Add uv dependabot workaround

.github/workflows/deploy.yaml

@@ -7,8 +7,34 @@ on:
     branches:
       - master
 jobs:
+  uv-sync:
+    # from https://github.com/win845/uv-light/blob/b4fabd9fc4fca621dd91bfe0a90e6ce6f17dd5ce/.github/workflows/push.yml#L7
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+    - uses: 'actions/[email protected]'
+      with:
+        fetch-depth: 2
+    - name: UV sync
+      id: uv-sync
+      # a new commit will not trigger this workflow again
+      run: |
+        pipx install uv
+        ./scripts/uv-sync.sh
+
+    - name: Commit file
+      uses: ryancyq/github-signed-commit@v1
+      env:
+        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      with:
+        files: |
+          uv.lock
+          requirements.txt
+        commit-message: uv sync
   deploy:
     runs-on: ubuntu-latest
+    needs: uv-sync
     permissions:
       contents: 'read'
       id-token: 'write'

.gitignore

@@ -1,5 +1,4 @@
 # Project specific
-requirements.txt
 .env_vars.yaml
 
 # ------------
@@ -78,9 +77,6 @@ target/
 # Jupyter Notebook
 .ipynb_checkpoints
 
-# pyenv
-.python-version
-
 # celery beat schedule file
 celerybeat-schedule
 

.python-version

@@ -0,0 +1 @@
+3.12.5

pyproject.toml

@@ -15,14 +15,16 @@ dependencies = [
     "surepy",
 ]
 
+[tool.uv.sources]
+surepy = { url = "https://github.com/therefromhere/surepy/archive/refs/heads/dst_bug_workaround.zip" }
+
+[tool.pytest.ini_options]
+pythonpath = "."
+
 [tool.uv]
 dev-dependencies = [
     "pytest<8",
     "pytest-freezegun>=0.4.2",
 ]
 
-[tool.uv.sources]
-surepy = { url = "https://github.com/therefromhere/surepy/archive/refs/heads/dst_bug_workaround.zip" }
-
-[tool.pytest.ini_options]
-pythonpath = "."
+# Note - scripts/uv-sync.sh will append here, it assumes tool.uv is the last section

requirements.txt

@@ -0,0 +1,82 @@
+#
+# This file is autogenerated by pip-compile with Python 3.12.5
+# by the following command:
+#
+#    pip-compile pyproject.toml
+#
+#
+# The above comment was added for dependabot to support uv.
+#
+# This file was autogenerated by uv via the following command:
+#    uv export --no-hashes -o requirements.txt
+aiodns==3.2.0 ; sys_platform == 'darwin' or sys_platform == 'linux'
+aiohappyeyeballs==2.4.3
+aiohttp==3.10.10
+aiosignal==1.3.1
+astral==3.2
+async-timeout==4.0.3
+asyncio==3.4.3
+attrs==24.2.0
+blinker==1.8.2
+brotli==1.1.0 ; platform_python_implementation == 'CPython'
+brotlicffi==1.1.0.0 ; platform_python_implementation != 'CPython'
+cachetools==5.5.0
+certifi==2024.8.30
+cffi==1.17.1 ; platform_python_implementation != 'CPython' or sys_platform == 'darwin' or sys_platform == 'linux'
+charset-normalizer==3.4.0
+click==8.1.7
+cloudevents==1.11.0
+colorama==0.4.6
+commonmark==0.9.1
+deprecated==1.2.14
+deprecation==2.1.0
+flask==3.0.3
+freezegun==1.5.1
+frozenlist==1.4.1
+functions-framework==3.8.1
+google-api-core==2.21.0
+google-auth==2.35.0
+google-cloud-appengine-logging==1.4.5
+google-cloud-audit-log==0.3.0
+google-cloud-core==2.4.1
+google-cloud-logging==3.11.2
+googleapis-common-protos==1.65.0
+grpc-google-iam-v1==0.13.1
+grpcio==1.66.2
+grpcio-status==1.66.2
+gunicorn==23.0.0 ; platform_system != 'Windows'
+idna==3.10
+importlib-metadata==8.4.0
+iniconfig==2.0.0
+itsdangerous==2.2.0
+jinja2==3.1.4
+markupsafe==3.0.1
+multidict==6.1.0
+opentelemetry-api==1.27.0
+packaging==24.1
+pluggy==1.5.0
+propcache==0.2.0
+proto-plus==1.24.0
+protobuf==5.28.2
+pyasn1==0.6.1
+pyasn1-modules==0.4.1
+pycares==4.4.0 ; sys_platform == 'darwin' or sys_platform == 'linux'
+pycparser==2.22 ; platform_python_implementation != 'CPython' or sys_platform == 'darwin' or sys_platform == 'linux'
+pygments==2.18.0
+pytest==7.4.4
+pytest-freezegun==0.4.2
+python-dateutil==2.9.0.post0
+pytz==2024.2
+requests==2.32.3
+rich==10.16.2
+rsa==4.9
+setuptools==75.1.0
+six==1.16.0
+surepy @ https://github.com/therefromhere/surepy/archive/refs/heads/dst_bug_workaround.zip
+tzdata==2024.2 ; sys_platform == 'win32'
+urllib3==2.2.3
+watchdog==5.0.3
+werkzeug==3.0.4
+wrapt==1.16.0
+yarl==1.15.0
+zipp==3.20.2

scripts/uv-sync.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+
+# adapted from https://github.com/win845/uv-light/blob/b4fabd9fc4fca621dd91bfe0a90e6ce6f17dd5ce/bin/uv-sync.sh
+
+set -e
+set -u
+
+PYTHON_VERSION=$(cat .python-version)
+#BRANCH_NAME=${GITHUB_REF#refs/heads/}
+AUTHOR_NAME=$(git log -1 --pretty=format:"%an")
+#AUTHOR_EMAIL=$(git log -1 --pretty=format:"%ae")
+
+if [[ "$AUTHOR_NAME" == *dependabot* ]] ; then
+    # Read requirements.txt, exclude comments, and format as TOML array
+    constraints=$(grep -vE '^\s*#' requirements.txt | awk '{print "  \""$0"\","}')
+
+    # Append constraint-dependencies to pyproject.toml
+    cat <<EOF >> pyproject.toml
+
+### generated scripts/uv-sync.sh , but not intended to be checked in! ###
+constraint-dependencies = [
+$constraints
+]
+EOF
+
+    echo "Lock uv with a new requirements.txt as constraint"
+    uv lock
+fi
+
+echo "Export uv.lock to requirements.txt"
+uv export --no-hashes -o requirements.txt
+
+# Add pip-compile like comment to the top of requirements.txt
+# for dependabot to detect a pip-compile workflow
+cat << EOF | cat - requirements.txt > temp && mv temp requirements.txt
+#
+# This file is autogenerated by pip-compile with Python $PYTHON_VERSION
+# by the following command:
+#
+#    pip-compile pyproject.toml
+#
+#
+# The above comment was added for dependabot to support uv.
+#
+EOF
+
+#git add uv.lock requirements.txt
+#if ! git diff --cached --quiet; then
+#    git config --global user.name "$AUTHOR_NAME"
+#    git config --global user.email "$AUTHOR_EMAIL"
+#    git commit -m "Sync uv.lock and requirements.txt"
+#    git push origin $BRANCH_NAME
+#    echo "push changes"
+#fi