[irfanuddinahmad]

Summary

Modernize openedx-core to uv + pyproject.toml (PEP 621/735) + python-semantic-release.

Part of openedx/public-engineering#506 (tracked in openedx/public-engineering#516).

• Replace setup.py/setup.cfg with pyproject.toml (PEP 621 static metadata), version derived from git tags via setuptools-scm
• Switch from pip-compile to uv with PEP 735 dependency groups; commit uv.lock
• Update tox.ini to use tox-uv with uv-venv-lock-runner
• Update CI to use astral-sh/setup-uv; SHA-pin all actions
• Add python-semantic-release + release.yml, replacing the old token-based pypi-publish.yml with OIDC trusted publishing

Not included: src/ layout. This repo already uses src/openedx_{core,content,tagging,catalog} and src/openedx_django_lib, so Phase 0 of the org-wide migration (openedx/public-engineering#506's 2026-07-15 decision) required no changes here — MANIFEST.in, .coveragerc's (now [tool.coverage.run]) source, docs/conf.py's sys.path entries, and tox.ini already pointed at src/.

Removed

Deleted files: setup.py, setup.cfg, .coveragerc, .readthedocs.yml (legacy duplicate of .readthedocs.yaml), requirements/ (all .in/.txt files, constraints.txt, private.readme), .github/workflows/pypi-publish.yml (replaced by release.yml, OIDC instead of the PYPI_UPLOAD_TOKEN secret).

Removed Makefile targets:

Target	Reason
compile-requirements	pip-compile machinery, replaced by uv lock

upgrade and requirements targets were kept but rewritten to use uv (edx_lint write_uv_constraints + uv lock --upgrade, and uv sync --group dev, respectively) instead of pip-compile/pip-sync.

Versioning

Dynamic — setuptools-scm derives the build version from the latest git tag. Pre-flight check passed: latest git tag v1.1.0 matches the version currently live on PyPI (1.1.0), so the first automated release should compute the correct next version from conventional-commit history.

Testing Notes

Verified locally:

• uv lock resolves cleanly (156 packages)
• uv sync (base project, no groups) succeeds; editable install makes all five packages (openedx_core, openedx_content, openedx_tagging, openedx_django_lib, openedx_catalog) importable, with openedx_core.__version__ correctly resolving to 1.1.0 via importlib.metadata
• python -m build + twine check dist/* both pass; inspected the built wheel and confirmed all five packages (with py.typed markers) are bundled correctly
• mypy resolves the editable install correctly under this repo's existing src/ layout (ran ad hoc with a partial dependency set due to a local sandbox limitation below; it got past all import/plugin resolution and only flagged missing pytest/freezegun stubs from the deliberately-partial ad hoc install, not a resolution problem)
• tox -l lists all envs correctly (py312-django52, quality, docs, pii_check, lint-imports) — tox.ini parses cleanly against the new [dependency-groups] names

Could not verify locally: uv sync --group dev (and test/quality/doc) fails to build in this sandbox because mysqlclient has no macOS wheel and needs local MySQL client headers unavailable here. This predates the migration (same coupling existed via the old requirements/test.in) and is expected to build fine on GitHub Actions' ubuntu-latest runners, which ship with MySQL client libraries preinstalled. Full test-suite / quality-check execution therefore relies on this PR's own CI run.

Code reviewer notes

• PyPI OIDC trusted publisher needs configuring for openedx-core (tracked in the consolidated comment on Tbain/253 add tags count #506) before the first automated release can publish. OPENEDX_SEMANTIC_RELEASE_GITHUB_TOKEN is already a standard org-level secret used by many other repos, so no action needed there.
• Known, out-of-scope gap: .github/workflows/upgrade-python-requirements.yml calls openedx/.github's shared reusable workflow, which hardcodes add-paths: requirements. Now that requirements/ is deleted, that scheduled job will silently stop producing real dependency-upgrade PRs — same gap across every repo in this migration batch; needs a fix in openedx/.github itself, not here.
• mysqlclient is bundled into the test-base dependency group (and therefore test/quality/doc/ci/dev transitively), matching the pre-migration coupling in requirements/test.in → quality.in/doc.in/dev.in. This is why the "Not included"/"Testing Notes" sections above call out the local verification gap.
• [dependency-groups].ci is intentionally minimal (tox, tox-uv only, no include-group) — CI's own uv sync --group ci step only needs tox on PATH; tox installs each env's actual dependency group itself via uv-venv-lock-runner.

---

This PR was created with Claude Code.

[openedx-webhooks]

Thanks for the pull request, @irfanuddinahmad!

This repository is currently maintained by @axim-engineering.

Once you've gone through the following steps feel free to tag them in a comment and let them know that your changes are ready for engineering review.

🔘 Get product approval

If you haven't already, check this list to see if your contribution needs to go through the product review process.

• If it does, you'll need to submit a product proposal for your contribution, and have it reviewed by the Product Working Group.
  • This process (including the steps you'll need to take) is documented here.
• If it doesn't, simply proceed with the next step.

🔘 Provide context

To help your reviewers and other members of the community understand the purpose and larger context of your changes, feel free to add as much of the following information to the PR description as you can:

• Dependencies

  This PR must be merged before / after / at the same time as ...

• Blockers

  This PR is waiting for OEP-1234 to be accepted.

• Timeline information

  This PR must be merged by XX date because ...

• Partner information

  This is for a course on edx.org.

• Supporting documentation
• Relevant Open edX discussion forum threads

🔘 Get a green build

If one or more checks are failing, continue working on your changes until this is no longer the case and your build turns green.

Details

---

Where can I find more information?

If you'd like to get more details on all aspects of the review process for open source pull requests (OSPRs), check out the following resources:

• Overview of Review Process for Community Contributions
• Pull Request Status Guide
• Making changes to your pull request

When can I expect my changes to be merged?

Our goal is to get community contributions seen and reviewed as efficiently as possible.

However, the amount of time that it takes to review and merge a PR can vary significantly based on factors such as:

• The size and impact of the changes that it introduces
• The need for product review
• Maintenance status of the parent repository

💡 As a result it may take up to several weeks or months to complete a review and merge your PR.

[salman2013]

Conflicts need to be resolved.

[feanil]

1.4.0 published Django, edx-drf-extensions and edx-organizations with no bounds, because setup.py read requirements/base.in and dropped the -c constraints.txt line. This branch publishes Django<6.0,>=5.2, edx-drf-extensions>=10.7.0 and edx-organizations>=9.0.0, and those are the only three Requires-Dist changes in the wheel.

<6.0 is the one that matters. It was a constraint on this repo's own installs; in released metadata it blocks openedx-platform from resolving Django 6 until openedx-core cuts a release. I also can't find where 10.7.0 comes from, base.txt pinned edx-drf-extensions==10.9.0.

Restore the unbounded specifiers, or say what each bound is for.

[irfanuddinahmad]

Restored unbounded Django/edx-drf-extensions/edx-organizations in published deps. The 10.7.0 floor didn't match any real release or historical pin — traced it to a stale snapshot from when the migration commit was authored. Django<6.0 stays in constraint-dependencies only.

[feanil]

We're dropping the uv run prefixes from Makefiles, so this goes back to pytest --cov-report html. The Makefile should assume the environment is already set up: activate the venv locally, put uv run in the workflow step in CI. openedx/public-engineering#506 (comment)

Same for the other uv run lines in this file, apart from the --with edx-lint one that upgrade needs.

[irfanuddinahmad]

Dropped uv run — bare pytest --cov-report html now.

[feanil]

Makefile:59 dropped lint-imports, so make quality doesn't run it locally any more. CI still covers it through the lint-imports.yml workflow, same as before.

Add it to [testenv:quality] rather than back to the Makefile. import-linter is already in the quality group through test-base, so it resolves there, and the CI matrix already runs tox -e quality. That makes lint-imports.yml redundant, so we can just drop that workflow in this PR.

Suggested change

	isort --check-only --diff src tests test_utils manage.py test_settings.py mysql_test_settings.py
	isort --check-only --diff src tests test_utils manage.py test_settings.py mysql_test_settings.py
	lint-imports

[irfanuddinahmad]

Added lint-imports to [testenv:quality]'s commands, right after isort — import-linter was already resolving via test-base.

[feanil]

This lint-imports entry in the envlist can be deleted. There's no [testenv:lint-imports] section, so it falls back to [testenv] and runs pytest again rather than the linter. We're gonna ad the import-linter to the quality check so we're still getting that coverage.

[irfanuddinahmad]

Removed the bogus lint-imports envlist entry.

[feanil]

62b51bc takes care of the uv run prefixes. The other three comments from last round are still open: the dependency bounds in pyproject.toml, moving lint-imports into [testenv:quality] and dropping lint-imports.yml, and the lint-imports entry in the tox envlist.

I rebuilt the wheel off 38916465 with SETUPTOOLS_SCM_PRETEND_VERSION=1.4.0 and re-diffed it against openedx_core-1.4.0 from PyPI. Still nothing dropped, still the same 11 README and ARCHITECTURE additions, and Requires-Dist still differs on exactly Django, edx-drf-extensions and edx-organizations. uv lock --check is clean and all 8 checks are green.

I tried the [testenv:quality] change locally to make sure it resolves: import-linter comes from the quality group through test-base, and tox -e quality finishes in 28s with Contracts: 2 kept, 0 broken. Worth doing now that main has added openedx_catalog as a fourth root package in .importlinter.

One new comment below, on branch protection.

[feanil]

Lint Python Imports is a required status check on main, so deleting this workflow means the check never reports on the head and this PR blocks on itself.

Before this merges and once lint-imports is in [testenv:quality] I can remove the requirements on the Python Lint Imports job. tests (ubuntu-latest, 3.12, quality, 8) is already required and covers it.

[irfanuddinahmad]

Left lint-imports.yml in place for now so the required check keeps reporting — lint-imports is wired into quality as of this commit, so this should be ready for you to lift the branch-protection requirement whenever you get a chance. Will remove the workflow file in a follow-up once that's done.

[feanil]

Add --locked here and on the uv run tox step below, so CI fails when uv.lock doesn't
match pyproject.toml instead of relocking it in the runner. Both pass on this branch as-is.

[irfanuddinahmad]

Added --locked to both steps, verified uv sync --locked --group ci passes cleanly.

[feanil]

nit: point this at [tool.edx_lint].uv_constraints. constraint-dependencies is written by
edx_lint write_uv_constraints on every make upgrade, so a bound hand-edited into it gets
overwritten.

[irfanuddinahmad]

Fixed -- pointed the comment at [tool.edx_lint].uv_constraints instead (the actual safe-to-edit spot), and confirmed directly that Django<6.0 is already covered globally via edx-lint's common_constraints.txt, so it was never at risk of being lost.

[feanil]

@irfanuddinahmad now that this has landed, I've dropped the requirement on the LintImports check and it should be safe to remove in a follow up PR. Feel free to tag me on it.