[MISC] Switch to uv

[sinclert-canonical]

This PR changes the tool used for dependency management from poetry to uv, following this PG-Bouncer example. Some of the main changes are:

• Migrated from poetry-specific pyproject.toml syntax to standard Python project one.
• Migrated from poetry-specific carrot specifier (^) to standard compatible release specifier (~=).
• Renamed dependency groups main to charm and charm-libs to just libs (revertible upon request).

Differences from PG-Bouncer PR:

• The uv binary is installed via pip, instead of via snap (both @paulomach and myself prefer that way).
• The tox_uv.toml file to cherry pick when dependencies are installed from pre-built packages has been ignored. Instead, all tox environments use pre-built packages, only installing from source when the charm gets packed.

Additional changes

• Bumped ruff target python version to 3.10 + updated Python files format.

[carlcsaposs-canonical]

This will cause Dependabot vulnerability alerts to stop working, which Renovate uses to segment security updates from normal PRs (and to open security update PRs immediately, instead of waiting for the weekly schedule)

[dragomirp]

This will cause Dependabot vulnerability alerts to stop working, which Renovate uses to segment security updates from normal PRs (and to open security update PRs immediately, instead of waiting for the weekly schedule)

There's a experimental feature in renovate osvvulnerabilityalerts that seems to work with uv. But IMHO, without a pressing need to switch (focal support), it might be best to discuss further at the sprint.

[carlcsaposs-canonical]

There's a experimental feature in renovate osvvulnerabilityalerts that seems to work with uv. But IMHO, without a pressing need to switch (focal support), it might be best to discuss further at the sprint.

good to know

the docs for that feature mention

You will only get OSV-based vulnerability alerts for direct dependencies.

which might be an issue—I'm not sure what renovate considers a direct dependency in this context. Would guess it would not include lockfile deps, but not sure

[sinclert-canonical]

There's a experimental feature in renovate osvvulnerabilityalerts that seems to https://github.com/dragomirp/pgbouncer-operator/pull/10 with uv.

Will take a look. Thanks Drago!

IMHO, without a pressing need to switch (focal support), it might be best to discuss further at the sprint.

I somewhat agree.

I recognize the value of simplifying the charmcraft.yaml file (which IMHO is confusing and bloated at the moment), but I think migrating the dependency management tooling is one of those changes where either we are convince enough to migrate all our projects, or we do not migrate any at all. Leaving some of them with poetry and some of them with uv will only make things worse long term.

As you said: let's discuss during the Sprint. Paulo told me John wants to foster the usage of uv.

[sinclert-canonical]

Depends on canonical/data-platform#38.

[astrojuanlu]

Investigated this a bit today, so I might as well share my findings.

I was annoyed by tox -e format taking 2 seconds, so I investigated a bit how to make our tox config "generic" (no explicit uv). I have it working on a branch, and with tox-uv it supports locking.

tox.ini

# Copyright 2022 Canonical Ltd.
# See LICENSE file for licensing details.

[tox]
env_list = lint, unit

[vars]
src_path = "{tox_root}/src"
tests_path = "{tox_root}/tests"
lib_path = "{tox_root}/lib/charms/mysql"
terraform_path = "{tox_root}/terraform"
all_path = {[vars]src_path} {[vars]tests_path} {[vars]lib_path}

[testenv]
set_env =
    PYTHONPATH = {tox_root}/src:{tox_root}/lib
    PY_COLORS = 1

[testenv:format]
description = Apply coding style standards to code
skip_install = true
dependency_groups =
    format
commands =
    ruff check --fix {[vars]all_path}
    ruff format {[vars]all_path}

[testenv:lint]
description = Check code against coding style standards
skip_install = true
allowlist_externals =
    find
dependency_groups =
    lint
commands =
    # uncomment the following line if this charm owns a lib
    # codespell {[vars]lib_path}
    codespell {[vars]all_path}
    ruff check {[vars]all_path}
    ruff format --check --diff {[vars]all_path}
    find {[vars]all_path} -type f \( -name "*.sh" -o -name "*.bash" \) -exec shellcheck --color=always \{\} +

[testenv:lint-terraform]
description = Check code against Terraform style standards
skip_install = true
allowlist_externals =
    {[testenv]allowlist_externals}
    terraform
commands =
    terraform fmt -check -diff -recursive {[vars]terraform_path}
    terraform -chdir={[vars]terraform_path} init -backend=false
    terraform -chdir={[vars]terraform_path} validate

[testenv:unit]
description = Run unit tests
set_env =
    {[testenv]set_env}
dependency_groups =
    charm-libs
    unit
commands =
    coverage run --source={[vars]src_path},{[vars]lib_path} \
        -m pytest -v --tb native -s {posargs} {[vars]tests_path}/unit
    coverage report
    coverage xml

[testenv:integration]
description = Run integration tests
pass_env =
    CI
    CHARM_REVISION_AMD64
    CHARM_REVISION_ARM64
    AWS_ACCESS_KEY
    AWS_SECRET_KEY
    GCP_ACCESS_KEY
    GCP_SECRET_KEY
    UBUNTU_PRO_TOKEN
    LANDSCAPE_ACCOUNT_NAME
    LANDSCAPE_REGISTRATION_KEY
    CEPH_ENDPOINT_URL
    CEPH_ACCESS_KEY
    CEPH_SECRET_KEY
skip_install = true
dependency_groups =
    integration
commands =
    pytest -v --tb native --log-cli-level=INFO -s --ignore={[vars]tests_path}/unit/ {posargs}

ops is already testing the uv plugin for their charms, which is nice canonical/operator#2218

Full migration to uv might still be a bit premature, but at least dependabot started addressing the major issues. Recently there were some headwinds, keeping tabs on dependabot/dependabot-core#10478 (comment).

If we wanted to keep our tox.ini tool-agnostic as I showed above but without fully migrating CI to uv, we'd need some other way of locking the dependencies, for example with layers of requirements.txt. PEP 751 pylock.toml is not yet supported by pip as input pypa/pip#13334 nor poetry as output python-poetry/poetry-plugin-export#336.

Still, it's worth noting that global Poetry downloads peaked in ~June 2025 while uv topped Poetry in December 2025 and is still rising. If there are no surprises, in the next ~3-6 months it's going to be clear that uv "won". Hopefully the ecosystem will be ready and the migration path will be free of hurdles.