Migrate to modern Python tooling (uv, pyproject.toml, semantic-release)

.github/workflows/ci.yml

@@ -2,15 +2,19 @@ name: Python CI
 
 on:
   push:
-    branches: [master]
+    branches:
+      - master
   pull_request:
     branches:
       - "**"
+  workflow_call:
 
 jobs:
   run_tests:
-    name: Tests
+    name: ${{ matrix.toxenv }}
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -20,19 +24,18 @@ jobs:
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: setup python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
-        with:
-          python-version: ${{ matrix.python-version }}
 
-      - name: Install pip
-        run: pip install -r requirements/pip.txt
+      - name: Setup uv and Python
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          python-version: "${{ matrix.python-version }}"
+          enable-cache: true
 
       - name: Set env variable
         run: export AWS_CONFIG_FILE=/dev/null
 
-      - name: Install Dependencies
-        run: pip install -r requirements/ci.txt
+      - name: Install CI dependencies
+        run: uv sync --group ci
 
       - name: Install GNU gettext
         run: sudo apt-get install gettext
@@ -43,9 +46,7 @@ jobs:
           node-version-file: ".nvmrc"
 
       - name: Run Tests
-        env:
-          TOXENV: ${{ matrix.toxenv }}
-        run: tox
+        run: uv run tox -e ${{ matrix.toxenv }}
 
       - name: Run Coverage
         if: matrix.python-version == '3.12' && matrix.toxenv=='django42'

.github/workflows/release.yml

@@ -0,0 +1,121 @@
+name: Semantic Release
+
+on:
+  push:
+    branches: [master]
+
+jobs:
+  # The same aggregate a pull request has to pass, so the release runs exactly
+  # the checks that were required to merge -- and picks up any package added to
+  # ci.yml later without needing a change here.
+  run_ci:
+    uses: ./.github/workflows/ci.yml
+    secrets: inherit
+    permissions:
+      contents: read
+
+  release:
+    # Every package this workflow publishes has to build before we tag
+    # anything. The GitHub release and the PyPI uploads cannot be taken back,
+    # so a package that only fails to build in its publish job would leave the
+    # release half-finished.
+    needs: [run_ci]
+    runs-on: ubuntu-latest
+    if: github.ref_name == 'master'
+    concurrency:
+      group: ${{ github.workflow }}-release-${{ github.ref_name }}
+      cancel-in-progress: false
+
+    permissions:
+      contents: write
+
+    steps:
+      # Note: We checkout the repository at the branch that triggered the workflow.
+      # Python Semantic Release will automatically convert shallow clones to full clones
+      # if needed to ensure proper history evaluation. However, we forcefully reset the
+      # branch to the workflow sha because it is possible that the branch was updated
+      # while the workflow was running, which prevents accidentally releasing un-evaluated
+      # changes.
+      - name: Setup | Checkout Repository on Release Branch
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.ref_name }}
+
+      - name: Setup | Force release branch to be at workflow sha
+        run: |
+          git reset --hard ${{ github.sha }}
+
+      - name: Action | Semantic Version Release
+        id: release
+        # Adjust tag with desired version if applicable.
+        uses: python-semantic-release/python-semantic-release@9a026e9303981c866c3425723009becb2437c757 # v10.6.2
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          git_committer_name: "github-actions"
+          git_committer_email: "actions@users.noreply.github.com"
+          changelog: "false"
+          # Commit, tag, push and build, but don't create the GitHub release.
+          # We create it ourselves in the next step so that the distributions
+          # are attached before the release is published. See that step for why.
+          vcs_release: "false"
+
+      # This repo has immutable releases enabled, which freezes a release's
+      # assets the moment it is published, so assets cannot be attached
+      # afterwards. Everything we want on the release has to be built by now
+      # and passed to this one command, which creates the release as a draft,
+      # uploads the assets, and only then publishes it:
+      # https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/immutable-releases
+      - name: Publish | Create GitHub Release with Assets
+        if: steps.release.outputs.released == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # Reuse the release notes python-semantic-release generated for us.
+          RELEASE_NOTES: ${{ steps.release.outputs.release_notes }}
+          TAG: ${{ steps.release.outputs.tag }}
+        run: |
+          # Output the release notes to a file
+          printf '%s' "$RELEASE_NOTES" > "$RUNNER_TEMP/release_notes.md"
+          # Creates the release as a draft, uploads the assets, and then
+          # publishes it -- all within this one command.
+          gh release create "$TAG" \
+            --verify-tag \
+            --title "$TAG" \
+            --notes-file "$RUNNER_TEMP/release_notes.md" \
+            dist/*
+
+      - name: Upload | Distribution Artifacts
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        if: steps.release.outputs.released == 'true'
+        with:
+          name: dist
+          path: dist/
+          if-no-files-found: error
+
+    outputs:
+      released: ${{ steps.release.outputs.released || 'false' }}
+      version: ${{ steps.release.outputs.version }}
+
+  publish_to_pypi:
+    # 1. Separate out the publish step from the github release step to run each step at
+    #    the least amount of token privilege
+    # 2. Also, publishing can fail, and its better to have a separate job if you need to retry
+    #    and it won't require reversing the release.
+    runs-on: ubuntu-latest
+    needs: release
+    if: github.ref_name == 'master' && needs.release.outputs.released == 'true'
+
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - name: Setup | Download Build Artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: dist
+          path: dist/
+
+      - name: Publish to PyPi
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        with:
+          packages-dir: dist/

.readthedocs.yaml

@@ -16,7 +16,10 @@ build:
   tools:
     python: "3.12"
 
-# Optionally install extra requirements required to build your docs
+# Install doc dependencies from uv.lock using the doc dependency group
 python:
   install:
-  - requirements: requirements/docs.txt
+  - method: uv
+    command: sync
+    groups:
+      - doc

MANIFEST.in

@@ -1,16 +1,17 @@
 include LICENSE
 include AUTHORS
 include README.rst
-include setup.cfg
-include openassessment/xblock/static/dist/manifest.json
-include openassessment/xblock/static/dist/*.js
-include openassessment/xblock/static/dist/*.css
-include openassessment/xblock/static/css/*.css
-include openassessment/xblock/static/css/lib/backgrid/*.css
-include openassessment/xblock/static/js/openassessment*.js
-include openassessment/xblock/static/js/lib/backgrid/*.js
-include requirements/*.in
-recursive-include openassessment/xblock/static/js/src *.js
-recursive-include openassessment/templates *.html *.underscore
-recursive-include openassessment/locale *.po
-recursive-include openassessment/locale *.mo
+include src/openassessment/xblock/static/dist/manifest.json
+include src/openassessment/xblock/static/dist/*.js
+include src/openassessment/xblock/static/dist/*.css
+include src/openassessment/xblock/static/css/*.css
+include src/openassessment/xblock/static/css/lib/backgrid/*.css
+include src/openassessment/xblock/static/js/openassessment*.js
+include src/openassessment/xblock/static/js/lib/backgrid/*.js
+recursive-include src/openassessment/xblock/static/js/src *.js
+recursive-include src/openassessment/templates *.html *.underscore
+recursive-include src/openassessment/locale *.po
+recursive-include src/openassessment/locale *.mo
+prune .github
+prune htmlcov
+exclude .coverage coverage.xml