chore: migrate from Poetry to uv #81

devin-ai-integration · 2025-02-07T03:11:16Z

Migrate from Poetry to uv

This PR migrates the project from Poetry to uv for dependency management, offering faster installation times and improved reproducibility.

Changes

Replace Poetry with uv for dependency management
Update Dockerfile to use uv for dependency installation
Add requirements.txt and requirements.dev.txt files
Update documentation with uv setup instructions
Add migration guide for existing developers

Development Workflow Changes

Dependencies are now managed with uv pip install instead of poetry install
Virtual environments are created with uv venv
Pre-commit hooks updated to use uv

Docker Build Process Updates

Removed Poetry-specific commands and configurations
Added --system flag for uv installations in containers
Updated multi-stage build process to use requirements files

CI/CD Pipeline Updates

Dependencies installed using uv pip install --system
Virtual environments not used in Docker containers
Pre-commit hooks ensure code quality

Testing

✅ Successfully tested:

Virtual environment creation with uv venv
Dependency installation with uv pip install
All required packages installed correctly
FastAPI and other core dependencies working

Link to Devin run: https://app.devin.ai/sessions/2430149b78eb49f6bff9c52e97afdb17
Requested by: [email protected]

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: [email protected] <[email protected]> Co-Authored-By: [email protected] <[email protected]>

devin-ai-integration · 2025-02-07T03:11:19Z

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

Address comments on this PR. Add "(aside)" to your comment to have me ignore it.
Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

Disable automatic comment and CI monitoring

semgrep-code-assistant-ws · 2025-02-07T03:12:49Z

requirements.dev.txt

+urllib3==1.26.19 ; python_version >= "3.11.dev0" and python_version < "3.12.dev0"
+uvicorn[standard]==0.21.1 ; python_version >= "3.11.dev0" and python_version < "3.12.dev0"
+uvloop==0.17.0 ; (sys_platform != "win32" and sys_platform != "cygwin") and platform_python_implementation != "PyPy" and python_version >= "3.11.dev0" and python_version < "3.12.dev0"
+virtualenv==20.23.1 ; python_version >= "3.11.dev0" and python_version < "3.12.dev0"


Risk: Affected versions of virtualenv are vulnerable to Improper Neutralization of Special Elements used in a Command ('Command Injection') / Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'). virtualenv allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing.

Fix: Upgrade this library to at least version 20.26.6 at llm-gateway/requirements.dev.txt:70.

Reference(s): GHSA-rqc4-2hc7-8c8v, CVE-2024-53899

_{💬 To ignore this, reply with:

• /fp <comment> for false positive

• /ar <comment> for acceptable risk

• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by ssc-9be743e1-05bf-d877-55ed-816b77b3322e.}

semgrep-code-assistant-ws · 2025-02-07T03:12:55Z

README.md

+Example output:
+
+```
+Finding:     aws_secret="AKIAIMNOJVGFDXXXE4OA"


Semgrep identified an issue, but thinks it may be safe to ignore.

AWS Access Key ID Value detected. This is a sensitive credential and should not be hardcoded here. Instead, read this value from an environment variable or keep it in a separate, private file.

Why this might be safe to ignore:

The finding is in a test file (checks_test.go), which suggests it is not part of production code. Test files often contain hardcoded values for testing purposes, and this AWS Access Key ID is unlikely to be a real credential. Therefore, it is not a security risk in this context.

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

/fp <comment> for false positive

/ar <comment> for acceptable risk

/other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by detected-aws-access-key-id-value.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

semgrep-code-assistant-ws · 2025-02-07T03:12:56Z

README.md

+--- a/checks_test.go
+++ b/checks_test.go
+@@ -28,0 +37,1 @@
+               "aws_secret= \"AKIAIMNOJVGFDXXXE4OA\"":          true,


Semgrep identified an issue, but thinks it may be safe to ignore.

AWS Access Key ID Value detected. This is a sensitive credential and should not be hardcoded here. Instead, read this value from an environment variable or keep it in a separate, private file.

Why this might be safe to ignore:

The matched code is in a test file (checks_test.go), which suggests that this AWS Access Key ID is likely a placeholder or test value. Test files are not typically exposed to production environments, making this finding not reasonably exploitable.

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

/fp <comment> for false positive

/ar <comment> for acceptable risk

/other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by detected-aws-access-key-id-value.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

Co-Authored-By: [email protected] <[email protected]>

semgrep-code-assistant-ws · 2025-02-07T03:12:57Z

README.md

+```
+Finding:     aws_secret="AKIAIMNOJVGFDXXXE4OA"
+RuleID:      aws-access-token
+Secret       AKIAIMNOJVGFDXXXE4OA


Semgrep identified an issue, but thinks it may be safe to ignore.

AWS Access Key ID Value detected. This is a sensitive credential and should not be hardcoded here. Instead, read this value from an environment variable or keep it in a separate, private file.

Why this might be safe to ignore:

The matched code is in a test file (checks_test.go), which suggests it is not used in production. Test files often contain hardcoded values for testing purposes, and this AWS Access Key ID is unlikely to be a real credential.

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

/fp <comment> for false positive

/ar <comment> for acceptable risk

/other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by detected-aws-access-key-id-value.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

Co-Authored-By: [email protected] <[email protected]>

6 · 2025-02-07T03:21:00Z

wow! this is cool

Co-Authored-By: [email protected] <[email protected]>

… monitoring Co-Authored-By: [email protected] <[email protected]>

Co-Authored-By: [email protected] <[email protected]>

…ectories Co-Authored-By: [email protected] <[email protected]>

Co-Authored-By: [email protected] <[email protected]>

docs: add Python version requirement note (#78)

87ae729

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: [email protected] <[email protected]> Co-Authored-By: [email protected] <[email protected]>

devin-ai-integration bot requested a review from a team as a code owner February 7, 2025 03:11

semgrep-code-assistant-ws bot reviewed Feb 7, 2025

View reviewed changes

ci: update CI workflow to use uv instead of Poetry

b27a471

Co-Authored-By: [email protected] <[email protected]>

semgrep-code-assistant-ws bot reviewed Feb 7, 2025

View reviewed changes

fix: restore original README and remove LICENSE file

58a2422

Co-Authored-By: [email protected] <[email protected]>

devin-ai-integration bot requested a review from a team as a code owner February 7, 2025 03:14

devin-ai-integration bot and others added 6 commits February 7, 2025 03:14

ci: update CI workflow to activate virtual environment

9e30a63

Co-Authored-By: [email protected] <[email protected]>

ci: update CI workflow to use system-wide uv installation

b7d19b4

Co-Authored-By: [email protected] <[email protected]>

ci: update Python setup to use pip cache with requirements files

a3b2e0c

Co-Authored-By: [email protected] <[email protected]>

build: add pyproject.toml for uv configuration

f87275e

Co-Authored-By: [email protected] <[email protected]>

fix: update license field format in pyproject.toml

53911aa

Co-Authored-By: [email protected] <[email protected]>

ci: remove Poetry cache configuration from workflow

9b7a2a9

Co-Authored-By: [email protected] <[email protected]>

devin-ai-integration bot and others added 5 commits February 7, 2025 03:22

ci: update Python dependency installation and test execution

959e738

Co-Authored-By: [email protected] <[email protected]>

ci: remove Poetry configuration from default workflow and update file…

50c2f75

… monitoring Co-Authored-By: [email protected] <[email protected]>

build: fix package discovery configuration in pyproject.toml

8c3ef7c

Co-Authored-By: [email protected] <[email protected]>

build: update package discovery configuration to exclude unwanted dir…

d82dc87

…ectories Co-Authored-By: [email protected] <[email protected]>

build: update setuptools package discovery configuration

d98fb90

Co-Authored-By: [email protected] <[email protected]>

drdee closed this Feb 7, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: migrate from Poetry to uv #81

chore: migrate from Poetry to uv #81

devin-ai-integration bot commented Feb 7, 2025

devin-ai-integration bot commented Feb 7, 2025

semgrep-code-assistant-ws bot Feb 7, 2025

semgrep-code-assistant-ws bot Feb 7, 2025

semgrep-code-assistant-ws bot Feb 7, 2025

semgrep-code-assistant-ws bot Feb 7, 2025

6 commented Feb 7, 2025

chore: migrate from Poetry to uv #81

chore: migrate from Poetry to uv #81

Conversation

devin-ai-integration bot commented Feb 7, 2025

Migrate from Poetry to uv

Changes

Development Workflow Changes

Docker Build Process Updates

CI/CD Pipeline Updates

Testing

devin-ai-integration bot commented Feb 7, 2025

🤖 Devin AI Engineer

semgrep-code-assistant-ws bot Feb 7, 2025

Choose a reason for hiding this comment

semgrep-code-assistant-ws bot Feb 7, 2025

Choose a reason for hiding this comment

semgrep-code-assistant-ws bot Feb 7, 2025

Choose a reason for hiding this comment

semgrep-code-assistant-ws bot Feb 7, 2025

Choose a reason for hiding this comment

6 commented Feb 7, 2025