Migrate project dependency management from Pipenv to uv#1231
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughReplaces Pipenv with uv across project metadata, CI workflows, Dockerfile, tox, CONTRIBUTING, and ignores; workflows install pinned astral-sh/setup-uv and use ChangesPipenv to uv Migration
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/pre-release-tests.yml:
- Around line 31-35: Remove the trailing whitespace in the GitHub Actions
"Install uv" step: edit the step with name "Install uv" (the block containing
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b and with:
version: "0.11.16") and delete any trailing spaces on the empty/closing lines so
there are no trailing whitespace characters; save and re-run yamllint/CI to
confirm the lint error is resolved.
In @.github/workflows/tests.yml:
- Around line 105-109: In the "black" job's uv setup step (step name "Install
uv" using astral-sh/setup-uv), remove trailing whitespace from the version line
— the value version: "0.11.16" currently has extra spaces at the end; delete
those trailing spaces so the line ends immediately after the closing quote and
re-run yamllint to confirm the fix.
- Around line 123-129: The isort step calls the CLI "uv" but never installs it;
add a job step before the "isort" run to install the required package (e.g., run
pip install --upgrade pip && pip install uv) after the existing "Set up Python
3.9" step so that the "uv run isort meilisearch tests --check-only" command in
the isort step can be found and executed; reference the isort job step and the
exact run invocation "uv run isort meilisearch tests --check-only" when applying
the change.
In `@Dockerfile`:
- Line 6: The Dockerfile currently runs "RUN apt-get update -y" in its own
layer; combine that update with the following install command(s) into a single
RUN instruction (e.g., "RUN apt-get update -y && apt-get install -y <packages>
&& rm -rf /var/lib/apt/lists/*") or remove the standalone update if no packages
are installed, ensuring package installation and cleanup occur in one layer to
improve reproducibility and satisfy scanners; locate the standalone RUN apt-get
update -y line and merge it with the subsequent apt-get install usages in the
Dockerfile.
- Around line 3-4: In the Dockerfile layer that only copies pyproject.toml and
uv.lock (the COPY pyproject.toml . and COPY uv.lock . step), change the uv
command to use --no-install-project so that uv sync --frozen does not try to
install the local project before source is added; update the uv sync invocation
in that Dockerfile layer to include --no-install-project (keeping --frozen) to
avoid failing when the local package is not present yet.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 7c1f8b76-47cf-48c4-8962-a9a336c9b3fb
⛔ Files ignored due to path filters (2)
Pipfile.lockis excluded by!**/*.lockuv.lockis excluded by!**/*.lock
📒 Files selected for processing (10)
.github/workflows/documentation.yml.github/workflows/pre-release-tests.yml.github/workflows/pypi-publish.yml.github/workflows/tests.yml.gitignoreCONTRIBUTING.mdDockerfilePipfilepyproject.tomltox.ini
💤 Files with no reviewable changes (1)
- Pipfile
DhavalGojiya
force-pushed
the
feat/migrate-to-uv
branch
from
a795d90 to
07f8086
Compare
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/pypi-publish.yml:
- Around line 36-37: Replace the current secret-based upload (TWINE_USERNAME:
__token__, TWINE_PASSWORD: pypi-${{ secrets.PYPI_API_TOKEN }}) and the direct
twine invocation in the step that runs "uv run --with=twine -- twine upload
dist/*" with an OIDC-based publish flow: stop setting TWINE_PASSWORD from
secrets.PYPI_API_TOKEN, enable id-token: write and packages: write in the
workflow permissions, and use an OIDC-capable publisher (for example, switch to
the pypa/gh-action-pypi-publish action with use_oidc: true or request an OIDC
token and feed that token to TWINE_PASSWORD) so the twine upload step no longer
depends on the long-lived secrets.PYPI_API_TOKEN value.
- Around line 26-29: The workflow step "Install uv" (uses:
astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b) should explicitly
disable setup-uv's cache by adding the with key enable-cache: "false" alongside
the existing version: "0.11.16" so the PyPI publish job does not rely on GitHub
Actions cache restore/upload.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: b7fa490c-f5ea-45f1-97e0-3c5ddd610a22
⛔ Files ignored due to path filters (2)
Pipfile.lockis excluded by!**/*.lockuv.lockis excluded by!**/*.lock
📒 Files selected for processing (10)
.github/workflows/documentation.yml.github/workflows/pre-release-tests.yml.github/workflows/pypi-publish.yml.github/workflows/tests.yml.gitignoreCONTRIBUTING.mdDockerfilePipfilepyproject.tomltox.ini
💤 Files with no reviewable changes (1)
- Pipfile
✅ Files skipped from review due to trivial changes (1)
- .gitignore
| uv build | ||
| uv run --with=twine -- twine upload dist/* |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
ls -la .github/workflows || true
sed -n '1,140p' .github/workflows/pypi-publish.yml | nl -baRepository: meilisearch/meilisearch-python
Length of output: 647
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "---- pypi-publish.yml (full) ----"
cat -n .github/workflows/pypi-publish.yml | sed -n '1,200p'Repository: meilisearch/meilisearch-python
Length of output: 1163
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Find all usages of PyPI API token / twine password
rg -n "PYPI_API_TOKEN|TWINE_PASSWORD|TWINE_USERNAME|twine upload|trusted publishing|oidc|OIDC" .github/workflows -S || true
# Look for uv cache-related hardening/controls
rg -n "UV_CACHE|cache|setup-uv|astral-sh/setup-uv|cache-poison" .github/workflows -S || true
# Also scan any mentioned scripts
rg -n "trusted publishing|oidc|twine|TWINE_PASSWORD|PYPI_API_TOKEN" .github/scripts -S || trueRepository: meilisearch/meilisearch-python
Length of output: 1289
Switch PyPI publishing to OIDC trusted publishing (stop using PYPI_API_TOKEN for TWINE_PASSWORD).
The workflow uploads with TWINE_USERNAME: __token__ and TWINE_PASSWORD: "pypi-${{ secrets.PYPI_API_TOKEN }}", which requires a long-lived secret; using PyPI Trusted Publishing (OIDC) would avoid secret injection and reduce exposure/rotation burden.
🧰 Tools
🪛 zizmor (1.25.2)
[info] 37-37: prefer trusted publishing for authentication (use-trusted-publishing): this command
(use-trusted-publishing)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/pypi-publish.yml around lines 36 - 37, Replace the current
secret-based upload (TWINE_USERNAME: __token__, TWINE_PASSWORD: pypi-${{
secrets.PYPI_API_TOKEN }}) and the direct twine invocation in the step that runs
"uv run --with=twine -- twine upload dist/*" with an OIDC-based publish flow:
stop setting TWINE_PASSWORD from secrets.PYPI_API_TOKEN, enable id-token: write
and packages: write in the workflow permissions, and use an OIDC-capable
publisher (for example, switch to the pypa/gh-action-pypi-publish action with
use_oidc: true or request an OIDC token and feed that token to TWINE_PASSWORD)
so the twine upload step no longer depends on the long-lived
secrets.PYPI_API_TOKEN value.
There was a problem hiding this comment.
Switch PyPI publishing to OIDC trusted publishing (stop using PYPI_API_TOKEN for TWINE_PASSWORD).
@curquiza We should really consider switching to OIDC trusted publishing for publishing the project to PyPI in the near future, given the many supply chain and security attacks happening nowadays.
There was a problem hiding this comment.
Seems like the humans are having a chat. I'll hop back into my burrow for now. If you need me again, just tag @coderabbitai in a new comment, and I'll come hopping out!
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/pypi-publish.yml (1)
36-36: ⚡ Quick winPin Twine for deterministic CI uploads.
In
.github/workflows/pypi-publish.ymlline 36,uvx twine upload dist/*can resolve/install the latest Twine when Twine isn’t already cached, which makes release behavior drift over time. Prefer pinning an exact Twine version (e.g.,uvx twine@6.2.0 upload dist/*) or installing Twine with a locked/pinned version before upload.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/pypi-publish.yml at line 36, Replace the unpinned Twine invocation "uvx twine upload dist/*" with a pinned Twine version to ensure deterministic CI uploads; either call the runner tool with an exact Twine release (e.g., use "uvx twine@6.2.0 upload dist/*") or add a preceding step that installs Twine with a locked version (e.g., pip install twine==6.2.0) and then run "uvx twine upload dist/*" so the upload uses the pinned Twine release.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/pypi-publish.yml:
- Line 36: Replace the unpinned Twine invocation "uvx twine upload dist/*" with
a pinned Twine version to ensure deterministic CI uploads; either call the
runner tool with an exact Twine release (e.g., use "uvx twine@6.2.0 upload
dist/*") or add a preceding step that installs Twine with a locked version
(e.g., pip install twine==6.2.0) and then run "uvx twine upload dist/*" so the
upload uses the pinned Twine release.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: f6e12e73-52e2-444b-a298-27607ff59c36
📒 Files selected for processing (2)
.github/workflows/pypi-publish.ymlDockerfile
Strift
added
the
maintenance
Strift
left a comment
Strift
left a comment
There was a problem hiding this comment.
Hello @DhavalGojiya and thanks for this PR 🙌
It's a much welcome improvement :)
Your welcome, many new improvements coming soon 😉 |
2 participants
Pull Request
Related issue
Fixes #1220 (comment)
Description
Migrate to uv from pipenv.
Now to Setup
meilisearch-pythonproject in any machine,Run:
% uv syncIt will take care of everything.
Changes
Pipfile.lock-->uv.lockuvsupport in ci pipelinesuvsupport intoxuvRemoved Files
Removed Dependencies
Tests
% uv run tox -e pylint% uv run tox -e mypy% uv run tox -e py39PR checklist
Please check if your PR fulfills the following requirements:
Thank you so much for contributing to Meilisearch!
Summary
Migrates the project's dependency management from Pipenv to uv (https://docs.astral.sh/uv/). This resolves CI determinism and lockfile drift described in issue
#1220by replacing Pipenv installs (which could mutate Pipfile.lock) with deterministic uv-based installs and lockfiles.Changes
Configuration & Dependency Files
CI/CD Workflows
All GitHub Actions workflows were updated to install and use uv (via astral-sh/setup-uv, pinned) instead of Pipenv:
Docker, Docs & Contributing
Dependencies Removed
New Local Setup Command
uv syncas the new command to prepare the project environment on any machine.Verification
PR includes evidence of successful checks executed via uv-run tox:
uv run tox -e pylint: pylint score 10.00/10.uv run tox -e mypy: "Success: no issues found" across checked files.uv run tox -e py39: pytest run reported 357 collected tests; tests executed via tox under uv environments.Impact