feat!: rewrite in pure Python

[b-long]

Alpha release

An alpha release is available now: https://test.pypi.org/project/otdf-python/0.3.0a6/

✨🪩✨ New and Improved! ✨🪩✨

This pull request rewrites this library in "pure python" (of course, using the cryptography library means that Rust is used under the hood for crypto).

In this PR, we introduce a simplified, modernized toolchain. In particular, the CI pipeline and local development is improved using using the uv tool. The most important changes are grouped below.

Build and Test Improvements:

• Switches to uv for Python environment management. This simplifies the CI/CD process, improve maintainability, and align the workflows with modern Python tooling and best practices.

• Switches to building a sub-module using buf and generating Connect RPC client code.

  • See also:
    • Consider generating SDK using buf #45
    • ⚠️ experimentation: buf build #50
    • Consider rewrite in pure Python #54

• Deletes obsolete workflows related to gopy tooling

• Maintains and expands integration testing: separates unit and integration tests (can now be run with uv run pytest, and can execute tests with clear markers).

Increased compatibility:

• With the updated build, we will be able to broadly support macOS, Linux, and Windows

• Currently, we are supporting Python version 3.10+

TODO

• Remove commented code (see _get_token_from_client_credentials)
• Update README
• Add a Changelog
• Add https://github.com/googleapis/release-please-action , including a version number indicating the rewrite milestone

TODO (nice to have)

• Move fallback branch (realm_name = "opentdf") to configuration loader, log a warning when we fallback
• Consider adjusting self.issuer_endpoint, to align more closely with Java SDK's SDKBuilder.java (get platform_issuer from well known configuration)
• Enable additional ruff rules ( e.g. "D" for pydocstyle [ docstring conventions] )
• Replace uses of getattr and kwargs

[b-long]

/gemini review

[gemini-code-assist]

Code Review

This is a massive and impressive rewrite of the library from a gopy-based solution to a pure Python implementation. The changes modernize the toolchain by adopting uv, buf, and Connect RPC, which significantly improves maintainability, compatibility, and the overall development experience. The addition of comprehensive documentation for the new architecture, development setup, and release process is commendable. The CI/CD pipeline improvements, including the separation of unit and integration tests and automated log collection on failure, are excellent additions. I have a few suggestions to further improve the robustness and security of the scripts.

[gemini-code-assist]

For improved robustness, it's a good practice to add set -euo pipefail at the beginning of your shell scripts. This will cause the script to exit immediately if a command fails, preventing unexpected behavior.

Suggested change

	#!/bin/bash
	#!/bin/bash
	set -euo pipefail

[gemini-code-assist]

The use of curl -k (and grpcurl -plaintext on line 39) disables certificate validation, which is a security risk. While this may be acceptable for a local test environment, it would be beneficial to add a comment explaining why this is necessary and to warn against using this script in production-like environments.

[gemini-code-assist]

It's good practice to check if the BEARER token was successfully retrieved. If the curl or jq command fails, the script will continue with an empty token, which could lead to confusing errors later.

Suggested change

	BEARER=$( get_token | jq -r '.access_token' )
	BEARER=$( get_token | jq -r '.access_token' )
	if [ -z "$BEARER" ]; then
	echo "❌ Failed to get access token."
	exit 1
	fi

[gemini-code-assist]

Pinning to a specific commit hash is great for reproducibility. However, it can become stale. It would be helpful to add a comment explaining how and when to update this hash, or consider using a Git submodule to manage this dependency more formally.

[gemini-code-assist]

The permission 700 grants execute permissions to files, which is unnecessary for keys and could be a minor security risk. A more secure approach is to set 700 for directories and 600 for files. You can achieve this with:

find ./keys -type d -exec chmod 700 {} +;
find ./keys -type f -exec chmod 600 {} +;

[gemini-code-assist]

This appears to be a placeholder. It would be more helpful for users if you replace <repository-url> with the actual repository URL.

Suggested change

	git clone <repository-url>
	git clone https://github.com/b-long/opentdf-python-sdk.git

[gemini-code-assist]

This function to patch the .proto files is a clever workaround for the deprecated IGNORE_IF_DEFAULT_VALUE enum. While pragmatic, this suggests the upstream proto definitions from protovalidate are using a deprecated feature. Consider opening an issue in the upstream repository to encourage a fix, which would allow you to remove this workaround in the future and rely on pristine source files.