build: modernize packaging with uv, pyproject.toml and semantic-release

.github/workflows/ci.yml

@@ -1,11 +1,10 @@
 name: Python CI
 
 on:
-  push:
-    branches: [master]
   pull_request:
     branches:
     - '**'
+  workflow_call:
 
 jobs:
   tests:
@@ -20,20 +19,21 @@ jobs:
 
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-    - name: setup python
-      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+
+    - name: Install uv
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
       with:
+        enable-cache: true
         python-version: ${{ matrix.python-version }}
-    - name: Install pip
-      run: pip install -r requirements/pip.txt
+        # Puts .venv/bin (with `coverage` from the ci group) on PATH so the
+        # Codecov uploader can generate coverage.xml, as it did on master.
+        activate-environment: true
 
     - name: Install Dependencies
-      run: pip install -r requirements/ci.txt
+      run: uv sync --locked --group ci
 
     - name: Run Tests
-      env:
-        TOXENV: ${{ matrix.toxenv }}
-      run: tox
+      run: uv run tox -e ${{ matrix.toxenv }}
 
     - name: Run coverage
       if: matrix.python-version == '3.12' && matrix.toxenv == 'django52-celery54-drflatest'

.github/workflows/release.yml

@@ -0,0 +1,117 @@
+name: Semantic Release
+
+on:
+  push:
+    branches: [master]
+
+jobs:
+  # The same aggregate a pull request has to pass, so the release runs exactly
+  # the checks that were required to merge -- and picks up any package added to
+  # ci.yml later without needing a change here.
+  run_ci:
+    uses: ./.github/workflows/ci.yml
+
+  release:
+    # Every package this workflow publishes has to build before we tag
+    # anything. The GitHub release and the PyPI uploads cannot be taken back,
+    # so a package that only fails to build in its publish job would leave the
+    # release half-finished.
+    needs: [run_ci]
+    runs-on: ubuntu-latest
+    if: github.ref_name == 'master'
+    concurrency:
+      group: ${{ github.workflow }}-release-${{ github.ref_name }}
+      cancel-in-progress: false
+
+    permissions:
+      contents: write
+
+    steps:
+      # Note: We checkout the repository at the branch that triggered the workflow.
+      # Python Semantic Release will automatically convert shallow clones to full clones
+      # if needed to ensure proper history evaluation. However, we forcefully reset the
+      # branch to the workflow sha because it is possible that the branch was updated
+      # while the workflow was running, which prevents accidentally releasing un-evaluated
+      # changes.
+      - name: Setup | Checkout Repository on Release Branch
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.ref_name }}
+
+      - name: Setup | Force release branch to be at workflow sha
+        run: |
+          git reset --hard ${{ github.sha }}
+
+      - name: Action | Semantic Version Release
+        id: release
+        # Adjust tag with desired version if applicable.
+        uses: python-semantic-release/python-semantic-release@b700dbeb1f431a0fcc30a79f3f0869407fe07278 # v10.7.0
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          git_committer_name: "github-actions"
+          git_committer_email: "actions@users.noreply.github.com"
+          changelog: "false"
+          # Commit, tag, push and build, but don't create the GitHub release.
+          # We create it ourselves in the next step so that the distributions
+          # are attached before the release is published. See that step for why.
+          vcs_release: "false"
+
+      # This repo has immutable releases enabled, which freezes a release's
+      # assets the moment it is published, so assets cannot be attached
+      # afterwards. Everything we want on the release has to be built by now
+      # and passed to this one command, which creates the release as a draft,
+      # uploads the assets, and only then publishes it:
+      # https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/immutable-releases
+      - name: Publish | Create GitHub Release with Assets
+        if: steps.release.outputs.released == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # Reuse the release notes python-semantic-release generated for us.
+          RELEASE_NOTES: ${{ steps.release.outputs.release_notes }}
+          TAG: ${{ steps.release.outputs.tag }}
+        run: |
+          # Output the release notes to a file
+          printf '%s' "$RELEASE_NOTES" > "$RUNNER_TEMP/release_notes.md"
+          # Creates the release as a draft, uploads the assets, and then
+          # publishes it -- all within this one command.
+          gh release create "$TAG" \
+            --verify-tag \
+            --title "$TAG" \
+            --notes-file "$RUNNER_TEMP/release_notes.md" \
+            dist/*
+
+      - name: Upload | Distribution Artifacts
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        if: steps.release.outputs.released == 'true'
+        with:
+          name: distribution-artifacts
+          path: dist
+          if-no-files-found: error
+
+    outputs:
+      released: ${{ steps.release.outputs.released || 'false' }}
+      version: ${{ steps.release.outputs.version }}
+
+  publish_to_pypi:
+    # 1. Separate out the publish step from the github release step to run each step at
+    #    the least amount of token privilege
+    # 2. Also, publishing can fail, and its better to have a separate job if you need to retry
+    #    and it won't require reversing the release.
+    runs-on: ubuntu-latest
+    needs: release
+    if: github.ref_name == 'master' && needs.release.outputs.released == 'true'
+
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - name: Setup | Download Build Artifacts
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        id: artifact-download
+        with:
+          name: distribution-artifacts
+          path: dist
+
+      - name: Publish to PyPi
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2

.gitignore

@@ -63,10 +63,6 @@ docs/modules.rst
 docs/rest_api.rst
 docs/user_tasks.rst
 
-# Private requirements
-requirements/private.in
-requirements/private.txt
-
 # tox environment temporary artifacts
 tests/__init__.py
 

.readthedocs.yaml

@@ -16,4 +16,7 @@ build:
 
 python:
   install:
-    - requirements: requirements/doc.txt
+    - method: uv
+      command: sync
+      groups:
+        - doc

.tx/config

@@ -2,14 +2,14 @@
 host = https://www.transifex.com
 
 [o:open-edx:p:edx-platform:r:django-user-tasks]
-file_filter = user_tasks/conf/locale/<lang>/LC_MESSAGES/django.po
-source_file = user_tasks/conf/locale/en/LC_MESSAGES/django.po
+file_filter = src/user_tasks/conf/locale/<lang>/LC_MESSAGES/django.po
+source_file = src/user_tasks/conf/locale/en/LC_MESSAGES/django.po
 source_lang = en
 type        = PO
 
 [o:open-edx:p:edx-platform:r:django-user-tasks-js]
-file_filter = user_tasks/conf/locale/<lang>/LC_MESSAGES/djangojs.po
-source_file = user_tasks/conf/locale/en/LC_MESSAGES/djangojs.po
+file_filter = src/user_tasks/conf/locale/<lang>/LC_MESSAGES/djangojs.po
+source_file = src/user_tasks/conf/locale/en/LC_MESSAGES/djangojs.po
 source_lang = en
 type        = PO
 

CHANGELOG.rst

@@ -1,3 +1,7 @@
+.. DEPRECATED: This changelog is no longer maintained. Release notes are
+   published only on the GitHub Releases page:
+   https://github.com/openedx/django-user-tasks/releases
+
 Change Log
 ----------
 

MANIFEST.in

@@ -1,7 +1,15 @@
-include AUTHORS
-include CHANGELOG.rst
-include LICENSE.txt
-include README.rst
-include requirements/base.in
-recursive-include user_tasks *.html *.png *.gif *js *.css *jpg *jpeg *svg *py
-include requirements/constraints.txt
+# Exclude development, test, and documentation folders
+prune .github
+prune docs
+prune tests
+
+# Exclude root level configuration and build files
+exclude Makefile
+exclude tox.ini
+exclude uv.lock
+exclude .gitignore
+
+# Exclude test/coverage artifacts
+prune htmlcov
+global-exclude .coverage
+global-exclude coverage.xml

Makefile

@@ -45,39 +45,27 @@ coverage: clean ## generate and view HTML coverage report
 	$(BROWSER) htmlcov/index.html
 
 docs: ## generate Sphinx HTML documentation, including API docs
-	tox -e docs
+	doc8 --ignore-path docs/_build --ignore-path docs/rest_api.rst README.rst docs
+	rm -f docs/user_tasks.rst
+	rm -f docs/modules.rst
+	make -C docs clean
+	make -C docs html
+	python -m build
+	twine check dist/*
 	$(BROWSER) docs/_build/html/index.html
 
 dummy_translations: ## generate dummy translation (.po) files
-	cd user_tasks && i18n_tool dummy
+	cd src/user_tasks && i18n_tool dummy
 
 extract_translations: ## extract strings to be translated, outputting .mo files
 	./manage.py makemessages -l en -v1 -d django
 	./manage.py makemessages -l en -v1 -d djangojs
 
 fake_translations: extract_translations dummy_translations compile_translations ## generate and compile dummy translation files
 
-# Define PIP_COMPILE_OPTS=-v to get more information during make upgrade.
-PIP_COMPILE = pip-compile --upgrade $(PIP_COMPILE_OPTS)
-
-upgrade: export CUSTOM_COMPILE_COMMAND=make upgrade
-upgrade: ## update the requirements/*.txt files with the latest packages satisfying requirements/*.in
-	pip install -qr requirements/pip-tools.txt
-	# Make sure to compile files after any other files they include!
-	$(PIP_COMPILE) --allow-unsafe --rebuild -o requirements/pip.txt requirements/pip.in
-	$(PIP_COMPILE) -o requirements/pip-tools.txt requirements/pip-tools.in
-	pip install -qr requirements/pip.txt
-	pip install -qr requirements/pip-tools.txt
-	$(PIP_COMPILE) -o requirements/base.txt requirements/base.in
-	$(PIP_COMPILE) -o requirements/test.txt requirements/test.in
-	$(PIP_COMPILE) -o requirements/doc.txt requirements/doc.in
-	$(PIP_COMPILE) -o requirements/quality.txt requirements/quality.in
-	$(PIP_COMPILE) -o requirements/ci.txt requirements/ci.in
-	$(PIP_COMPILE) -o requirements/dev.txt requirements/dev.in
-	# Let tox control the Django, djangorestframework, and celery versions for tests
-	sed -i.tmp '/^[d|D]jango==/d' requirements/test.txt
-	sed -i.tmp '/^djangorestframework==/d' requirements/test.txt
-	rm requirements/test.txt.tmp
+upgrade: ## update python dependencies
+	uv run --with edx-lint edx_lint write_uv_constraints pyproject.toml
+	uv lock --upgrade
 
 pull_translations: ## pull translations from Transifex
 	tx pull -t -a
@@ -86,12 +74,18 @@ push_translations: ## push source translation files (.po) from Transifex
 	tx push -s
 
 quality: ## check coding style with pycodestyle and pylint
-	tox -e quality
+	touch tests/__init__.py
+	pylint src/user_tasks
+	pylint tests
+	pylint schema
+	rm tests/__init__.py
+	pycodestyle schema tests src/user_tasks
+	pydocstyle schema tests src/user_tasks
+	isort --check-only --diff schema tests src/user_tasks manage.py test_settings.py
+	make help
 
 requirements: ## install development environment requirements
-	pip install -qr requirements/pip.txt
-	pip install -qr requirements/pip-tools.txt --exists-action w
-	pip-sync requirements/dev.txt requirements/private.*
+	uv sync --locked --group dev
 
 swagger-ui: ## view Swagger UI for the REST API documentation
 	tox -e docs
@@ -100,7 +94,7 @@ swagger-ui: ## view Swagger UI for the REST API documentation
 	. .tox/docs/bin/activate; ./manage.py migrate --settings=schema.settings; SWAGGER_JSON_PATH=docs/swagger.json ./manage.py runserver --settings=schema.settings
 
 test: clean ## run tests in the current virtualenv
-	pytest
+	python -Wd -m pytest $(PYTEST_ARGS)
 
 test-all: ## run tests on every supported Python/Django combination
 	tox -e quality

docs/conf.py

@@ -508,8 +508,8 @@ def on_init(app):  # pylint: disable=unused-argument
         bin_path = os.path.abspath(os.path.join(sys.prefix, 'bin'))
         apidoc_path = os.path.join(bin_path, apidoc_path)
 
-    check_call([apidoc_path, '-o', docs_path, os.path.join(root_path, 'user_tasks'),
-                os.path.join(root_path, 'user_tasks/migrations')])
+    check_call([apidoc_path, '-o', docs_path, os.path.join(root_path, 'src', 'user_tasks'),
+                os.path.join(root_path, 'src', 'user_tasks', 'migrations')])
 
 
 def setup(app):