build: Modernize codejail to use uv and pyproject.toml

.github/workflows/ci.yml

@@ -4,6 +4,7 @@ on:
     branches:
       - master
   pull_request:
+  workflow_call:
 
 jobs:
   codejail_ci:

.github/workflows/release.yml

@@ -0,0 +1,83 @@
+name: Release
+
+on:
+  push:
+    branches: [master]
+
+jobs:
+  run_ci:
+    uses: ./.github/workflows/ci.yml
+
+  release:
+    needs: run_ci
+    runs-on: ubuntu-latest
+    if: github.ref_name == 'master'
+    concurrency:
+      group: ${{ github.workflow }}-release-${{ github.ref_name }}
+      cancel-in-progress: false
+
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.ref_name }}
+
+      - name: Force branch to workflow sha
+        run: git reset --hard ${{ github.sha }}
+
+      - name: Run Semantic Release
+        id: release
+        uses: python-semantic-release/python-semantic-release@9a026e9303981c866c3425723009becb2437c757 # v10.6.2
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          git_committer_name: "github-actions"
+          git_committer_email: "actions@users.noreply.github.com"
+          vcs_release: "false"
+
+      - name: Create GitHub Release with Assets
+        if: steps.release.outputs.released == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RELEASE_NOTES: ${{ steps.release.outputs.release_notes }}
+          TAG: ${{ steps.release.outputs.tag }}
+        run: |
+          printf '%s' "$RELEASE_NOTES" > "$RUNNER_TEMP/release_notes.md"
+          gh release create "$TAG" \
+            --verify-tag \
+            --title "$TAG" \
+            --notes-file "$RUNNER_TEMP/release_notes.md" \
+            dist/*
+
+      - name: Upload distribution artifacts
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        if: steps.release.outputs.released == 'true'
+        with:
+          name: distribution-artifacts
+          path: dist
+          if-no-files-found: error
+
+    outputs:
+      released: ${{ steps.release.outputs.released || 'false' }}
+      version: ${{ steps.release.outputs.version }}
+
+  publish_to_pypi:
+    runs-on: ubuntu-latest
+    needs: release
+    if: github.ref_name == 'master' && needs.release.outputs.released == 'true'
+
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - name: Download build artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: distribution-artifacts
+          path: dist
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2

CHANGELOG.rst

@@ -1,3 +1,7 @@
+.. DEPRECATED: This changelog is no longer maintained. Release notes are
+   published only on the GitHub Releases page:
+   https://github.com/openedx/codejail/releases
+
 Changelog
 #########
 

Dockerfile

@@ -31,6 +31,9 @@ RUN curl -sS https://bootstrap.pypa.io/get-pip.py -o get-pip.py && \
     python${python_version} get-pip.py --break-system-packages && rm get-pip.py
 RUN pip install virtualenv --break-system-packages
 
+# Install uv for dependency management (install system-wide to /usr/local/bin)
+RUN curl -LsSf https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh
+
 # Define Environment Variables
 ENV CODEJAIL_GROUP=sandbox
 ENV CODEJAIL_SANDBOX_CALLER=ubuntu
@@ -66,16 +69,15 @@ RUN chown -R $CODEJAIL_TEST_USER:$CODEJAIL_GROUP $CODEJAIL_TEST_VENV
 
 WORKDIR /codejail
 
-# Clone Requirement files
-COPY ./requirements/sandbox.txt /codejail/requirements/sandbox.txt
-COPY ./requirements/testing.txt /codejail/requirements/testing.txt
-COPY ./requirements/tox.txt /codejail/requirements/tox.txt
+# Copy project files needed for dependency installation
+COPY pyproject.toml uv.lock /codejail/
 
-# Install codejail_sandbox sandbox dependencies
-RUN source $CODEJAIL_TEST_VENV/bin/activate && pip install -r /codejail/requirements/sandbox.txt && deactivate
+# Install sandbox dependencies into the sandbox virtualenv from the
+# 'sandbox' dependency group
+RUN uv pip install --python $CODEJAIL_TEST_VENV/bin/python --no-cache-dir --group sandbox
 
-# Install testing requirements in parent venv
-RUN pip install -r /codejail/requirements/sandbox.txt -r /codejail/requirements/testing.txt -r /codejail/requirements/tox.txt
+# Install CI dependencies (tox + tox-uv) into the main venv from the 'ci' group
+RUN uv pip install --python $VIRTUAL_ENV/bin/python --no-cache-dir --group ci
 
 # Clone Codejail Repo
 COPY . /codejail

MANIFEST.in

@@ -1,6 +1,13 @@
-include LICENSE.txt
-include README.rst
-include requirements/*
+# Exclude development, test, and documentation folders
+prune .github
+prune docs
+
+# Exclude root level configuration and build files
+exclude Makefile
+exclude conftest.py
+exclude .gitignore
+exclude tox.ini
+
+# Include operational files needed by the package
 include apparmor-profiles/*
 include sudoers-file/*
-include requirements/constraints.txt

Makefile

@@ -3,9 +3,9 @@
         test_proxy upgrade upgrade
 
 clean:
-	find codejail -name '*.pyc' -exec rm -f {} +
-	find codejail -name '*.pyo' -exec rm -f {} +
-	find codejail -name '__pycache__' -exec rm -rf {} +
+	find src/codejail -name '*.pyc' -exec rm -f {} +
+	find src/codejail -name '*.pyo' -exec rm -f {} +
+	find src/codejail -name '__pycache__' -exec rm -rf {} +
 
 
 test: test_no_proxy test_proxy
@@ -18,34 +18,19 @@ test_proxy:
 	@echo "Running all tests with proxy process"
 	CODEJAIL_PROXY=1 pytest --junitxml=reports/pytest-proxy.xml --log-level=DEBUG
 
-COMMON_CONSTRAINTS_TXT=requirements/common_constraints.txt
-.PHONY: $(COMMON_CONSTRAINTS_TXT)
-$(COMMON_CONSTRAINTS_TXT):
-	wget -O "$(@)" https://raw.githubusercontent.com/edx/edx-lint/master/edx_lint/files/common_constraints.txt || touch "$(@)"
-
-upgrade: export CUSTOM_COMPILE_COMMAND=make upgrade
-upgrade: $(COMMON_CONSTRAINTS_TXT)
-	## update the requirements/*.txt files with the latest packages satisfying requirements/*.in
-	pip install -q -r requirements/pip_tools.txt
-	pip-compile --allow-unsafe --rebuild --annotation-style=line --upgrade -o requirements/pip_tools.txt requirements/pip_tools.in
-	pip install -q -r requirements/pip_tools.txt
-	pip-compile --annotation-style=line --upgrade -o requirements/tox.txt requirements/tox.in
-	pip-compile --annotation-style=line --upgrade -o requirements/testing.txt requirements/testing.in
-	pip-compile --annotation-style=line --upgrade -o requirements/sandbox.txt requirements/sandbox.in
-	pip-compile --annotation-style=line --upgrade -o requirements/development.txt requirements/development.in
-	# Handle Django via tox
-	sed -i '/^[dD]jango==/d' requirements/testing.txt
+upgrade: ## update python dependencies
+	uv run --with edx-lint edx_lint write_uv_constraints pyproject.toml
+	uv lock --upgrade
 
 quality: ## check coding style with pycodestyle and pylint
-	pycodestyle codejail *.py
-	isort --check-only --diff codejail *.py
-	pylint codejail *.py
+	pycodestyle src/codejail *.py
+	isort --check-only --diff src/codejail *.py
+	pylint src/codejail *.py
 
 isort: ## apply automatic import sorting
-	isort --recursive codejail *.py
+	isort --recursive src/codejail *.py
 
 requirements: dev-requirements
 
 dev-requirements:
-	pip install -r requirements/sandbox.txt
-	pip install -r requirements/development.txt
+	uv sync --group dev

pyproject.toml

@@ -0,0 +1,126 @@
+[build-system]
+requires = ["setuptools", "setuptools-scm>8.1"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "edx-codejail"
+description = "CodeJail manages execution of untrusted code in secure sandboxes. It is designed primarily for Python execution, but can be used for other languages as well."
+requires-python = ">=3.12"
+license = "Apache-2.0"
+license-files = ["LICENSE*"]
+authors = [
+    {name = "Open edX Project", email = "oscm@openedx.org"},
+]
+classifiers = [
+    "Development Status :: 5 - Production/Stable",
+    "Operating System :: POSIX :: Linux",
+    "Intended Audience :: Developers",
+    "Programming Language :: Python",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.12",
+]
+keywords = [
+    "Python",
+    "edx",
+    "codejail",
+]
+
+dynamic = ["readme", "version"]
+
+dependencies = [
+    "six",
+]
+
+[project.urls]
+Homepage = "https://github.com/openedx/codejail"
+Repository = "https://github.com/openedx/codejail"
+
+[dependency-groups]
+sandbox = [
+    "numpy",
+    "six",
+]
+test-base = [
+    {include-group = "sandbox"},
+    "pylint",
+    "pytest",
+    "isort",
+    "pycodestyle",
+]
+test = [
+    {include-group = "test-base"},
+    "Django>=5.2,<6.0",
+]
+django42 = [
+    {include-group = "test-base"},
+    "Django>=4.2,<5.0",
+]
+quality = [
+    {include-group = "test"},
+    "edx-lint",
+]
+ci = [
+    "tox",
+    "tox-uv",
+]
+dev = [
+    {include-group = "quality"},
+    {include-group = "ci"},
+]
+
+[tool.setuptools]
+include-package-data = true
+script-files = ["memory_stress.py"]
+
+[tool.setuptools.dynamic]
+readme = {file = ["README.rst"], content-type = "text/x-rst"}
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.setuptools.package-data]
+"*" = [
+    "tests/hello.txt",
+]
+
+[tool.semantic_release]
+build_command = "pip install build && SETUPTOOLS_SCM_PRETEND_VERSION=$NEW_VERSION python -m build"
+
+[tool.setuptools_scm]
+version_scheme = 'only-version'
+local_scheme = 'no-local-version'
+fallback_version = "0.0.0.dev0"
+
+[tool.uv]
+package = true
+conflicts = [
+    [{group = "django42"}, {group = "test"}],
+    [{group = "django42"}, {group = "quality"}],
+    [{group = "dev"}, {group = "django42"}],
+]
+constraint-dependencies = [
+    "Django<6.0",
+    "elasticsearch<7.14.0",
+    "social-auth-app-django<6.0.0",
+    "social-auth-core<5.0.0",
+    "pip<26.2.1",
+]
+
+[tool.edx_lint]
+uv_constraints = []
+
+[tool.coverage.run]
+branch = true
+source = ["codejail"]
+omit = [
+    "*/tests/doit.py",
+]
+
+[tool.coverage.report]
+show_missing = true
+
+[tool.isort]
+include_trailing_comma = true
+indent = "    "
+line_length = 120
+multi_line_output = 3