Switch to uv for dependency management - #1149
Conversation
93ca935 to
3da4d69
Compare
fd5e7ca to
db6c605
Compare
tomodwyer
added
dependencies
mikerkelly
left a comment
mikerkelly
left a comment
There was a problem hiding this comment.
Thanks Thomas, the diff is obviously huge but this was a lot of work and I think as this is a relatively simple repository it makes sense to do it all in one PR so there is a clear before and after. Downside is more potential things to break when we deploy it...
I have some small questions and suggestions inline.
I also wonder if the format lint and lint-actions justfile recipes are needed now? They are not in the repo template and seem to overlap with just check / just fix.
we need to change the requirements for branch protection before merging this PR.
caution should be taken when merging this to be able to rollback in the case of errors.
Do you have a sequence of steps for the deploy and possible rollback in mind?
2c2ed06 to
665673f
Compare
Following repo-template Dockerfile
As my default formatter added quote marks around everything (which I prefer) - but for ease of review I have removed them from lines which haven't been edited.
So that they include reports and remove the comment
When the file was renamed and copied from repo-template it missed this dependent package.
And associated documentation
665673f to
75c1326
Compare
|
docker compose down --remove-orphans is used because it delegates project identification to Docker Compose
| upgrade-package package: && uvmirror devenv | ||
| uv lock --upgrade-package {{ package }} | ||
|
|
||
| # Upgrade all packages to the latest versions as of the cutoff in pyproject.toml |
There was a problem hiding this comment.
Currently getting:
just upgrade-all
uv lock --upgrade
× No solution found when resolving dependencies:
╰─▶ Because only sentry-sdk<2.67.1 is available and your project depends on
sentry-sdk>=2.67.1, we can conclude that your project's requirements are
unsatisfiable.
hint: Pre-releases are available for `sentry-sdk` in the requested range (e.g.,
3.0.0a7), but pre-releases weren't enabled (try: `--prerelease=allow`)
error: recipe `upgrade-all` failed on line 63 with exit code 1
There was a problem hiding this comment.
❯ just upgrade-all
uv lock --upgrade
Resolved 79 packages in 346ms
rm -f requirements.uvmirror.txt
uv export --format requirements-txt --frozen --no-hashes --all-groups --all-extras > requirements.uvmirror.txt
uv sync --inexact
Resolved 79 packages in 11ms
Checked 76 packages in 270ms
There was a problem hiding this comment.
I checked, and get similar to @tomodwyer here as of 8083167.
I haven't worked on reports for a little bit, so I ran just devenv before just upgrade-all and also saw sentry-sdk upgrade:
- sentry-sdk==2.66.1
+ sentry-sdk==3.0.0a7
Is there some other repository state, caching, or some other temporary glitch with PyPI that's happened for Mike?
Maybe worth trying again, perhaps with updated or rebuilt devenv?
3 participants
Closes #1095
This PR follows the steps listed in opensafely-core/osgithub#236 - updated in the issue listed above.
The extra changes made include:
This means we need to change the requirements for branch protection before merging this PR.
There is also no valid way of checking the workflow end-to-end without attempting to deploy to production, so caution should be taken when merging this to be able to rollback in the case of errors.
Preview of the updated job dependencies