feat: modernize to uv + pyproject.toml + semantic-release

.github/workflows/ci.yml

@@ -1,39 +1,47 @@
 name: Python CI
 
 on:
-  push:
-    branches: [master]
+  workflow_call:
   pull_request:
     branches:
     - '**'
 
 jobs:
   run_tests:
-    name: Tests
+    name: ${{ matrix.toxenv }}
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
     strategy:
+      fail-fast: false
       matrix:
         os: [ubuntu-latest]
         python-version: ['3.12']
         toxenv: [quality, docs, without-django, django42]
 
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-    - name: setup python
-      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
       with:
-        python-version: ${{ matrix.python-version }}
+        fetch-depth: 0
 
-    - name: Install pip
-      run: pip install -r requirements/pip.txt
+    - name: Install uv
+      uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      with:
+        enable-cache: true
+        python-version: ${{ matrix.python-version }}
 
-    - name: Install Dependencies
-      run: make requirements
+    - name: Install CI dependencies
+      run: uv sync --group ci
 
     - name: Run Tests
-      env:
-        TOXENV: ${{ matrix.toxenv }}
-      run: tox -- --hypothesis-profile=ci
+      run: uv run tox -e ${{ matrix.toxenv }} -- --hypothesis-profile=ci
+
+    - name: Generate coverage XML
+      if: matrix.python-version == '3.12' && matrix.toxenv == 'django42'
+      # Tox's uv-venv-lock-runner keeps `coverage` inside an isolated .tox venv,
+      # so it's not on PATH for the codecov-action step below (which shells out
+      # to a bare `coverage` command to turn the .coverage data file into XML).
+      run: uv run --with coverage coverage xml
 
     - name: Run Coverage
       if: matrix.python-version == '3.12' && matrix.toxenv == 'django42'

.github/workflows/release.yml

@@ -0,0 +1,66 @@
+name: Release
+
+on:
+  push:
+    branches: [master]
+
+jobs:
+  run_tests:
+    uses: ./.github/workflows/ci.yml
+    secrets: inherit
+    permissions:
+      contents: read
+
+  release:
+    runs-on: ubuntu-latest
+    needs: run_tests
+    if: github.ref_name == 'master'
+    concurrency:
+      group: ${{ github.workflow }}-release-${{ github.ref_name }}
+      cancel-in-progress: false
+    permissions:
+      contents: write
+    outputs:
+      released: ${{ steps.release.outputs.released || 'false' }}
+      version: ${{ steps.release.outputs.version }}
+
+    steps:
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      with:
+        ref: ${{ github.ref_name }}
+        fetch-depth: 0
+
+    - run: git reset --hard ${{ github.sha }}
+
+    - name: Python Semantic Release
+      id: release
+      uses: python-semantic-release/python-semantic-release@v10.6.1
+      with:
+        github_token: ${{ secrets.OPENEDX_SEMANTIC_RELEASE_GITHUB_TOKEN }}
+        git_committer_name: "github-actions"
+        git_committer_email: "github-actions@github.com"
+
+    - name: Upload dist artifacts
+      if: steps.release.outputs.released == 'true'
+      uses: actions/upload-artifact@v7
+      with:
+        name: dist
+        path: dist/
+
+  publish_to_pypi:
+    runs-on: ubuntu-latest
+    needs: release
+    if: needs.release.outputs.released == 'true'
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+    - name: Download dist artifacts
+      uses: actions/download-artifact@v8
+      with:
+        name: dist
+        path: dist/
+
+    - name: Publish to PyPI
+      uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # v1.14.1

.readthedocs.yaml

@@ -20,7 +20,10 @@ formats:
    - pdf
    - epub
 
-# Optionally set the version of Python and requirements required to build your docs
+# Install dependencies via uv, using the "doc" dependency group from pyproject.toml
 python:
    install:
-   - requirements: requirements/doc.txt
+   - method: uv
+     command: sync
+     groups:
+        - doc

CHANGELOG.rst

@@ -1,3 +1,5 @@
+.. changelog-insertion-marker
+
 # 3.1.0
 
 * The Django OpaqueKeyField subclasses like CourseKeyField now specify a default

MANIFEST.in

@@ -1,9 +1,5 @@
 include CHANGELOG.rst
 include LICENSE
 include README.rst
-include requirements/base.in
-include requirements/django.in
-recursive-include opaque_keys *.html *.png *.gif *js *.css *jpg *jpeg *svg *py
-include requirements/constraints.txt
-include requirements/base.txt
-include opaque_keys/py.typed
+recursive-include src/opaque_keys *.html *.png *.gif *js *.css *jpg *jpeg *svg *py
+include src/opaque_keys/py.typed

Makefile

@@ -15,28 +15,12 @@ html_coverage:
 	coverage html && open htmlcov/index.html
 
 
-requirements:
-	pip install -qr requirements/pip.txt
-	pip install -r requirements/dev.txt
+requirements: ## install development environment requirements
+	uv sync --group dev
 
-test:
-	tox
+test: ## run tests
+	uv run tox
 
-upgrade: export CUSTOM_COMPILE_COMMAND=make upgrade
-upgrade: ## update the requirements/*.txt files with the latest packages satisfying requirements/*.in
-	pip install -qr requirements/pip-tools.txt
-	pip install -qr requirements/pip.txt
-	pip-compile --upgrade --allow-unsafe --rebuild -o requirements/pip.txt requirements/pip.in
-	pip-compile --rebuild --upgrade -o requirements/pip-tools.txt requirements/pip-tools.in
-	pip install -qr requirements/pip.txt
-	pip install -qr requirements/pip-tools.txt
-	pip-compile --rebuild --upgrade -o requirements/base.txt requirements/base.in
-	pip-compile --rebuild --upgrade -o requirements/django.txt requirements/django.in
-	pip-compile --rebuild --upgrade -o requirements/test.txt requirements/test.in
-	pip-compile --rebuild --upgrade -o requirements/django-test.txt requirements/django-test.in
-	pip-compile --rebuild --upgrade -o requirements/doc.txt requirements/doc.in
-	pip-compile --rebuild --upgrade -o requirements/ci.txt requirements/ci.in
-	pip-compile --rebuild --upgrade -o requirements/dev.txt requirements/dev.in
-	# Let tox control the Django version for tests
-	sed '/^[dD]jango==/d' requirements/django-test.txt > requirements/django-test.tmp
-	mv requirements/django-test.tmp requirements/django-test.txt
+upgrade: ## update the uv.lock to use the latest releases satisfying our constraints
+	uv run --with edx-lint edx_lint write_uv_constraints pyproject.toml
+	uv lock --upgrade

codecov.yml

@@ -0,0 +1,23 @@
+coverage:
+  status:
+    project:
+      default:
+        target: auto
+        # This tooling migration (openedx/public-engineering#506) changed the
+        # coverage measurement scope: opaque_keys/**/tests/* is now correctly
+        # omitted from [tool.coverage.run] instead of counting test files'
+        # own (trivially self-covered) statements toward the package's
+        # coverage percentage. On this PR, that drops the reported total
+        # from 94.03% (31 files, including tests) to 92.46% (11 files,
+        # production code only) -- a one-time discontinuity in this PR's own
+        # base-vs-head comparison, not a regression in production-code
+        # coverage. No threshold added: `target: auto` compares against
+        # each PR's own base commit, so once this PR merges, 92.46% becomes
+        # the new baseline for every subsequent PR -- there's no lingering
+        # gap to accommodate, and this status check isn't required for
+        # merging anyway.
+    patch:
+      default:
+        target: 90%
+
+comment: false

mypy.ini

@@ -3,4 +3,4 @@ python_version = 3.12
 follow_imports = normal
 ignore_missing_imports = True
 allow_untyped_globals = False
-files = opaque_keys
+packages = opaque_keys