nuitka/Build executables or extension modules from Python projects
Build a modules or standalone executable from python code using Nuitka on Mac/Linux/Windows. Very wide range of compatibility.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit May 22, 2026
- License
- MIT
Pinned Snippet
uses: nuitka/nuitka-action@b24f9b7859f1022afcfad039eb8b8ac3ae299e39 # v1.3tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| working-directory | Directory to run nuitka in if not top level | — | . |
| nuitka-version | Version of nuitka to use, branches, tags work | — | main |
| script-name | Path to python script that is to be built. | yes | — |
| access-token | Github personal access token of an account authorized to access the Nuitka-commercial repo | — | — |
| mode | Mode in which to compile. "accelerated" runs in your Python installation and depends on it. "standalone" creates a folder with an executable contained to run it. "onefile" creates a single self extracting executable to deploy. "app" is "onefile" except on macOS where it creates an app bundle. "app-dist" is "standalone" except on macOS where it creates an app bundle. "module" makes an extension module from a single module and "package" compiles a whole package into an extension module. "dll" is currently under development and not for users yet. Default is 'accelerated'. | — | app |
| python-flag | Python flags to use. Default is what you are using to run Nuitka, this enforces a specific mode. These are options that also exist to standard Python executable. Currently supported: "-S" (alias "no_site"), "static_hashes" (do not use hash randomization), "no_warnings" (do not give Python run time warnings), "-O" (alias "no_asserts"), "no_docstrings" (do not use doc strings), "-u" (alias "unbuffered"), "isolated" (do not load outside code), "-P" (alias "safe_path", do not used current directory in module search) and "-m" (package mode, compile as "package.__main__"). Default empty. | — | — |
| python-debug | Use debug version or not. Default uses what you are using to run Nuitka, most likely a non-debug version. Only for debugging and testing purposes. | — | — |
| project | Compile the project in the current directory by extracting configuration from it. Default is not to use it. | — | — |
| enable-plugins | Enabled plugins. Must be plug-in names. Use '--plugin-list' to query the full list and exit. Default empty. | — | — |
| disable-plugins | Disabled plugins. Must be plug-in names. Use '--plugin-list' to query the full list and exit. Most standard plugins are not a good idea to disable. Default empty. | — | — |
| user-plugin | The file name of user plugin. Can be given multiple times. Default empty. | — | — |
| plugin-no-detection | Plugins can detect if they might be used, and the you can disable the warning via "--disable-plugin=plugin-that-warned", or you can use this option to disable the mechanism entirely, which also speeds up compilation slightly of course as this detection code is run in vain once you are certain of which plugins to use. Defaults to off. | — | — |
| module-parameter | Provide a module parameter. You are asked by some packages to provide extra decisions. Format is currently --module-parameter=module.name-option-name=value Default empty. | — | — |
| report | Report module, data files, compilation, plugin, etc. details in an XML output file. This is also super useful for issue reporting. These reports can e.g. be used to re-create the environment easily using it with '--create-environment-from-report', but contain a lot of information. Default is off. | — | — |
| report-diffable | Report data in diffable form, i.e. no timing or memory usage values that vary from run to run. Default is off. | — | — |
| report-user-provided | Report data from you. This can be given multiple times and be anything in 'key=value' form, where key should be an identifier, e.g. use '--report-user-provided=pipenv-lock-hash=64a5e4' to track some input values. Default is empty. | — | — |
| report-template | Report via template. Provide template and output filename 'template.rst.j2:output.rst'. For built-in templates, check the User Manual for what these are. Can be given multiple times. Default is empty. | — | — |
| quiet | Disable all information outputs, but show warnings. Defaults to off. | — | — |
| show-scons | Run the C building backend Scons with verbose information, showing the executed commands, detected compilers. Defaults to off. | — | — |
| show-memory | Provide memory information and statistics. Defaults to off. | — | — |
| include-package-data | Include data files for the given package name. DLLs and extension modules are not data files and never included like this. Can use patterns the filenames as indicated below. Data files of packages are not included by default, but package configuration can do it. This will only include non-DLL, non-extension modules, i.e. actual data files. After a ":" optionally a filename pattern can be given as well, selecting only matching files. Examples: "--include-package-data=package_name" (all files) "--include-package-data=package_name:*.txt" (only certain type) "--include-package-data=package_name:some_filename.dat (concrete file) Default empty. | — | — |
| include-data-files | Include data files by filenames in the distribution. There are many allowed forms. With '--include-data-files=/path/to/file/*.txt=folder_name/some.txt' it will copy a single file and complain if it's multiple. With '--include-data-files=/path/to/files/*.txt=folder_name/' it will put all matching files into that folder. For recursive copy there is a form with 3 values that '--include-data-files=/path/to/scan=folder_name/=**/*.txt' that will preserve directory structure. Default empty. | — | — |
| include-data-dir | Include data files from complete directory in the distribution. This is recursive. Check '--include-data-files' with patterns if you want non-recursive inclusion. An example would be '--include-data-dir=/path/some_dir=data/some_dir' for plain copy, of the whole directory. All non-code files are copied, if you want to use '--noinclude-data-files' option to remove them. Default empty. | — | — |
| noinclude-data-files | Do not include data files matching the filename pattern given. This is against the target filename, not source paths. So to ignore a file pattern from package data for 'package_name' should be matched as 'package_name/*.txt'. Or for the whole directory simply use 'package_name'. Default empty. | — | — |
| include-data-files-external | Include the specified data file patterns outside of the onefile binary, rather than on the inside. First files have to be specified as included with other `--include-*data*` options, and then this refers to target paths inside the distribution that are then put external to it. Default empty. | — | — |
| include-raw-dir | Include raw directories completely in the distribution. This is recursive. Check '--include-data-dir' to use the sane option. Default empty. | — | — |
| include-package | Include a whole package. Give as a Python namespace, e.g. "some_package.sub_package" and Nuitka will then find it and include it and all the modules found below that disk location in the binary or extension module it creates, and make it available for import by the code. To avoid unwanted sub packages, e.g. tests you can e.g. do this "--nofollow-import-to=*.tests". Default empty. | — | — |
| include-module | Include a single module. Give as a Python namespace, e.g. "some_package.some_module" and Nuitka will then find it and include it in the binary or extension module it creates, and make it available for import by the code. Default empty. | — | — |
| include-plugin-directory | Include the content of that directory, no matter if it is used by the given main program in a visible form. Overrides all other inclusion options. Can be given multiple times. Default empty. | — | — |
| include-plugin-files | Include into files matching the PATTERN. Overrides all other follow options. Can be given multiple times. Default empty. | — | — |
| prefer-source-code | For already compiled extension modules, where there is both a source file and an extension module, normally the extension module is used, but it should be better to compile the module from available source code for best performance. If not desired, there is --no- prefer-source-code to disable warnings about it. Default off. | — | — |
| nofollow-import-to | Do not follow to that module name even if used, or if a package name, to the whole package in any case, overrides all other options. Can be given multiple times. Default empty. | — | — |
| user-package-configuration-file | User provided YAML file with package configuration. You can include DLLs, remove bloat, add hidden dependencies. Check User Manual for a complete description of the format to use. Can be given multiple times. Defaults to empty. | — | — |
| force-runtime-environment-variable | Force an environment variables to a given value. Default empty. | — | — |
| onefile-tempdir-spec | Use this as a folder to unpack onefile. Defaults to '%TEMP%\onefile_%PID%_%TIME%', but e.g. '%CACHE_DIR%/%COMPANY%/%PRODUCT%/%VERSION%' would be cached and good too. | — | — |
| onefile-child-grace-time | When stopping the child, e.g. due to CTRL-C or shutdown, how much time to allow before killing it the hard way. Unit is ms. Default 5000. | — | — |
| onefile-no-compression | When creating the onefile, disable compression of the payload. Default is false. | — | — |
| warn-implicit-exceptions | Enable warnings for implicit exceptions detected at compile time. | — | — |
| warn-unusual-code | Enable warnings for unusual code detected at compile time. | — | — |
| assume-yes-for-downloads | Allow Nuitka to download external code if necessary, e.g. dependency walker, ccache, and even gcc on Windows. To disable, redirect input from nul device, e.g. "</dev/null" or "<NUL:". Default is to prompt. | — | true |
| nowarn-mnemonic | Disable warning for a given mnemonic. These are given to make sure you are aware of certain topics, and typically point to the Nuitka website. The mnemonic is the part of the URL at the end, without the HTML suffix. Can be given multiple times and accepts shell pattern. Default empty. | — | — |
| deployment | Disable code aimed at making finding compatibility issues easier. This will e.g. prevent execution with "-c" argument, which is often used by code that attempts run a module, and causes a program to start itself over and over potentially. Disable once you deploy to end users, for finding typical issues, this is very helpful during development. Default off. | — | — |
| no-deployment-flag | Keep deployment mode, but disable selectively parts of it. Errors from deployment mode will output these identifiers. Default empty. | — | — |
| output-dir | Directory for output builds | — | build |
| output-file | Specify how the executable should be named. For extension modules there is no choice, also not for standalone mode and using it will be an error. This may include path information that needs to exist though. Defaults to '<program_name>' on this platform. .exe) | — | — |
| disable-console | Obsolete as of Nuitka 2.3: When compiling for Windows or macOS, disable the console window and create a GUI application. Defaults to false. | — | — |
| enable-console | Obsolete as of Nuitka 2.3: When compiling for Windows or macOS, enable the console window and create a GUI application. Defaults to false and tells Nuitka your choice is intentional. | — | — |
| company-name | Name of the company to use in version information. Defaults to unused. | — | — |
| product-name | Name of the product to use in version information. Defaults to base filename of the binary. | — | — |
| file-version | File version to use in version information. Must be a sequence of up to 4 numbers, e.g. 1.0 or 1.0.0.0, no more digits are allowed, no strings are allowed. Defaults to unused. | — | — |
| product-version | Product version to use in version information. Same rules as for file version. Defaults to unused. | — | — |
| file-description | Description of the file used in version information. Windows only at this time. Defaults to binary filename. | — | — |
| copyright | Copyright used in version information. Windows/macOS only at this time. Defaults to not present. | — | — |
| trademarks | Trademark used in version information. Windows/macOS only at this time. Defaults to not present. | — | — |
| force-stdout-spec | Force standard output of the program to go to this location. Useful for programs with disabled console and programs using the Windows Services Plugin of Nuitka commercial. Defaults to not active, use e.g. '{PROGRAM_BASE}.out.txt', i.e. file near your program, check User Manual for full list of available values. | — | — |
| force-stderr-spec | Force standard error of the program to go to this location. Useful for programs with disabled console and programs using the Windows Services Plugin of Nuitka commercial. Defaults to not active, use e.g. '{PROGRAM_BASE}.err.txt', i.e. file near your program, check User Manual for full list of available values. | — | — |
| windows-console-mode | Select console mode to use. Default mode is 'force' and creates a console window unless the program was started from one. With 'disable' it doesn't create or use a console at all. With 'attach' an existing console will be used for outputs. With 'hide' a newly spawned console will be hidden and an already existing console will behave like 'force'. Default is 'force'. | — | — |
| windows-icon-from-ico | Add executable icon. Can be given multiple times for different resolutions or files with multiple icons inside. In the later case, you may also suffix with #<n> where n is an integer index starting from 1, specifying a specific icon to be included, and all others to be ignored. | — | — |
| windows-icon-from-exe | Copy executable icons from this existing executable (Windows only). | — | — |
| onefile-windows-splash-screen-image | When compiling for Windows and onefile, show this while loading the application. Defaults to off. | — | — |
| windows-uac-admin | Request Windows User Control, to grant admin rights on execution. (Windows only). Defaults to off. | — | — |
| windows-uac-uiaccess | Request Windows User Control, to enforce running from a few folders only, remote desktop access. (Windows only). Defaults to off. | — | — |
| macos-app-console-mode | Select console mode to use. Default mode is 'disable' and creates no console window. With 'force' it will create a console window when launched from Finder. Default is 'disable'. | — | — |
| macos-target-arch | What architecture is this supposed to run on. Default and limit is what the running Python allows for. Default is "native" which is the architecture the Python is run with. | — | — |
| macos-app-icon | Add icon for the application bundle to use. Can be given only one time. Defaults to Python icon if available. | — | — |
| macos-app-create-dmg | When compiling for macOS, create a DMG file for the application bundle. Defaults to off. | — | — |
| macos-signed-app-name | Name of the application to use for macOS signing. Follow "com.YourCompany.AppName" naming results for best results, as these have to be globally unique, and will potentially grant protected API accesses. | — | — |
| macos-app-name | Name of the product to use in macOS bundle information. Defaults to base filename of the binary. | — | — |
| macos-app-mode | Mode of application for the application bundle. When launching a Window, and appearing in the dock is desired, default value "gui" is a good fit. Without a Window ever, the application is a "background" application. For UI elements that get to display later, "ui-element" is in-between. The application will not appear in the dock, but get full access to desktop when it does open a Window later. | — | — |
| macos-prohibit-multiple-instances | For application bundles, set the flag "LSMultipleInstancesProhibited" to prevent launching multiple instances of the application. Default is off. | — | — |
| macos-sign-identity | When signing on macOS, by default an ad-hoc identify will be used, but with this option your get to specify another identity to use. The signing of code is now mandatory on macOS and cannot be disabled. Use "auto" to detect your only identity installed. Default "ad-hoc" if not given. | — | — |
| macos-sign-notarization | When signing for notarization, using a proper TeamID identity from Apple, use the required runtime signing option, such that it can be accepted. | — | — |
| macos-app-version | Product version to use in macOS bundle information. Defaults to "1.0" if not given. | — | — |
| macos-app-protected-resource | Request an entitlement for access to a macOS protected resources, e.g. "NSMicrophoneUsageDescription:Microphone access for recording audio." requests access to the microphone and provides an informative text for the user, why that is needed. Before the colon, is an OS identifier for an access right, then the informative text. Legal values can be found on https://developer.apple.com/documentation/bundleresources/information_property_list/protected_resources and the option can be specified multiple times. Default empty. | — | — |
| macos-sign-keyring-filename | Path to the certificate file to be used for macOS code signing. This is used in conjunction with '--macos-sign-identity'. Default empty. | — | — |
| macos-sign-keyring-password | Password for the certificate file provided via '--macos-sign-keyring-filename'. Default empty. | — | — |
| linux-icon | Add executable icon for onefile binary to use. Can be given only one time. Defaults to Python icon if available. | — | — |
| clang | Enforce the use of clang. On Windows this requires a working Visual Studio version to piggy back on. Defaults to off. | — | — |
| mingw64 | Enforce the use of MinGW64 on Windows. Defaults to off unless MSYS2 with MinGW Python is used. | — | — |
| zig | Enforce usage of Zig on for C compilation. Defaults to off. | — | — |
| msvc | Enforce the use of specific MSVC version on Windows. Allowed values are e.g. "14.3" (MSVC 2022) and other MSVC version numbers, specify "list" for a list of installed compilers, or use "latest". Defaults to latest MSVC being used if installed, otherwise MinGW64 is used. | — | — |
| jobs | Specify the allowed number of parallel C compiler jobs. Negative values are system CPU minus the given value. Defaults to the full system CPU count unless low memory mode is activated, then it defaults to 1. | — | — |
| reproducible | Enable reproducible builds. Allowed values are "yes", "no", and "auto" (where it's "no" on Windows and "yes" otherwise). Defaults to "auto". | — | — |
| lto | Use link time optimizations (MSVC, gcc, clang). Allowed values are "yes", "no", and "auto" (when it's known to work). Defaults to "auto". | — | — |
| static-libpython | Use static link library of Python. Allowed values are "yes", "no", and "auto" (when it's known to work). Defaults to "auto". | — | — |
| cf-protection | This option is gcc specific. For the gcc compiler, select the "cf-protection" mode. Default "auto" is to use the gcc default value, but you can override it, e.g. to disable it with "none" value. Refer to gcc documentation for "-fcf-protection" for the details. | — | — |
| debug | Executing all self checks possible to find errors in Nuitka, do not use for production. Defaults to off. | — | — |
| debug-self-forking | For fork bombs, debug what Nuitka does when it encounters a relaunch of itself. Defaults to off. | — | — |
| no-debug-immortal-assumptions | Disable check normally done with "--debug". With Python3.12+ do not check known immortal object assumptions. Some C libraries corrupt them. Defaults to check being made if "--debug" is on. | — | — |
| no-debug-c-warnings | Disable check normally done with "--debug". The C compilation may produce warnings, which it often does for some packages without these being issues, esp. for unused values. | — | — |
| unstripped | Keep debug info in the resulting object file for better debugger interaction. Defaults to off. | — | — |
| trace-execution | Traced execution output, output the line of code before executing it. Defaults to off. | — | — |
| xml | Write the internal program structure, result of optimization in XML form to given filename. | — | — |
| experimental | Use features declared as 'experimental'. May have no effect if no experimental features are present in the code. Uses secret tags (check source) per experimented feature. | — | — |
| low-memory | Attempt to use less memory, by forking less C compilation jobs and using options that use less memory. For use on embedded machines. Use this in case of out of memory problems. Defaults to off. | — | — |
| auto-update-url-spec | URL to check for automatic updates. Default empty, i.e. not updates. | — | — |
| auto-update-debug | Debug automatic updates at runtime printing messages. Default False. | — | — |
| auto-update-toml-file | Path to generate a TOML update config for the compiled binary. Default empty, i.e. do not generate. | — | — |
| windows-service-name | The Windows service name. | — | — |
| windows-service-grace-time | For shutdown, wait this extra time before killing. Unit is ms, and default is 2000, i.e. it waits 2 seconds to allow cleanup. Increase if you need more time, decrease if you want faster service shutdown. | — | — |
| windows-service-start-mode | Pick the service start mode, value "auto" starts automatically at reboot without login, "demand" (default) must be started manually, and "disabled" cannot be started, requires further action to change it. | — | — |
| windows-service-cli | Should the program allow to be ran from the command line. By default it does not and only outputs a message it is disallowed. | — | — |
| esigner-sign-deep | Also sign included DLLs (shared libraries) and extension modules in the distribution. Use with care, as this may break some things. | — | — |
| esigner-disable-signing-cache | Disable usage of the hashing based signing cache. This will make deep signing much slower. | — | — |
| esigner-tool-path | Path to the 'CodeSignTool' executable/batch file provided by SSL.com. | — | — |
| esigner-username | SSL.com username. | — | — |
| esigner-password | SSL.com password. | — | — |
| esigner-credential-id | Credential ID for the signing certificate. | — | — |
| esigner-totp-secret | TOTP secret for the signing account (static secret). | — | — |
| windows-sign-deep | Also sign included DLLs (shared libraries) and extension modules in the distribution. Use with care, as this may break some things. | — | — |
| windows-disable-signing-cache | Disable usage of the hashing based signing cache. This will make deep signing much slower. | — | — |
| windows-signing-tool-path | The 'signtool' executable. You may make this a wrapper script should you want very specific options, by default `signtool` from PATH or used MSVC used is used. | — | — |
| windows-certificate-name | Name of the certificate to use. This will be used to sign the binary. | — | — |
| windows-certificate-sha1 | Checksum of the certificate to use. This will be used to sign the binary. | — | — |
| windows-certificate-filename | Filename of the certificate, typically a ".pfx" file. This will be used to sign the binary. | — | — |
| windows-certificate-password | Password of the certificate filename used. Defaults to empty, must be provided to successfully sign if certificate the file has one. | — | — |
| windows-signed-content-comment | Comment to be used for the signed comments. Optional, defaults to not given. | — | — |
| anti-debugger-debugging | Enables debug outputs for the debugger plugin, so that it e.g. says why it rejects something. | — | — |
| data-hiding-salt-value | Salt value to make encryption result unique. | — | — |
| embed-data-files-compile-time-pattern | Pattern of data files to embed for use during compile time. These should match target filenames. | — | — |
| embed-data-files-run-time-pattern | Pattern of data files to embed for use during run time. These should match target filenames. | — | — |
| embed-data-files-qt-resource-pattern | Pattern of data files to embed for use with Qt at run time. These should match target filenames. | — | — |
| embed-debug-qt-resources | For debugging purposes, print out information for Qt resources not found. | — | — |
| embed-dll-pattern | Pattern of DLLs to embed (glob style). Matches against the destination path (e.g. package/ext.pyd or library.dll). | — | — |
| encryption-key | The encryption key to use. | — | — |
| encrypt-stdout | Apply encryption to standard output. | — | — |
| encrypt-stderr | Apply encryption to standard error. | — | — |
| encrypt-debug-init | In case the encryption fails to install, do not abort, but run normally and trace error unencrypted. | — | — |
| encrypt-crypto-package | These are two very similar packages that can both do the encryption, and to avoid duplication in case one of your packages requires the other, you get to select which one to use by the plugin code. By default "pycryptodomex" is used and only legacy code uses that. However it will fallback to "pycryptodome" if that's the only one installed, and you can enforce Nuitka choice if both are for some reason. | — | — |
| upx-binary | The UPX binary to use or the directory it lives in, by default `upx` from PATH is used. | — | — |
| upx-disable-cache | Do not cache UPX compression result, by default DLLs are cached, exe files are not. | — | — |
| include-pickle-support-module | Include support for these modules to pickle nested compiled functions. You can use "all" which is the default, but esp. in module mode, just might want to limit yourself to not create unnecessary run-time usages. For standalone mode, you can leave it at the default, at it will detect the usage. | — | — |
| include-pmw-blt | Should 'Pmw.Blt' not be included, Default is to include it. | — | — |
| include-pmw-color | Should 'Pmw.Color' not be included, Default is to include it. | — | — |
| tk-library-dir | The Tk library dir. Nuitka is supposed to automatically detect it, but you can override it here. Default is automatic detection. | — | — |
| tcl-library-dir | The Tcl library dir. See comments for Tk library dir. | — | — |
| include-qt-plugins | Which Qt plugins to include. These can be big with dependencies, so by default only the "sensible" ones are included, but you can also put "all" or list them individually. If you specify something that does not exist, a list of all available will be given. | — | — |
| noinclude-qt-plugins | Which Qt plugins to not include. This removes things, so you can ask to include "all" and selectively remove from there, or even from the default sensible list. | — | — |
| noinclude-qt-translations | Include Qt translations with QtWebEngine if used. These can be a lot of files that you may not want to be included. | — | — |
| qt-debug-plugins | Sets the "QT_DEBUG_PLUGINS" environment variable to "1" in the created standalone, so you can debug what plugin loading issues there might be. | — | — |
| disable-cache | Disables caching of compiled binaries. Defaults to false. | — | — |
| caching-key | An optional string to make the Nuitka build cache key more specific. This can be used for manual cache invalidation or to segment caches based on custom criteria. This key itself is not passed to Nuitka. | no | caching |
Outputs
no outputs