files(self):
+        source = self.tmpdir / 'tree'
+        source.mkdir()
+        self._make_tree(source, [
+            '__main__.py',
+            'foo/a.py',
+            'foo/b.py',
+            'bar/c.py',
+        ])
+
+        # Include all *.py, but exclude 'foo/**' entirely
+        args = [
+            str(source),
+            '--include', '*.py',
+            '--exclude', 'foo/**',
+        ]
+        zipapp.main(args)
+
+        target = source.with_suffix('.pyz')
+        with zipfile.ZipFile(target, 'r') as z:
+            names = set(z.namelist())
+            self.assertIn('__main__.py', names)
+            # foo is excluded even though files match *.py
+            self.assertNotIn('foo/', names)
+            self.assertNotIn('foo/a.py', names)
+            self.assertNotIn('foo/b.py', names)
+            # bar/c.py remains
+            self.assertIn('bar/c.py', names)
+
 
 if __name__ == "__main__":
     unittest.main()

Lib/zipapp.py

@@ -6,6 +6,8 @@
 import sys
 import zipfile
 
+from collections.abc import Iterable, Callable
+
 __all__ = ['ZipAppError', 'create_archive', 'get_interpreter']
 
 
@@ -177,6 +179,46 @@ def get_interpreter(archive):
         if f.read(2) == b'#!':
             return f.readline().strip().decode(shebang_encoding)
 
+def _make_glob_filter(
+    includes: Iterable[str] | None,
+    excludes: Iterable[str] | None,
+) -> Callable[[pathlib.Path], bool]:
+    """
+    Build a filter(relative_path: Path) -> bool applying includes first, then excludes.
+
+    Semantics:
+      - Patterns are standard glob patterns as implemented by PurePath.match.
+      - If 'includes' is empty, all files/dirs are initially eligible.
+      - If any exclude pattern matches, the path is rejected.
+    """
+
+    def _normalize_patterns(values: Iterable[str] | None) -> list[str]:
+        """
+        Return patterns exactly as provided by the CLI (no comma splitting).
+        Each item is stripped of surrounding whitespace; empty items are dropped.
+        """
+        if not values:
+            return []
+        out: list[str] = []
+        for v in values:
+            v = v.strip()
+            if v:
+                out.append(v)
+        return out
+
+    inc = _normalize_patterns(values=includes)
+    exc = _normalize_patterns(values=excludes)
+
+    def _filter(rel: pathlib.Path) -> bool:
+        # If includes were provided, at least one must match.
+        if inc and not any(rel.match(pat) for pat in inc):
+            return False
+        # Any exclude match removes the path.
+        if exc and any(rel.match(pat) for pat in exc):
+            return False
+        return True
+
+    return _filter
 
 def main(args=None):
     """Run the zipapp command line interface.
@@ -204,6 +246,15 @@ def main(args=None):
             help="Display the interpreter from the archive.")
     parser.add_argument('source',
             help="Source directory (or existing archive).")
+    parser.add_argument('--include', action='extend', nargs='+', default=None,
+            help=("Glob pattern(s) of files/dirs to include (relative to SOURCE). "
+                  "Repeat the flag for multiple patterns. "
+                  "To include a directory and its contents, use 'foo/**'."))
+    parser.add_argument('--exclude', action='extend', nargs='+', default=None,
+            help=("Glob pattern(s) of files/dirs to exclude (relative to SOURCE). "
+                  "Repeat the flag for multiple patterns. "
+                  "To exclude a directory and its contents, use 'foo/**'. "
+                  "Applied after --include."))
 
     args = parser.parse_args(args)
 
@@ -222,9 +273,19 @@ def main(args=None):
         if args.main:
             raise SystemExit("Cannot change the main function when copying")
 
+    # build a filter from include and exclude flags
+    filter_fn = None
+    src_path = pathlib.Path(args.source)
+    if src_path.exists() and src_path.is_dir() and (args.include or args.exclude):
+        filter_fn = _make_glob_filter(
+            includes=args.include,
+            excludes=args.exclude
+        )
+
     create_archive(args.source, args.output,
                    interpreter=args.python, main=args.main,
-                   compressed=args.compress)
+                   compressed=args.compress,
+                   filter=filter_fn)
 
 
 if __name__ == '__main__':

Misc/NEWS.d/next/Library/2025-09-26-23-05-56.gh-issue-117829.Fpf5i1.rst

@@ -0,0 +1,2 @@
+Add flags ``--include`` and ``--exclude`` to the CLI of the :mod:`zipapp` module. These flags accept glob patterns to
+indicate allow-list and/or deny-list of files to be included in the zipapp file.