chore: Modernize codejail to use uv and pyproject.toml

[farhan]

Important

PR implemented with the assistance of Claude Code. Refined and validated before being submitted for code review.

Modernize codejail
Part of openedx/public-engineering#517

Summary

• edx-codejail on PyPI
• Move the package into a src/ layout
• Replace setup.py/setup.cfg with pyproject.toml (PEP 621 static metadata)
• Switch from pip-compile to uv with PEP 735 dependency groups; commit uv.lock
• Retain pylint/isort/pycodestyle as on master
• Coverage config moved into pyproject.toml
• Keep ci.yml in parity with master — all jobs (test matrix + quality) run inside the Docker/AppArmor container; only a workflow_call trigger is added so release.yml can reuse it
• Add python-semantic-release + release.yml (OIDC trusted publishing), replacing the legacy pypi-release.yml
• Add commitlint.yml was already present on master — retained as-is

Removed/Updated

Deleted files: setup.py, setup.cfg, requirements/, .coveragerc, .github/workflows/pypi-release.yml

Removed Makefile targets:

Target	Reason
$(COMMON_CONSTRAINTS_TXT) (wget rule)	pip-compile/constraints infrastructure removed; edx-lint constraints now managed via [tool.edx_lint].uv_constraints

Updated Makefile targets:

Target	Change
upgrade	Replaced pip-compile with uv run --with edx-lint edx_lint write_uv_constraints pyproject.toml && uv lock --upgrade
requirements / dev-requirements	Replaced pip install -r requirements/*.txt with uv sync --group dev
quality	Updated path from codejail to src/codejail to reflect src/ layout move
isort	Updated path from codejail to src/codejail to reflect src/ layout move
clean	Updated path from codejail to src/codejail to reflect src/ layout move

Versioning

setuptools-scm with dynamic = ["version"] — master had a PyPI publish workflow; python-semantic-release controls the version string at release time via git tags.

Important Notes

• No [testenv:docs] — codejail has no docs infrastructure (no docs/ directory, no make docs target, no Sphinx configuration), so the docs tox environment was intentionally omitted.
• CI kept in parity with master — every job (the django42/django52 × Ubuntu 22.04/24.04 test matrix and quality) runs inside the Docker/AppArmor container via bash -c 'tox', exactly as on master. The only change to ci.yml is an added workflow_call trigger so release.yml can reuse it — so the required-check names are unchanged and branch protection needs no update.
• Dockerfile migrated to uv + dependency groups — the Dockerfile no longer copies requirements/*.txt; it copies pyproject.toml/uv.lock and installs from dependency groups via uv pip install --group: the sandbox virtualenv from the sandbox group (numpy, six) and the main venv from the ci group (tox, tox-uv). A sandbox dependency group was added to mirror the old sandbox.in. No follow-up on the Docker-based test infrastructure is required.
• commitlint.yml was already present — not added by this PR.
• Conventional commit format — release.yml uses python-semantic-release which requires conventional commits (feat/fix/etc.) for automated versioning. All future PRs to this repo must use conventional commit format.
• PSR baseline tag — existing git tags use v-prefixed format (e.g. v4.1.0) matching PSR's default tag_format = "v{version}". No manual baseline tag is required.

Testing Notes

This PR has not been manually tested against the repo's own features. Testing relied on CI checks and local agent tooling (make requirements, make quality, uv run python -m build). The Docker-based tests require AppArmor setup and cannot be run locally without the full Docker environment. Repo-owner is encouraged to run the repo's feature tests before merging.

---

🤖 Generated with Claude Code