build: uses uv for dependency locking#482
Conversation
jeandersonbc
force-pushed
the
fix-build-dependencies
branch
from
787ffda to
1765a01
Compare
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request migrates the project's dependency management and tooling from pip and setup.py to uv and pyproject.toml, updating the Makefile, README.md, and tox.ini accordingly. Feedback on these changes includes: 1) in tox.ini, running 'make tests' bypasses tox's isolated environments, so the test command should be run directly; 2) in the Makefile, hardcoding uv configurations prevents custom enterprise setups, and the 'clean' target's find command should be optimized using '-prune'; 3) the custom uv index in pyproject.toml is redundant and should be removed; and 4) the README.md should recommend uv's standalone installer instead of pip.
| # UV_NO_CONFIG bypasses system overrides | ||
| # UV_DEFAULT_INDEX enforces the use of PYPI registry | ||
| UV=UV_NO_CONFIG=1 UV_DEFAULT_INDEX=https://pypi.org/simple/ uv |
There was a problem hiding this comment.
Hardcoding UV_NO_CONFIG=1 and UV_DEFAULT_INDEX=https://pypi.org/simple/ prevents developers in enterprise environments from using their custom uv configurations, private package registries, or corporate proxies. It is better to allow UV to be overridden or simply default to uv without bypassing user configurations.
UV ?= uv
| [[tool.uv.index]] | ||
| url = "https://pypi.org/simple/" | ||
| default = true |
There was a problem hiding this comment.
Defining [[tool.uv.index]] pointing to PyPI as the default is redundant because uv already defaults to PyPI. Moreover, hardcoding this in pyproject.toml makes it harder for developers or CI environments using private package mirrors to override the index. It is recommended to remove this block.
jeandersonbc
force-pushed
the
fix-build-dependencies
branch
from
1765a01 to
369275d
Compare
Removes setup.py/setup.cfg, introduces uv.lock as the single universal lock file (with hashes), migrates tox to tox-uv, updates all CI workflows and the Makefile to use UV, adds a clean target, and documents the contributor workflow in the README.
jeandersonbc
force-pushed
the
fix-build-dependencies
branch
4 times, most recently
from
dcfaf79 to
be3d854
Compare
|
|
Closing this for now, as I want more time to address this. |
1 participant
This PR addresses the lack of dependency lock for development.
The main change is the adoption of UV to streamline development lifecycle:
I considered using pip-tools but the final result created way too many configuration files. UV is more convenient since it also brings control over python versions for development.