feat: modernize Python tooling (pyproject.toml + uv + semantic-release) by irfanuddinahmad · Pull Request #481 · openedx/edx-rbac

irfanuddinahmad · 2026-10-15T11:06:09Z

Summary

Moves edx-rbac from setup.py/pip-tools to pyproject.toml, uv and python-semantic-release.

Part of openedx/public-engineering#512 (parent openedx/public-engineering#506).

Package metadata now lives in pyproject.toml, and setuptools-scm reads the version from git tags. setup.py, setup.cfg and the hard-coded __version__ string are gone; __version__ and docs/conf.py now use importlib.metadata.
requirements/ is replaced by dependency groups and uv.lock. The Django cap and diff-cover==4.0.0 sit in [tool.uv].constraint-dependencies, so the published dependencies are unchanged.
tox uses tox-uv with the uv-venv-lock-runner. CI installs with setup-uv and runs the same matrix as before (quality, django42, django52, check_keywords).
release.yml comes from openedx/sample-plugin and publishes to PyPI through trusted publishing. It replaces publish_pypi.yml, which used a token.
The package now lives under src/edx_rbac/.

Before merging

PyPI trusted publisher configured for edx-rbac with repository openedx/edx-rbac, workflow release.yml.

The latest tag matching PyPI is v3.0.0 (3.0.0 on PyPI). It points at the same commit as the bare 3.0.0 tag. PSR ignores the bare tag and treats v3.0.0 as the last release, so the first automated release will be v3.1.0.

Testing

tox -e quality,django42,django52,check_keywords,docs passes locally on Python 3.12: 93 tests under each Django version, 84% coverage, the same as master.
The built wheel has the same 19 files as the 3.0.0 wheel on PyPI, and Requires-Dist is identical. Only the tag (py3-none-any instead of py2.py3) and the metadata fields (License-Expression AGPL-3.0-or-later, author Open edX Project, Requires-Python >=3.11) differ. The sdist still ships README, CHANGELOG, LICENSE and AUTHORS, and twine check passes.

Reviewer notes

include-package-data = false plus an explicit templates/** package-data entry keeps the wheel identical to 3.0.0. With true, setuptools-scm would also ship conf/locale/config.yaml.
requires-python = ">=3.11" matches the py311 env that tox.ini still lists.
The translation targets in the Makefile pointed at a nonexistent edx-rbac/ directory. They now point at src/edx_rbac.

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

openedx-webhooks · 2026-10-15T11:06:16Z

Thanks for the pull request, @irfanuddinahmad!

This repository is currently unmaintained.

🔘 Find a technical reviewer

To get help with finding a technical reviewer, reach out to the community contributions project manager for this PR:

On the right-hand side of the PR, find the Contributions project, click the caret in the top right corner to expand it, and check the "Primary PM" field for the name of your project manager.
Find their GitHub handle here.

Once you've gone through the following steps feel free to tag them in a comment and let them know that your changes are ready for engineering review.

🔘 Get product approval

If you haven't already, check this list to see if your contribution needs to go through the product review process.

If it does, you'll need to submit a product proposal for your contribution, and have it reviewed by the Product Working Group.
- This process (including the steps you'll need to take) is documented here.
If it doesn't, simply proceed with the next step.

🔘 Provide context

To help your reviewers and other members of the community understand the purpose and larger context of your changes, feel free to add as much of the following information to the PR description as you can:

Dependencies

This PR must be merged before / after / at the same time as ...
Blockers

This PR is waiting for OEP-1234 to be accepted.
Timeline information

This PR must be merged by XX date because ...
Partner information

This is for a course on edx.org.
Supporting documentation
Relevant Open edX discussion forum threads

🔘 Get a green build

If one or more checks are failing, continue working on your changes until this is no longer the case and your build turns green.

Details

Where can I find more information?

If you'd like to get more details on all aspects of the review process for open source pull requests (OSPRs), check out the following resources:

When can I expect my changes to be merged?

Our goal is to get community contributions seen and reviewed as efficiently as possible.

However, the amount of time that it takes to review and merge a PR can vary significantly based on factors such as:

The size and impact of the changes that it introduces
The need for product review
Maintenance status of the parent repository

💡 As a result it may take up to several weeks or months to complete a review and merge your PR.

…igrations Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

farhan · 2026-10-20T13:52:25Z

+[project]
+name = "edx-rbac"
+description = "Library to help managing role based access controls for django apps"
+requires-python = ">=3.11"


This publishes Requires-Python: >=3.11, which 3.0.0 didn't declare. The classifiers and the CI matrix only cover 3.12, and the py311 tox envs were never run in CI, so 3.11 would be advertised without being tested. Can you make it >=3.12 and drop py311 from the envlist, like help-tokens#350 did?

>=3.11 matches master's tox envlist, which still has py311 envs. Without it, uv locks only for whatever Python runs uv lock, and the py311 envs break. Dropping 3.11 support would be a separate change.

farhan · 2026-10-20T13:52:25Z

-include requirements/base.in
-recursive-include edx_rbac *.html *.png *.gif *js *.css *jpg *jpeg *svg *py
-include requirements/constraints.txt
+recursive-include src/edx_rbac *.html *.png *.gif *js *.css *jpg *jpeg *svg *py


The sdist grew from 49 files to 81 here. setuptools-scm adds every git-tracked file, so it now ships uv.lock, .github/, docs/, tests/, Makefile, tox.ini, pytest.ini, lint configs and more. Can you add excludes here?

prune .github prune docs prune tests prune test_utils prune locale prune htmlcov exclude uv.lock Makefile tox.ini pytest.ini pylintrc pylintrc_tweaks codecov.yml openedx.yaml db_keyword_overrides.yml manage.py test_settings.py .gitignore .annotation_safe_list.yml .pii_annotations.yml global-exclude .coverage coverage.xml

I'd keep this out of the migration PR. None of the merged migrations added sdist excludes, so it fits better as a separate follow-up.

farhan · 2026-10-20T13:52:25Z

+include-package-data = false
+
+[tool.setuptools.dynamic]
+readme = {file = ["README.rst", "CHANGELOG.rst"], content-type = "text/x-rst"}


Since the changelog is turned off in release.yml, CHANGELOG.rst won't be updated anymore (it stops at 3.0.0), but it's still appended to the PyPI description here. Can you drop it from readme and add a short note at the top of CHANGELOG.rst pointing to GitHub Releases?

Done, dropped it from readme and added a note at the top of CHANGELOG.rst pointing to GitHub Releases.

farhan · 2026-10-20T13:52:25Z

      env:
        TOXENV: ${{ matrix.toxenv }}
-      run: tox
+      run: uv run --locked tox


I think we can avoid --locked with uv run, with uv sync its already there

farhan · 2026-10-20T13:52:25Z

+  # the checks that were required to merge -- and picks up any package added to
+  # ci.yml later without needing a change here.
+  run_ci:
+    uses: ./.github/workflows/ci.yml


run_ci calls ci.yml without secrets: inherit, so on master pushes the Codecov step runs without CODECOV_TOKEN, and it has fail_ci_if_error: true. sample-plugin and XBlock are set up the same way, so tokenless upload is probably fine, but has this been confirmed? If the upload fails, release won't run.

Yes, openedx-chem has the same setup (no secrets: inherit, fail_ci_if_error: true) and the Codecov upload passed in its v2.0.1 release run.

CHANGELOG.rst is no longer updated now that release notes go to GitHub Releases, so stop appending it to the long description and note that at the top of the file. uv sync --locked already guards the lockfile in CI. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

irfanuddinahmad and others added 5 commits October 15, 2026 15:44

feat: consolidate package metadata into pyproject.toml

b958067

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

feat: switch dependency management from pip-tools to uv

6fce2b0

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

feat: add python-semantic-release

630b32a

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

refactor: migrate to src layout

de89512

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

fix: add read-only permissions to the CI job

66915b9

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

openedx-webhooks added open-source-contribution PR author is not from Axim or 2U core contributor PR author is a Core Contributor (who may or may not have write access to this repo). labels Oct 15, 2026

openedx-webhooks added this to Contributions Oct 15, 2026

github-project-automation Bot moved this to Needs Triage in Contributions Oct 15, 2026

irfanuddinahmad mentioned this pull request Oct 15, 2026

Modernize Python repo | Django Apps & Plugins openedx/public-engineering#512

Open

25 tasks

fix: align semantic-release and setuptools-scm settings with merged m…

b15a365

…igrations Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

farhan suggested changes Oct 20, 2026

View reviewed changes

mphilbrick211 moved this from Needs Triage to In Eng Review in Contributions Oct 22, 2026

Navigation Menu

Repository navigation

feat: modernize Python tooling (pyproject.toml + uv + semantic-release) - #481

feat: modernize Python tooling (pyproject.toml + uv + semantic-release)#481
irfanuddinahmad wants to merge 7 commits into
openedx:masterfrom
irfanuddinahmad:irfanuddinahmad/uv-migration

irfanuddinahmad commented Oct 15, 2026

Uh oh!

openedx-webhooks commented Oct 15, 2026

Uh oh!

farhan Oct 20, 2026

Uh oh!

irfanuddinahmad Oct 21, 2026

Uh oh!

farhan Oct 20, 2026

Uh oh!

irfanuddinahmad Oct 21, 2026

Uh oh!

farhan Oct 20, 2026

Uh oh!

irfanuddinahmad Oct 21, 2026

Uh oh!

farhan Oct 20, 2026

Uh oh!

irfanuddinahmad Oct 21, 2026

Uh oh!

farhan Oct 20, 2026

Uh oh!

irfanuddinahmad Oct 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

irfanuddinahmad commented Oct 15, 2026

Summary

Before merging

Testing

Reviewer notes

Uh oh!

openedx-webhooks commented Oct 15, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants