feat(packaging): move to uv

.ci/generate_documentation

@@ -10,12 +10,11 @@ if [ ! -d ${out_dir} ]; then
   exit 1
 fi
 
-pip3 install \
-  Sphinx \
-  sphinx_rtd_theme
-
 src_dir="${repo_dir}/docs"
-sphinx-build -E -av "${src_dir}" "${out_dir}"
+uv run \
+  --with Sphinx \
+  --with sphinx_rtd_theme \
+  sphinx-build -E -av "${src_dir}" "${out_dir}"
 
 # disable github's theme
 touch "${out_dir}/.nojekyll"

.ci/smoke-test

@@ -5,4 +5,4 @@ set -eu
 own_dir="$(dirname "${BASH_SOURCE[0]}")"
 repo_root="${own_dir}/.."
 
-"${repo_root}/src/smoke_test.py"
+uv run "${repo_root}/src/smoke_test.py"

.devcontainer/Dockerfile

@@ -13,9 +13,4 @@ RUN apt-get update \
 
 RUN mkdir -p /home/vscode/.kube && chown vscode /home/vscode/.kube
 
-COPY requirements*.txt /tmp/
-RUN --mount=type=cache,target=/root/.cache/pip \
-    pip3 install \
-    -r /tmp/requirements.txt \
-    -r /tmp/requirements-dev.txt \
-    && rm /tmp/requirements*.txt
+RUN pip3 install uv==0.12.3

.devcontainer/compose.yml

@@ -7,7 +7,7 @@ services:
       - ../:/workspaces/odg-core/:cached
 #      - $HOME/.claude:/home/vscode/.claude:cached
 #      - $HOME/.claude.json:/home/vscode/.claude.json:cached
-      - ${KUBECONFIG:-$HOME/.kube/config}:/home/vscode/.kube/config-orig:cached,ro
+      - $HOME/.kube/config:/home/vscode/.kube/config-orig:cached,ro
     command: sleep infinity
     environment:
       # For ODG service

.devcontainer/devcontainer.json

@@ -29,6 +29,7 @@
 						"source.organizeImports.ruff": "always"
 					}
 				},
+				"python.defaultInterpreterPath": "/workspaces/odg-core/.venv/bin/python",
 				"python.testing.pytestArgs": ["src"],
 				"python.testing.unittestEnabled": false,
 				"python.testing.pytestEnabled": true,

.devcontainer/post-create.sh

@@ -19,4 +19,4 @@ if [[ -f "$ORIG" ]]; then
 fi
 EOF
     echo "Kubeconfig refresh hook added to $BASHRC"
-fi
+fi

.github/workflows/build.yaml

@@ -29,10 +29,8 @@ jobs:
     outputs:
       version: ${{ steps.packages.outputs.version }}
     steps:
-      - name: install setuptools
-        run: |
-          pip3 install --root-user-action ignore \
-            setuptools
+      - name: Install the latest version of uv
+        uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
       - uses: gardener/cc-utils/.github/actions/trusted-checkout@v1
       - uses: gardener/cc-utils/.github/actions/install-gardener-gha-libs@v1
       - name: create distribution packages
@@ -60,7 +58,7 @@ jobs:
             setup.py \
           ; do
           echo "building distribution package from ${path}"
-          python3 ${path} \
+          uv run python3 ${path} \
               bdist_wheel \
               --dist-dir ${pkg_dir}
           rm -rf build
@@ -121,7 +119,7 @@ jobs:
         run: |
           set -euo pipefail
 
-          echo "${{ needs.prepare.outputs.version }}" | .ci/write-version
+          echo "${{ needs.prepare.outputs.version }}" | uv run .ci/write-version
 
           mkdir blobs.d
           tar czf blobs.d/extension_definitions.tar.gz extension-definitions.yaml
@@ -171,6 +169,8 @@ jobs:
       contents: read
     steps:
       - uses: gardener/cc-utils/.github/actions/trusted-checkout@v1
+      - name: Install the latest version of uv
+        uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
       - name: Retrieve Distribution Packages
         uses: actions/download-artifact@v4
         with:
@@ -179,21 +179,8 @@ jobs:
         run: |
           tar xf distribution-packages.tar.gz -C /tmp
 
-          echo "installing linters"
-          if ! pip3 install --pre --upgrade --break-system-packages \
-            --find-links /tmp/dist \
-            -r requirements.bdba-client.txt \
-            -r requirements.odg-client.txt \
-            -r requirements.txt \
-            numpy \
-            scipy \
-            bandit \
-            ruff \
-            setuptools \
-              > /tmp/pip3-install.log; then
-            echo "error while trying to install packages:"
-            cat /tmp/pip3-install.log
-          fi
+          echo "installing packages"
+          uv sync --find-links /tmp/dist
 
           echo "running linters"
           blobs_dir=blobs.d
@@ -202,13 +189,13 @@ jobs:
           bandit_evidence="${blobs_dir}/bandit.tar.gz"
 
           bandit_extra_args="-f txt -o ${bandit_logfile}" \
-            make lint
+            uv run make lint
 
           # pass bandit.log + used cfg (pyproject.toml) as evidence
           tar czf $bandit_evidence $bandit_logfile pyproject.toml
 
           echo "running format checker"
-          make format
+          uv run make format
       - uses: gardener/cc-utils/.github/actions/export-ocm-fragments@v1
         with:
           ocm-resources: |
@@ -237,6 +224,8 @@ jobs:
       contents: read
     steps:
       - uses: gardener/cc-utils/.github/actions/trusted-checkout@v1
+      - name: Install the latest version of uv
+        uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
       - name: Retrieve Distribution Packages
         uses: actions/download-artifact@v4
         with:
@@ -246,17 +235,11 @@ jobs:
           tar xf distribution-packages.tar.gz -C /tmp
 
           echo "installing packages"
-          if ! pip3 install --pre --upgrade --break-system-packages \
-            --find-links /tmp/dist \
-            -r requirements-dev.txt \
-              > /tmp/pip3-install.log; then
-            echo "error while trying to install packages:"
-            cat /tmp/pip3-install.log
-          fi
+          uv sync --find-links /tmp/dist
 
           echo "running tests"
           .ci/smoke-test
-          make test
+          uv run make test
 
   oci-image:
     name: Build OCI-Image

.github/workflows/create-hotfix-branch.yaml

@@ -37,7 +37,7 @@ jobs:
           git checkout "${odg_core_version}.0"
 
           next_version="${odg_core_version}.1-dev"
-          echo "$next_version" | .ci/write-version
+          echo "$next_version" | uv run .ci/write-version
           git commit --all -m "next version: ${next_version}"
 
           git push origin "@:refs/heads/hotfix-$odg_core_version"

.github/workflows/release-client-package.yaml

@@ -21,12 +21,8 @@ jobs:
           github-auth-token-permissions: |
             contents: write
           init-git-identity: true
-      - name: Install setuptools and semver
-        shell: bash
-        run: |
-          pip3 install \
-            setuptools \
-            semver
+      - name: Install the latest version of uv
+        uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
       - name: Create Distribution Package
         shell: bash
         run: |
@@ -39,7 +35,7 @@ jobs:
           path="setup.${{ inputs.client }}-client.py"
 
           echo "Building distribution package from ${path} to ${pkg_dir}"
-          python3 ${path} \
+          uv run python3 ${path} \
             bdist_wheel \
             --dist-dir ${pkg_dir}
 
@@ -76,8 +72,9 @@ jobs:
           version_file=${{ steps.version.outputs.version-file }}
 
           echo "$to_version" > "$version_file"
+          uv version --project "packages/${{ inputs.client }}-client" "$to_version"
 
-          git add "$version_file"
+          git add "$version_file" "packages/${{ inputs.client }}-client/pyproject.toml"
           git commit -m "Upgrade ${{ inputs.client }} client" -m "from ${from_version} to ${to_version}"
           git push
 

.gitignore

@@ -8,3 +8,7 @@ logs*
 .venv
 kubeconfig
 secrets/
+build/
+dist/
+*.egg-info/
+*.bak

Dockerfile

@@ -40,9 +40,8 @@ RUN --mount=type=bind,source=/dist,target=/dist \
 && curl https://aia.pki.co.sap.com/aia/SAPNetCA_G2_2.crt -o \
     /usr/local/share/ca-certificates/SAPNetCA_G2_2.crt \
 && update-ca-certificates \
-&& mkdir -p $HOME/.config/pip \
-&& echo -e "[global]\nbreak-system-packages = true" >> $HOME/.config/pip/pip.conf \
-&& pip3 install --upgrade --no-cache-dir --find-links ./dist odg-core-libs==${ODG_CORE_LIBS_VERSION} \
+&& pip3 install --break-system-packages uv==0.12.3 \
+&& uv pip install --system --break-system-packages --no-cache --find-links ./dist odg-core-libs==${ODG_CORE_LIBS_VERSION} \
 && apk del --no-cache \
     libc-dev \
     libffi-dev \

MANIFEST.in

@@ -0,0 +1,2 @@
+include VERSION
+recursive-include src *.py *.yaml *.conf

Makefile

@@ -35,7 +35,7 @@ help:
 # Setup development environment
 setup:
 	@echo "Installing development dependencies..."
-	@pip3 install --break-system-packages -r requirements-dev.txt
+	@uv sync
 	@echo "Generating RSA key pair as signing configuration..."
 	@keypath=$$(mktemp); \
 	unlink "$${keypath}"; \
@@ -46,7 +46,7 @@ setup:
 	unlink "$${keypath}.pub"; \
 	{ \
 		printf 'algorithm: RS256\n'; \
-		printf 'id: %s\n' "$$(python3 -c 'import uuid; print(uuid.uuid4())')"; \
+		printf 'id: %s\n' "$$(uv run python3 -c 'import uuid; print(uuid.uuid4())')"; \
 		printf 'private_key: |\n'; \
 		echo "$${private_key}" | sed 's/^/  /'; \
 		printf 'public_key: |\n'; \
@@ -74,10 +74,10 @@ build-clients:
 	@echo "Building client packages..."
 	@mkdir -p dist
 	@echo "Building bdba-client package..."
-	@python3 setup.bdba-client.py bdist_wheel --dist-dir dist
+	@uv run python3 setup.bdba-client.py bdist_wheel --dist-dir dist
 	@rm -rf build
 	@echo "Building odg-client package..."
-	@python3 setup.odg-client.py bdist_wheel --dist-dir dist
+	@uv run python3 setup.odg-client.py bdist_wheel --dist-dir dist
 	@rm -rf build
 	@echo "Client packages built:"
 	@ls -1 dist/
@@ -86,7 +86,7 @@ build-clients:
 build-core:
 	@echo "Building core package..."
 	@mkdir -p dist
-	@python3 setup.py bdist_wheel --dist-dir dist
+	@uv run setup.py bdist_wheel --dist-dir dist
 	@rm -rf build
 	@echo "Core package built:"
 	@ls -1 dist/

README.md

@@ -32,6 +32,8 @@ The ODG-Core Python HTTP web server can be started locally as a standalone appli
 First, you need to prepare your local environment.
 The Makefile implements convenient commands for setup, but makes certain assumptions (e.g. it **does not** use virtual environments). If you have a strong opinion on how to set up your local development environment, please review the Makefile in detail.
 
+Install `uv` e.g `brew install uv`.
+
 If you are fine with installing the Python packages globally, please run:
 
 ```shell
@@ -74,10 +76,10 @@ To work with a KinD cluster:
 1. Create the KinD cluster on the host: `kind create cluster --config .devcontainer/kind-config.yml`, which includes `host.docker.internal` as SAN
 1. Open the Dev Container (**Reopen in Container** in VS Code)
 1. Open a terminal session. The kubeconfig is refreshed on every shell startup, with `127.0.0.1` replaced by `host.docker.internal`
-1. Run `.devcontainer/prepare-kind.py` in the Dev Container to apply ODG CRDs and create `src/secrets/kubernetes/devcontainers-cluster.yaml`
+1. Run `uv run .devcontainer/prepare-kind.py` in the Dev Container to apply ODG CRDs and create `src/secrets/kubernetes/devcontainers-cluster.yaml`
 1. Update your local [configuration and secrets](https://open-component-model.github.io/open-delivery-gear/contents/how-to/00-hybrid-dev-setup.html#configuration-and-secrets)
 
-If you use Kubeconfig with multiple files, flatten first: `kubectl config view --raw --flatten > ~/.kube/config`.
+If you use Kubeconfig with multiple files, flatten the configs after you created the KinD cluster and before running the Dev Container: `kubectl config view --raw --flatten > ~/.kube/config`.
 
 To clean up the KinD cluster: `kind delete clusters odg-devcontainer-cluster`
 

packages/bdba-client/pyproject.toml

@@ -0,0 +1,14 @@
+[build-system]
+requires = ["setuptools"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "bdba-client"
+version = "0.15.0"
+requires-python = ">=3.12"
+dependencies = [
+    "cachecontrol",
+    "dacite",
+    "python-dateutil",
+    "requests",
+]

packages/odg-client/pyproject.toml

@@ -0,0 +1,16 @@
+[build-system]
+requires = ["setuptools"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "odg-client"
+description = "Client library for the Open Delivery Gear"
+version = "0.12.0"
+requires-python = ">=3.12"
+dependencies = [
+    "dacite",
+    "gardener-ocm",
+    "pycryptodome",
+    "pyjwt",
+    "requests",
+]

pyproject.toml

@@ -1,5 +1,66 @@
+[build-system]
+requires = ["setuptools", "semver"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "odg-core-libs"
+description = "Mandatory system internals for the Open Delivery Gear"
+requires-python = ">=3.12"
+dynamic = ["version"]
+dependencies = [
+    "bdba-client",
+    "odg-client",
+    "aiohttp",
+    "aiohttp-swagger3",
+    "awesomeversion",
+    "boto3",
+    "brotli",
+    "cachetools",
+    "cyclonedx-python-lib",
+    "dacite",
+    "dataclasses-json",
+    "gardener-cicd-libs",
+    "github3.py",
+    "htmllistparse",
+    "jsonpath-ng",
+    "jsonschema",
+    "kubernetes",
+    "prometheus_client",
+    "psycopg[binary]",
+    "pyjwt",
+    "requests",
+    "sqlalchemy>1.4.0",
+    "starlette",
+    "urllib3",
+    "uvicorn",
+    "watchdog",
+    "python-dateutil",
+]
+
+[tool.uv.workspace]
+members = ["packages/bdba-client", "packages/odg-client"]
+
+[tool.uv.sources]
+bdba-client = { workspace = true }
+odg-client = { workspace = true }
+
+[dependency-groups]
+dev = [
+    "aiohttp-devtools",
+    "aiosqlite",
+    "greenlet",
+    "numpy",
+    "pytest<9.1",
+    "pytest-asyncio",
+    "scipy",
+    "ruff",
+    "bandit",
+    "semver",
+    "setuptools",
+]
+
 [tool.bandit]
-exclude_dirs = ['test']
+exclude_dirs = ['test', '.venv']
 skips = [
   'B104', # we intendedly bind to `0.0.0.0` in productive environments only
   'B105', # we do not hardcode passwords