Uv dependency management

[gierdo]

This MR proposes the unification of dependency / build / venv management using uv.

It is built on top of the state of #153. I will keep it synchronized until it has been merged.

The MR should be reviewed against that state / after it has been merged.

[gierdo]

The pyproject.toml and uv integration provides powerful and concise integration with formatters and linters / typecheckers etc.

What is your opinion on those?

I would like to propose throwing at least ruff and maybe a typechecker at it, enforcing a common set of rules for style + formatting and more confidence in quality.

If you are interested, I'll add an additional MR after this.

[gunnar-mb]

Great, thanks. I will take a look soon. 153 is merged and I had to add back a reference to the submodule (because changing .gitmodules file is not enough - submodules are a bit strange), so this needs a rebase now.

[gunnar-mb]

I would like to propose throwing at least ruff and maybe a typechecker at it, enforcing a common set of rules for style + formatting and more confidence in quality.

I had ruff, and black and some other things on a branch. Guess I never finished it. But I recall there were a few areas where I preferred keeping the code style (maybe longer lines, or something like it), but mostly I'm fine with it, so yes I'm happy to pick up the thread and look at it again.

[gunnar-mb]

Also, since you are looking at fixing the dependency tree anyway, feel free to see if these changes make sense, just to get rid of the complaint: https://github.com/COVESA/ifex/security/dependabot

[gierdo]

I would like to propose throwing at least ruff and maybe a typechecker at it, enforcing a common set of rules for style + formatting and more confidence in quality.

I had ruff, and black and some other things on a branch. Guess I never finished it. But I recall there were a few areas where I preferred keeping the code style (maybe longer lines, or something like it), but mostly I'm fine with it, so yes I'm happy to pick up the thread and look at it again.

The configuration can be adapted, excluding / changing a few rules selectively, e.g. line length etc. I think we could find a good convention/configuration.

[gierdo]

I would like to propose throwing at least ruff and maybe a typechecker at it, enforcing a common set of rules for style + formatting and more confidence in quality.

I had ruff, and black and some other things on a branch. Guess I never finished it. But I recall there were a few areas where I preferred keeping the code style (maybe longer lines, or something like it), but mostly I'm fine with it, so yes I'm happy to pick up the thread and look at it again.

I will create a separate MR for discussion of that, based on the uv branch.

[gierdo]

Also, since you are looking at fixing the dependency tree anyway, feel free to see if these changes make sense, just to get rid of the complaint: https://github.com/COVESA/ifex/security/dependabot

I don't have access to the dependabot complaints, but I assume that whatever dependabot complains about would be fixed by pulling up the dependencies ;)
I created a fresh lock file of the dependency graph, anyways. pysentry-rs gives me no warnings, I assume dependabot should be reasonably happy.

[gunnar-mb]

I don't have access to the dependabot complaints

Oh!

but I assume that whatever dependabot complains about would be fixed by pulling up the dependencies ;)

Yes probably, and they are minor things but I clicked to create the PRs now anyway just so you can see.

[gierdo]

I don't have access to the dependabot complaints

Oh!

but I assume that whatever dependabot complains about would be fixed by pulling up the dependencies ;)

Yes probably, and they are minor things but I clicked to create the PRs now anyway just so you can see.

Ah, excellent. Yes, updating the dependency graph in the uv lock appears to have resolved eventual complaints with regards to python dependencies, it's only a bump for the document generation. I can cherry-pick the proposed change in here, as well, but the change proposed by dependabot doesn't seem unreasonable and could also be handled in the PR you opened up directly.

Edit: Now I read your comment, will try to address it there.

[gunnar-mb]

Whatever is easiest - cherry pick could be easier so you can test the combined result. I just put the PR up for your info.

[gierdo]

Whatever is easiest - cherry pick could be easier so you can test the combined result. I just put the PR up for your info.

Alright, I'll cherry-pick the fixed dependencies from #157 here.