feat: modernize Python tooling to uv + pyproject.toml + semantic-release

.github/workflows/ci.yml

@@ -1,40 +1,41 @@
 name: Python CI
 
 on:
-  push:
-    branches: [master]
+  workflow_call:
   pull_request:
     branches:
     - '**'
 
 
 jobs:
   run_tests:
-    name: tests
+    name: ${{ matrix.toxenv }}
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
     strategy:
+      fail-fast: false
       matrix:
         os: [ubuntu-latest]
         python-version:
         - '3.12'
         toxenv: [quality, django42, django52]
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-    - name: setup python
-      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with:
-        python-version: ${{ matrix.python-version }}
+        fetch-depth: 0
 
-    - name: Install pip
-      run: pip install -r requirements/pip.txt
+    - name: Install uv
+      uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      with:
+        enable-cache: true
+        python-version: ${{ matrix.python-version }}
 
-    - name: Install Dependencies
-      run: pip install -r requirements/ci.txt
+    - name: Install CI dependencies
+      run: uv sync --group ci
 
     - name: Run Tests
-      env:
-        TOXENV: ${{ matrix.toxenv }}
-      run: make test
+      run: uv run tox -e ${{ matrix.toxenv }}
 
     - name: Run Coverage
       if: matrix.python-version == '3.12' && matrix.toxenv=='django52'

.github/workflows/release.yml

@@ -0,0 +1,90 @@
+name: Release
+
+on:
+  push:
+    branches: [master]
+
+jobs:
+  run_tests:
+    uses: ./.github/workflows/ci.yml
+    secrets: inherit
+    permissions:
+      contents: read
+
+  release:
+    runs-on: ubuntu-latest
+    needs: run_tests
+    if: github.ref_name == 'master'
+    concurrency:
+      group: ${{ github.workflow }}-release-${{ github.ref_name }}
+      cancel-in-progress: false
+    permissions:
+      contents: write
+    outputs:
+      released: ${{ steps.release.outputs.released || 'false' }}
+      version: ${{ steps.release.outputs.version }}
+
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        ref: ${{ github.ref_name }}
+        fetch-depth: 0
+
+    - run: git reset --hard ${{ github.sha }}
+
+    - name: Python Semantic Release
+      id: release
+      uses: python-semantic-release/python-semantic-release@v10.6.1
+      with:
+        github_token: ${{ secrets.OPENEDX_SEMANTIC_RELEASE_GITHUB_TOKEN }}
+        git_committer_name: "github-actions"
+        git_committer_email: "github-actions@github.com"
+        changelog: "false"
+        # Commit, tag, push and build, but don't create the GitHub release.
+        # We create it ourselves in the next step so that the distributions
+        # are attached before the release is published. See that step for why.
+        vcs_release: "false"
+
+    # This repo has immutable releases enabled, which freezes a release's
+    # assets the moment it is published, so assets cannot be attached
+    # afterwards. `gh release create` handles this by creating the release as
+    # a draft, uploading the assets, and only then publishing it:
+    # https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/immutable-releases
+    - name: Publish | Create GitHub Release with Assets
+      if: steps.release.outputs.released == 'true'
+      env:
+        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        RELEASE_NOTES: ${{ steps.release.outputs.release_notes }}
+        TAG: ${{ steps.release.outputs.tag }}
+      run: |
+        printf '%s' "$RELEASE_NOTES" > "$RUNNER_TEMP/release_notes.md"
+        gh release create "$TAG" \
+          --verify-tag \
+          --title "$TAG" \
+          --notes-file "$RUNNER_TEMP/release_notes.md" \
+          dist/*
+
+    - name: Upload dist artifacts
+      if: steps.release.outputs.released == 'true'
+      uses: actions/upload-artifact@v7
+      with:
+        name: dist
+        path: dist/
+
+  publish_to_pypi:
+    runs-on: ubuntu-latest
+    needs: release
+    if: needs.release.outputs.released == 'true'
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+    - name: Download dist artifacts
+      uses: actions/download-artifact@v8
+      with:
+        name: dist
+        path: dist/
+
+    - name: Publish to PyPI
+      uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # v1.14.1

.gitignore

@@ -51,6 +51,7 @@ diff_*.html
 *.report
 report
 venv
+.venv
 acceptance_tests.*.log
 acceptance_tests.*.png
 

MANIFEST.in

@@ -1,4 +1,2 @@
 include LICENSE
 include README.rst
-include requirements/base.in
-include requirements/constraints.txt

Makefile

@@ -6,49 +6,21 @@ help: ## display this help message
 	@echo "Please use \`make <target>' where <target> is one of"
 	@awk -F ':.*?## ' '/^[a-zA-Z]/ && NF==2 {printf "\033[36m  %-25s\033[0m %s\n", $$1, $$2}' $(MAKEFILE_LIST) | sort
 
-quality:
-	tox -e quality
+quality: ## check coding style with pycodestyle and pylint
+	uv sync --group quality
+	DJANGO_SETTINGS_MODULE=test_settings PYTHONPATH=. uv run pycodestyle --config=.pep8 src/edx_rest_api_client
+	DJANGO_SETTINGS_MODULE=test_settings PYTHONPATH=. uv run pylint --rcfile=pylintrc src/edx_rest_api_client
+	uv run python -m build
+	uv run twine check dist/*
 
 requirements: ## install development environment requirements
-	pip install -qr requirements/pip.txt
-	pip install -qr requirements/pip-tools.txt
-	pip-sync requirements/dev.txt requirements/private.*
+	uv sync --group dev
 
-test:
-	tox
+test: ## run tests in the current virtualenv
+	uv run tox
 
-piptools:
-	pip install -q -r requirements/pip-tools.txt
-
-define COMMON_CONSTRAINTS_TEMP_COMMENT
-# This is a temporary solution to override the real common_constraints.txt\n# In edx-lint, until the pyjwt constraint in edx-lint has been removed.\n# See BOM-2721 for more details.\n# Below is the copied and edited version of common_constraints\n
-endef
-
-COMMON_CONSTRAINTS_TXT=requirements/common_constraints.txt
-.PHONY: $(COMMON_CONSTRAINTS_TXT)
-$(COMMON_CONSTRAINTS_TXT):
-	wget -O "$(@)" https://raw.githubusercontent.com/edx/edx-lint/master/edx_lint/files/common_constraints.txt || touch "$(@)"
-	echo "$(COMMON_CONSTRAINTS_TEMP_COMMENT)" | cat - $(@) > temp && mv temp $(@)
-
-
-export CUSTOM_COMPILE_COMMAND = make upgrade
-compile-requirements: piptools $(COMMON_CONSTRAINTS_TXT)	## update the requirements/*.txt files with the latest packages satisfying requirements/*.in
-	# Make sure to compile files after any other files they include!
-	pip-compile ${COMPILE_OPTS} --allow-unsafe --rebuild -o requirements/pip.txt requirements/pip.in
-	pip-compile ${COMPILE_OPTS} --allow-unsafe --verbose --rebuild -o requirements/pip-tools.txt requirements/pip-tools.in
-	pip install -qr requirements/pip.txt
-	pip install -qr requirements/pip-tools.txt
-	pip-compile ${COMPILE_OPTS}  --allow-unsafe --verbose --rebuild -o requirements/base.txt requirements/base.in
-	pip-compile ${COMPILE_OPTS}  --allow-unsafe --verbose --rebuild -o requirements/test.txt requirements/test.in
-	pip-compile ${COMPILE_OPTS}  --allow-unsafe --verbose --rebuild -o requirements/dev.txt requirements/dev.in
-	pip-compile ${COMPILE_OPTS}  --allow-unsafe --verbose --rebuild -o requirements/pip-tools.txt requirements/pip-tools.in
-	pip-compile ${COMPILE_OPTS}  --allow-unsafe --verbose --rebuild -o requirements/ci.txt requirements/ci.in
-	# Let tox control the Django and DRF versions for tests
-	sed -i.tmp '/^django==/d' requirements/test.txt
-	sed -i.tmp '/^djangorestframework==/d' requirements/test.txt
-	rm requirements/test.txt.tmp
-
-upgrade:  ## update the pip requirements files to use the latest releases satisfying our constraints
-	$(MAKE) compile-requirements COMPILE_OPTS="--upgrade"
+upgrade: ## update the uv.lock file with the latest packages satisfying pyproject.toml
+	uv run --with edx-lint edx_lint write_uv_constraints pyproject.toml
+	uv lock --upgrade
 
 validate: test quality