Switch dependency managment to uv

Author: marcospri

.github/dependabot.yml

@@ -3,10 +3,10 @@
 version: 2
 updates:
   # Enable version updates for python
-  - package-ecosystem: "pip"
-    directory: "/requirements"
+  - package-ecosystem: "uv"
+    directory: "/"
     schedule:
-      interval: "daily"
+      interval: "weekly"
     open-pull-requests-limit: 16
     pull-request-branch-name:
       # so it's compatible with docker tags

.github/workflows/build-and-release.yaml

@@ -18,59 +18,21 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
 
-      - name: Setup Python
-        uses: actions/setup-python@v6
+      - uses: astral-sh/setup-uv@v10
         with:
           python-version: '3.12.3'
-          architecture: 'x64'
 
       - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          python -m pip install --no-deps -r requirements/requirements-lint.txt
+        run: uv sync --locked
 
       - name: Formatting (ruff)
-        run: ruff format --check .
+        run: uv run ruff format --check .
 
       - name: Linting (ruff)
-        run: ruff check --no-cache --output-format github .
-
-      - name: Install production requirements (for Mypy)
-        run: |
-          # Mypy needs production packages for typechecking
-          pip install --no-deps -r requirements/requirements-prod.txt
+        run: uv run ruff check --no-cache --output-format github .
 
       - name: Mypy
-        run: mypy
-
-  check-compiled-requirements:
-    runs-on: ubuntu-24.04
-    if: ${{ !contains(github.event.head_commit.message, '#notests') }}
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          ref: ${{ github.event.pull_request.head.ref }}
-      - uses: actions/setup-python@v6
-        with:
-          python-version: '3.12.3'
-
-      - name: Prepare environment
-        run: |
-          pip install --no-deps -r requirements/requirements-pip.txt
-          pip install $(grep -rwoh requirements -e 'pip-tools==.*[^\]' | head -n 1)
-
-      - name: Compile Requirements Files
-        run: |
-          ./scripts/pip-compile-all.sh
-
-      - name: Check If Output Matches Committed
-        run: |
-          DIFF="$(git diff)"
-          if [ "$DIFF" ]; then
-            echo "Compiled requirements differ from committed requirements!"
-            echo "$DIFF"
-            exit 1
-          fi
+        run: uv run mypy
 
   build:
     runs-on: ${{ matrix.runs-on }}

Dockerfile

@@ -56,15 +56,20 @@ RUN apt-get update \
     git \
     pkg-config \
     python3.12-dev \
-    python3.12-venv \
-    python3-pip \
     libmysqlclient-dev \
   && rm -rf /var/lib/apt/lists/*
 
-COPY /requirements/ /requirements/
-RUN python3.12 -m venv /opt/venv && \
-  /opt/venv/bin/python3.12 -m pip install --no-cache --no-deps -r /requirements/requirements-prod.txt -r /requirements/requirements-test.txt && \
-  /opt/venv/bin/python3.12 -m pip check
+WORKDIR /src
+COPY pyproject.toml uv.lock .python-version ./
+# Install uv, pinned to the version declared in pyproject.toml's [tool.uv]
+# required-version (the same canonical source CI's astral-sh/setup-uv step
+# reads), so there's exactly one place to bump it.
+RUN UV_VERSION="$(grep -m1 'required-version' pyproject.toml | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')" \
+  && curl -LsSf "https://astral.sh/uv/${UV_VERSION}/install.sh" | sh
+ENV PATH="/root/.local/bin:${PATH}"
+ENV UV_PROJECT_ENVIRONMENT=/opt/venv
+ENV UV_PYTHON_DOWNLOADS=never
+RUN uv sync --locked --no-install-project --no-default-groups --group test
 
 
 # --- Stage 2 --- #

README.md

@@ -17,6 +17,17 @@ authorization token from Google or another service for syncing your mail. Your c
 
 The sync engine will automatically begin syncing your account with the underlying provider. The `inbox-sync` command allows you to manually stop or restart the sync by running `inbox-sync stop [YOUR_ACCOUNT]@example.com` or `inbox-sync start [YOUR_ACCOUNT]@example.com`. Note that an initial sync can take quite a while depending on how much mail you have.
 
+### Managing Dependencies
+
+We use [`uv`](https://github.com/astral-sh/uv) to manage the pinning of our
+dependencies. New dependencies should be added to the appropriate section of
+`pyproject.toml` (`[project.dependencies]` for runtime dependencies, or the
+relevant `[dependency-groups]` entry for lint/test/dev-only dependencies) and
+then `uv lock` should be run to update `uv.lock`.
+
+Run `uv sync` to install dependencies into a local virtualenv, and `uv run
+<command>` to run a command against it (e.g. `uv run pytest`).
+
 ### API Service
 
 The API service provides a REST API for interacting with your data. To start 

pyproject.toml

@@ -1,3 +1,106 @@
+[project]
+name = "sync-engine"
+version = "0.1.0"
+description = "Close's email sync engine."
+requires-python = "==3.12.*"
+dependencies = [
+    "alembic==1.7.5",
+    "arrow==0.17.0",
+    "asn1crypto==0.24.0",
+    "attrs==23.1.0",
+    "authalligator-client @ https://github.com/closeio/authalligator-client/archive/e7cc8e0bc5b1f2285ab5997e2590a8eb056fc627.zip",
+    "boto3==1.35.50",
+    "botocore==1.35.50",
+    "ciso8601==2.2.0",
+    "click==8.1.7",
+    "colorlog==6.5.0",
+    "cryptography==48.0.1",
+    "dnspython==2.6.1",
+    "flanker @ https://github.com/closeio/flanker-new/archive/fa272d95345d45e8bb1f9bc32bc2c074bf52a484.zip",
+    "Flask==3.1.3",
+    "Flask-RESTful==0.3.9",
+    "gdata==2.0.18",
+    "gunicorn==23.0.0",
+    "hiredis==2.3.2",
+    "html2text==2020.1.16",
+    "icalendar==4.0.9",
+    "imapclient==2.2.0",
+    "importlib-metadata==4.8.1",
+    "importlib-resources==5.4.0",
+    "ipython==9.12.0",
+    "json_log_formatter==1.0",
+    "limitlion==1.1.0",
+    "lxml==6.1.0",
+    "mysqlclient==2.2.5",
+    "psutil==5.8.0",
+    "Pympler==0.9",
+    "PyNaCl==1.6.2",
+    "python-dateutil==2.8.2",
+    "python-json-logger==3.3.0",
+    "pytz==2026.1.post1",
+    "PyYAML==6.0.2",
+    "redis==5.0.2",
+    "requests==2.34.2",
+    "requests-file==1.5.1",
+    "s3transfer==0.10.3",
+    "sentry-sdk<3",
+    "setproctitle==1.2.2",
+    "setuptools==82.0.0",
+    "six==1.17.0",
+    "sqlalchemy==1.4.54",
+    "statsd==3.3.0",
+    "tldextract==3.1.2",
+    "structlog==23.1.0",
+    "typing_extensions",
+    "urllib3==2.7.0",
+    "vobject==0.9.6.1",
+    "WebOb==1.8.8",
+    "Werkzeug==3.1.8",
+    "zipp==3.20.2",
+    "zstandard==0.23.0",
+]
+
+[dependency-groups]
+lint = [
+    "mypy==1.13.0",
+    "ruff==0.8.2",
+    "types-boto",
+    "types-python-dateutil",
+    "types-pytz",
+    "types-PyYAML",
+    "types-redis",
+    "types-requests",
+]
+test = [
+    "atomicwrites==1.4.1",
+    "coverage==7.6.1",
+    "exceptiongroup==1.2.2",
+    "funcsigs==1.0.2",
+    "freezegun==1.5.1",
+    "hypothesis==6.113.0",
+    "iniconfig==2.0.0",
+    "mockredispy==2.9.3",
+    "more-itertools==10.5.0",
+    "packaging==24.2",
+    "pbr==6.1.0",
+    "pluggy==1.6.0",
+    "pyparsing==3.1.4",
+    "pytest==9.0.3",
+    "pytest-cov==5.0.0",
+    "pytest-timeout==2.3.1",
+    "responses==0.25.3",
+    "types-toml==0.10.8.20240310",
+    "sortedcontainers==2.4.0",
+    "toml==0.10.2",
+    "tomli==2.2.1",
+]
+dev = [{include-group = "lint"}, {include-group = "test"}]
+
+[tool.uv]
+required-version = "==0.12.7"
+# This is a service, not a library to be installed/imported by others.
+package = false
+
 [tool.ruff]
 target-version = "py312"
 line-length = 79