feat: modernize to uv + pyproject.toml + src/ layout + python-semantic-release

.github/workflows/ci.yml

@@ -4,24 +4,44 @@ on:
     branches:
       - master
   pull_request:
+  # Allow this workflow to be called from other workflows
+  workflow_call:
 
 jobs:
-  codejail_ci:
-    name: tests
+  quality:
+    name: quality
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        with:
+          enable-cache: true
+          python-version: "3.12"
+
+      - name: Install CI dependencies
+        run: uv sync --group ci
+
+      - name: Run quality checks
+        run: uv run tox -e quality
+
+  tests:
+    name: ${{ matrix.toxenv }}
     runs-on: ubuntu-${{ matrix.ubuntu_version }}
     strategy:
       fail-fast: false
       matrix:
         python_version: ['3.12']
         ubuntu_version: ['22.04', '24.04']
-        tox_env: [ "django42", "django52"]
-        include:
-          - tox_env: quality
-            ubuntu_version: '24.04'
-            python_version: '3.12'
+        toxenv: ['django42', 'django52']
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
       - name: Parse custom apparmor profile with ABI 3.0
         run: sudo apparmor_parser -r -W apparmor-profiles/home.sandbox.codejail_sandbox.bin.python-abi3
 
@@ -39,4 +59,4 @@ jobs:
             openedx-codejail tail -f /dev/null
 
       - name: Run Tests
-        run: docker exec -e TOXENV=${{ matrix.tox_env }} -t codejail bash -c 'tox'
+        run: docker exec -e TOXENV=${{ matrix.toxenv }} -t codejail bash -c 'tox'

.github/workflows/release.yml

@@ -0,0 +1,79 @@
+name: Release
+
+on:
+  push:
+    branches: [master]
+
+jobs:
+  run_ci:
+    uses: ./.github/workflows/ci.yml
+    secrets: inherit
+    permissions:
+      contents: read
+
+  release:
+    needs: run_ci
+    runs-on: ubuntu-latest
+    if: github.ref_name == 'master'
+    concurrency:
+      group: ${{ github.workflow }}-release-${{ github.ref_name }}
+      cancel-in-progress: false
+
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ github.ref_name }}
+
+      - name: Force branch to workflow sha
+        run: git reset --hard ${{ github.sha }}
+
+      - name: Run Semantic Release
+        id: release
+        uses: python-semantic-release/python-semantic-release@8f4d8c4e3e4fcd2b8df16444b148aa49920cc4d3 # v10.6.1
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          git_committer_name: "github-actions"
+          git_committer_email: "actions@users.noreply.github.com"
+          changelog: "false"
+
+      - name: Upload to GitHub Release Assets
+        uses: python-semantic-release/publish-action@98e6c872368aff4290ef8444db095e5bcd3fba6c # v10.6.1
+        if: steps.release.outputs.released == 'true'
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          tag: ${{ steps.release.outputs.tag }}
+
+      - name: Upload distribution artifacts
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        if: steps.release.outputs.released == 'true'
+        with:
+          name: distribution-artifacts
+          path: dist
+          if-no-files-found: error
+
+    outputs:
+      released: ${{ steps.release.outputs.released || 'false' }}
+      version: ${{ steps.release.outputs.version }}
+
+  publish_to_pypi:
+    runs-on: ubuntu-latest
+    needs: release
+    if: github.ref_name == 'master' && needs.release.outputs.released == 'true'
+
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - name: Download build artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: distribution-artifacts
+          path: dist
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@6733eb7d741f0b11ec6a39b58540dab7590f9b7d # v1.14.0

Dockerfile

@@ -29,7 +29,7 @@ RUN apt-get install -y sudo git make curl build-essential
 # ---------------------------------------------------------------------------
 RUN curl -sS https://bootstrap.pypa.io/get-pip.py -o get-pip.py && \
     python${python_version} get-pip.py --break-system-packages && rm get-pip.py
-RUN pip install virtualenv --break-system-packages
+RUN pip install uv --break-system-packages
 
 # Define Environment Variables
 ENV CODEJAIL_GROUP=sandbox
@@ -38,9 +38,9 @@ ENV CODEJAIL_TEST_USER=sandbox
 ENV CODEJAIL_TEST_VENV=/home/sandbox/codejail_sandbox
 
 # Create Virtualenv for sandbox user
-RUN virtualenv -p python${python_version} --always-copy $CODEJAIL_TEST_VENV
+RUN python${python_version} -m venv --copies $CODEJAIL_TEST_VENV
 
-RUN virtualenv -p python${python_version} venv
+RUN python${python_version} -m venv /venv
 ENV VIRTUAL_ENV=/venv
 
 # Add venv/bin to path
@@ -66,20 +66,22 @@ RUN chown -R $CODEJAIL_TEST_USER:$CODEJAIL_GROUP $CODEJAIL_TEST_VENV
 
 WORKDIR /codejail
 
-# Clone Requirement files
-COPY ./requirements/sandbox.txt /codejail/requirements/sandbox.txt
-COPY ./requirements/testing.txt /codejail/requirements/testing.txt
-COPY ./requirements/tox.txt /codejail/requirements/tox.txt
+# Copy dependency files first for Docker layer caching
+COPY pyproject.toml uv.lock /codejail/
 
-# Install codejail_sandbox sandbox dependencies
-RUN source $CODEJAIL_TEST_VENV/bin/activate && pip install -r /codejail/requirements/sandbox.txt && deactivate
+# Install codejail_sandbox sandbox dependencies (numpy, six) into the sandbox venv
+RUN source $CODEJAIL_TEST_VENV/bin/activate && pip install numpy six && deactivate
 
-# Install testing requirements in parent venv
-RUN pip install -r /codejail/requirements/sandbox.txt -r /codejail/requirements/testing.txt -r /codejail/requirements/tox.txt
+# Install testing and tox dependencies using uv into the main venv
+RUN uv pip install tox tox-uv --python $VIRTUAL_ENV/bin/python
 
 # Clone Codejail Repo
 COPY . /codejail
 
+# Install the package and test dependencies
+RUN uv pip install --python $VIRTUAL_ENV/bin/python -e . && \
+    uv pip install --python $VIRTUAL_ENV/bin/python numpy six pytest pytest-cov coverage
+
 # Setup sudoers file
 COPY sudoers-file/01-sandbox-python /etc/sudoers.d/01-sandbox
 

MANIFEST.in

@@ -1,6 +1,4 @@
 include LICENSE.txt
 include README.rst
-include requirements/*
 include apparmor-profiles/*
 include sudoers-file/*
-include requirements/constraints.txt

Makefile

@@ -1,11 +1,11 @@
 # Makefile for CodeJail
 .PHONY: clean dev-requirements quality requirements test test_no_proxy \
-        test_proxy upgrade upgrade
+        test_proxy upgrade isort
 
 clean:
-	find codejail -name '*.pyc' -exec rm -f {} +
-	find codejail -name '*.pyo' -exec rm -f {} +
-	find codejail -name '__pycache__' -exec rm -rf {} +
+	find src/codejail -name '*.pyc' -exec rm -f {} +
+	find src/codejail -name '*.pyo' -exec rm -f {} +
+	find src/codejail -name '__pycache__' -exec rm -rf {} +
 
 
 test: test_no_proxy test_proxy
@@ -18,34 +18,18 @@ test_proxy:
 	@echo "Running all tests with proxy process"
 	CODEJAIL_PROXY=1 pytest --junitxml=reports/pytest-proxy.xml --log-level=DEBUG
 
-COMMON_CONSTRAINTS_TXT=requirements/common_constraints.txt
-.PHONY: $(COMMON_CONSTRAINTS_TXT)
-$(COMMON_CONSTRAINTS_TXT):
-	wget -O "$(@)" https://raw.githubusercontent.com/edx/edx-lint/master/edx_lint/files/common_constraints.txt || touch "$(@)"
-
-upgrade: export CUSTOM_COMPILE_COMMAND=make upgrade
-upgrade: $(COMMON_CONSTRAINTS_TXT)
-	## update the requirements/*.txt files with the latest packages satisfying requirements/*.in
-	pip install -q -r requirements/pip_tools.txt
-	pip-compile --allow-unsafe --rebuild --annotation-style=line --upgrade -o requirements/pip_tools.txt requirements/pip_tools.in
-	pip install -q -r requirements/pip_tools.txt
-	pip-compile --annotation-style=line --upgrade -o requirements/tox.txt requirements/tox.in
-	pip-compile --annotation-style=line --upgrade -o requirements/testing.txt requirements/testing.in
-	pip-compile --annotation-style=line --upgrade -o requirements/sandbox.txt requirements/sandbox.in
-	pip-compile --annotation-style=line --upgrade -o requirements/development.txt requirements/development.in
-	# Handle Django via tox
-	sed -i '/^[dD]jango==/d' requirements/testing.txt
+upgrade: ## update uv.lock with the latest packages satisfying pyproject.toml constraints
+	uv run --with edx-lint edx_lint write_uv_constraints pyproject.toml
+	uv lock --upgrade
 
 quality: ## check coding style with pycodestyle and pylint
-	pycodestyle codejail *.py
-	isort --check-only --diff codejail *.py
-	pylint codejail *.py
+	uv run tox -e quality
 
 isort: ## apply automatic import sorting
-	isort --recursive codejail *.py
+	isort --recursive src/codejail *.py
 
 requirements: dev-requirements
 
 dev-requirements:
-	pip install -r requirements/sandbox.txt
-	pip install -r requirements/development.txt
+	uv sync --group dev
+	uv tool install tox --with tox-uv

codecov.yml

@@ -0,0 +1 @@
+# https://docs.codecov.com/docs/codecov-yaml