feat: add GET competency criteria-groups endpoint

.annotation_safe_list.yml

@@ -77,6 +77,12 @@ openedx_content.Unit:
   ".. no_pii:": "This model has no PII"
 openedx_content.UnitVersion:
   ".. no_pii:": "This model has no PII"
+openedx_learning.HistoricalCompetencyCriteriaGroup:
+  ".. no_pii:": "This model has no PII"
+openedx_learning.HistoricalCompetencyCriterion:
+  ".. no_pii:": "This model has no PII"
+openedx_learning.HistoricalCompetencyRuleProfile:
+  ".. no_pii:": "This model has no PII"
 social_django.Association:
   ".. no_pii:": "This model has no PII"
 social_django.Code:

.github/workflows/ci.yml

@@ -2,7 +2,8 @@ name: Python CI
 
 on:
   push:
-    branches: [ main ]
+    branches: [main]
+  workflow_call:
   pull_request:
     branches:
       - '**'
@@ -12,12 +13,14 @@ jobs:
   run_tests:
     name: tests
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
         os: [ubuntu-latest]  # Add macos-latest later?
         python-version: ['3.12']
-        toxenv: ["django52", "package", "quality"]
+        toxenv: ["django52", "package", "quality", "docs"]
         mysql-version: ["8"]
     services:
       mysql:
@@ -37,19 +40,15 @@ jobs:
           --health-retries 3
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: setup python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
+          enable-cache: true
           python-version: ${{ matrix.python-version }}
 
-      - name: Install pip
-        run: pip install -r requirements/pip.txt
-
-      - name: Install Dependencies
-        run: pip install -r requirements/ci.txt
+      - name: Install CI dependencies
+        run: uv sync --locked --group ci
 
       - name: Run Tests
-        env:
-          TOXENV: ${{ matrix.toxenv }}
-        run: tox -e ${{ matrix.toxenv }}
-
+        run: uv run --locked tox -e ${{ matrix.toxenv }}

.github/workflows/release.yml

@@ -0,0 +1,90 @@
+name: Release
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  run_tests:
+    uses: ./.github/workflows/ci.yml
+    secrets: inherit
+    permissions:
+      contents: read
+
+  release:
+    runs-on: ubuntu-latest
+    needs: run_tests
+    if: github.ref_name == 'main'
+    concurrency:
+      group: ${{ github.workflow }}-release-${{ github.ref_name }}
+      cancel-in-progress: false
+    permissions:
+      contents: write
+    outputs:
+      released: ${{ steps.release.outputs.released || 'false' }}
+      version: ${{ steps.release.outputs.version }}
+
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        ref: ${{ github.ref_name }}
+
+    - run: git reset --hard ${{ github.sha }}
+
+    - name: Python Semantic Release
+      id: release
+      uses: python-semantic-release/python-semantic-release@b700dbeb1f431a0fcc30a79f3f0869407fe07278 # v10.7.0
+      with:
+        github_token: ${{ secrets.GITHUB_TOKEN }}
+        git_committer_name: "github-actions"
+        git_committer_email: "github-actions@github.com"
+        changelog: "false"
+        # Commit, tag, push and build, but don't create the GitHub release.
+        # We create it ourselves in the next step so that the distributions
+        # are attached before the release is published. See that step for why.
+        vcs_release: "false"
+
+    # This repo has immutable releases enabled, which freezes a release's
+    # assets the moment it is published, so assets cannot be attached
+    # afterwards. `gh release create` handles this by creating the release as
+    # a draft, uploading the assets, and only then publishing it:
+    # https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/immutable-releases
+    - name: Publish | Create GitHub Release with Assets
+      if: steps.release.outputs.released == 'true'
+      env:
+        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        RELEASE_NOTES: ${{ steps.release.outputs.release_notes }}
+        TAG: ${{ steps.release.outputs.tag }}
+      run: |
+        printf '%s' "$RELEASE_NOTES" > "$RUNNER_TEMP/release_notes.md"
+        gh release create "$TAG" \
+          --verify-tag \
+          --title "$TAG" \
+          --notes-file "$RUNNER_TEMP/release_notes.md" \
+          dist/*
+
+    - name: Upload dist artifacts
+      if: steps.release.outputs.released == 'true'
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+      with:
+        name: dist
+        path: dist/
+        if-no-files-found: error
+
+  publish_to_pypi:
+    runs-on: ubuntu-latest
+    needs: release
+    if: github.ref_name == 'main' && needs.release.outputs.released == 'true'
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+    - name: Download dist artifacts
+      uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+      with:
+        name: dist
+        path: dist/
+
+    - name: Publish to PyPI
+      uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2

.gitignore

@@ -58,10 +58,6 @@ docs/modules.rst
 docs/openedx_content.rst
 docs/openedx_content.*.rst
 
-# Private requirements
-requirements/private.in
-requirements/private.txt
-
 # database file
 dev.db*
 

.importlinter

@@ -5,11 +5,14 @@
 
 [importlinter]
 root_packages =
+    openedx_catalog
     openedx_learning
     openedx_content
     openedx_tagging
     openedx_django_lib
     openedx_core
+contract_types =
+    isolated_apps: test_utils.isolated_apps_contract.IsolatedAppsContract
 
 # This is layering between our top-level src folders (mostly Django apps).
 # This should be updated as new Django apps are added.
@@ -19,17 +22,23 @@ name = "top-level source folders are layered correctly"
 type = layers
 layers =
     # Learning-domain features (currently CBE; Learning Pathways to follow).
-    # May build on content and tagging. Nothing below may import it: in
-    # particular, openedx_tagging must never know that CBE exists.
+    # May build on content, catalog and tagging. Nothing below may import it:
+    # in particular, openedx_tagging must never know that CBE exists.
     openedx_learning
 
-    # Content: authoring-side models and APIs.
+    # Content: authoring-side models and APIs. May reference catalog models
+    # (e.g. to associate content with a CourseRun).
     openedx_content
 
+    # Catalog: the enrollable things (course runs, catalog courses, pathways).
+    # Not aware of content; must never import openedx_content. See
+    # docs/openedx_catalog/decisions/0001-catalog-models-usage.rst
+    openedx_catalog
+
     # Tagging is very simple & fundamental. Should probably not depend on any other Django apps.
     openedx_tagging
 
-    # Django utilities. Should not dependend on any of the real apps (above).
+    # Django utilities. Should not depend on any of the real apps (above).
     openedx_django_lib
 
     # This just an empty shell package, to expose the __version__ number.
@@ -69,3 +78,17 @@ layers=
     # to create Learning Packages and manage the draft and publish states for
     # various types of content.
     openedx_content.applets.publishing
+
+# Mirrors openedx-platform's isolated-apps contract (see test_utils/isolated_apps_contract.py):
+# code outside an isolated app may only import its public modules (api, models_api, data,
+# tests). src_layering above only controls which top-level packages may depend on which.
+[importlinter:contract:isolated_apps]
+name = "code outside an isolated app only reaches its public API"
+type = isolated_apps
+isolated_apps =
+    openedx_catalog
+allowed_modules =
+    api
+    models_api
+    data
+    tests

.readthedocs.yaml

@@ -8,8 +8,16 @@ version: 2
 # Build documentation in the docs/ directory with Sphinx
 sphinx:
   configuration: docs/conf.py
+  fail_on_warning: true
+
+build:
+  os: ubuntu-lts-latest
+  tools:
+    python: "3.12"
 
 python:
-  version: 3.12
   install:
-    - requirements: requirements/doc.txt
+    - method: uv
+      command: sync
+      groups:
+        - doc

MANIFEST.in

@@ -1,5 +1,4 @@
 include CHANGELOG.rst
 include LICENSE.txt
 include README.rst
-include requirements/base.in
 recursive-include src *.html *.png *.gif *.js *.css *.jpg *.jpeg *.svg *.py *.yaml *.json *.csv

Makefile

@@ -29,41 +29,18 @@ docs: ## generate Sphinx HTML documentation, including API docs
 	tox -e docs
 	$(BROWSER)docs/_build/html/index.html
 
-# Define PIP_COMPILE_OPTS=-v to get more information during make upgrade.
-PIP_COMPILE = pip-compile --rebuild $(PIP_COMPILE_OPTS)
-
-compile-requirements: export CUSTOM_COMPILE_COMMAND=make upgrade
-compile-requirements: ## update the requirements/*.txt files with the latest packages satisfying requirements/*.in
-	pip install -qr requirements/pip-tools.txt
-	pip install -qr requirements/pip.txt
-	# Make sure to compile files after any other files they include!	
-	$(PIP_COMPILE) --allow-unsafe -o requirements/pip.txt requirements/pip.in
-	$(PIP_COMPILE) -o requirements/pip-tools.txt requirements/pip-tools.in
-	pip install -qr requirements/pip.txt
-	pip install -qr requirements/pip-tools.txt
-	$(PIP_COMPILE) -o requirements/base.txt requirements/base.in
-	$(PIP_COMPILE) -o requirements/test.txt requirements/test.in
-	$(PIP_COMPILE) -o requirements/doc.txt requirements/doc.in
-	$(PIP_COMPILE) -o requirements/quality.txt requirements/quality.in
-	$(PIP_COMPILE) -o requirements/ci.txt requirements/ci.in
-	$(PIP_COMPILE) -o requirements/dev.txt requirements/dev.in
-	# Let tox control the Django version for tests
-	sed '/^[dD]jango==/d' requirements/test.txt > requirements/test.tmp
-	mv requirements/test.tmp requirements/test.txt
-
-upgrade:  ## update the pip requirements files to use the latest releases satisfying our constraints
-	make compile-requirements PIP_COMPILE_OPTS="--upgrade"
+upgrade: ## update the uv.lock file with the latest packages satisfying pyproject.toml
+	uv run --with edx-lint edx_lint write_uv_constraints pyproject.toml
+	uv lock --upgrade
 
 quality: ## check coding style with pycodestyle and pylint
 	tox -e quality
-	lint-imports
 
 pii_check: ## check for PII annotations on all Django models
 	tox -e pii_check
 
 requirements: ## install development environment requirements
-	pip install -qr requirements/pip-tools.txt
-	pip-sync requirements/dev.txt requirements/private.*
+	uv sync --group dev
 
 test: clean ## run tests in the current virtualenv
 	pytest tests