Update dependencies and build system

Convert all of the Docker builds to use uv to install packages,
which allows removing the update-deps-no-hashes nox session and
all of its supporting code. uv understands how to verify hashes
if present and skip the verification if the hashes aren't present.

Encode the startup command of the controller directly in the
Dockerfile and remove the one-line shell script that was previously
used to start it.

Update to the latest Ruff and shared Ruff configuration file. Move
Nublado-specific overrides out of the shared Ruff configuration
file into `pyproject.toml` where project-specific overrides should
live. Fix a few issues uncovered by Ruff that can be fixed instead
of suppressed.

Remove dead configuration from `client/pyproject.toml` and add some
additional metadata. Remove unnecessary dependencies.

Remove the now-unused `Dockerfile.sciplat-lab`. That build was moved
to a different repository.

Update pre-commit and Python dependencies.

.pre-commit-config.yaml

@@ -8,7 +8,7 @@ repos:
       - id: trailing-whitespace
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.8.2
+    rev: v0.8.3
     hooks:
       - id: ruff
         args: [--fix, --exit-non-zero-on-fix]

Dockerfile.controller

@@ -15,36 +15,37 @@
 #   - Runs a non-root user.
 #   - Sets up the entrypoint and port.
 
-FROM python:3.12.7-slim-bookworm AS base-image
+FROM python:3.12.8-slim-bookworm AS base-image
 
 # Update system packages
 COPY controller/scripts/install-base-packages.sh .
 RUN ./install-base-packages.sh && rm ./install-base-packages.sh
 
 FROM base-image AS install-image
 
+# Install uv.
+COPY --from=ghcr.io/astral-sh/uv:0.5.8 /uv /bin/uv
+
 # Install system packages only needed for building dependencies.
 COPY controller/scripts/install-dependency-packages.sh .
 RUN ./install-dependency-packages.sh
 
 # Create a Python virtual environment.
 ENV VIRTUAL_ENV=/opt/venv
-RUN python -m venv $VIRTUAL_ENV
+RUN uv venv $VIRTUAL_ENV
 
 # Make sure we use the virtualenv.
 ENV PATH="$VIRTUAL_ENV/bin:$PATH"
 
-# Put the latest pip and setuptools in the virtualenv.
-RUN pip install --upgrade --no-cache-dir pip setuptools wheel
-
 # Install the app's Python runtime dependencies.
 COPY controller/requirements/main.txt ./requirements.txt
-RUN pip install --quiet --no-cache-dir -r requirements.txt
+RUN uv pip install --compile-bytecode --verify-hashes --no-cache \
+    -r requirements.txt
 
 # Install the Python package.
 COPY . /workdir
 WORKDIR /workdir
-RUN pip install --no-cache-dir ./controller
+RUN uv pip install --compile-bytecode --no-cache ./controller
 
 FROM base-image AS runtime-image
 
@@ -54,9 +55,6 @@ RUN useradd --create-home appuser
 # Copy the virtualenv.
 COPY --from=install-image /opt/venv /opt/venv
 
-# Copy the startup script.
-COPY controller/scripts/start.sh /start.sh
-
 # Make sure we use the virtualenv.
 ENV PATH="/opt/venv/bin:$PATH"
 
@@ -67,4 +65,4 @@ USER appuser
 EXPOSE 8080
 
 # Run the application.
-CMD ["/start.sh"]
+CMD ["uvicorn", "--factory", "controller.main:create_app", "--host", "0.0.0.0", "--port", "8080"]

Dockerfile.hub

@@ -14,26 +14,34 @@
 # This is just an alias to avoid repeating the base image.
 FROM quay.io/jupyterhub/k8s-hub:4.0.0
 
+# The upstream chart already switched users, but we have additional
+# operations that must be done as root.
 USER 0
+
+# Install uv.
+COPY --from=ghcr.io/astral-sh/uv:0.5.8 /uv /bin/uv
+
 # Update and install packages.
 COPY hub/scripts/install-packages.sh .
 RUN ./install-packages.sh && rm install-packages.sh
 
 # Install the dependencies of the extra JupyterHub modules.
 COPY hub/requirements/main.txt ./requirements.txt
-RUN pip install --quiet --no-cache-dir -r requirements.txt
+RUN uv pip install --system --compile-bytecode --verify-hashes --no-cache \
+    -r requirements.txt
+RUN rm requirements.txt
 
 # Install the extra JupyterHub modules.
 COPY . /workdir
 WORKDIR /workdir
-RUN pip install --no-deps --no-cache-dir ./authenticator ./spawner
+RUN uv pip install --system --no-deps --compile-bytecode --no-cache \
+    ./authenticator ./spawner
 
 # Copy the modified page template
 COPY hub/templates/page.html /usr/local/etc/jupyterhub/templates/page.html
 
-# Upstream uses jovyan at 1000:1000 to run Jupyterhub.
-# This value must be kept in sync with the Phalanx nublado application
-# values.yaml.
+# Upstream uses jovyan at 1000:1000 to run Jupyterhub. This must be kept
+# in sync with the Phalanx nublado application values.yaml.
 WORKDIR /srv/jupyterhub
 USER jovyan
 EXPOSE 8000

Dockerfile.inithome

@@ -21,26 +21,29 @@
 #   - Sets up the entrypoint.
 
 # This is just an alias to avoid repeating the base image.
-FROM python:3.12.7-slim-bookworm AS base-image
+FROM python:3.12.8-slim-bookworm AS base-image
 
 FROM base-image AS install-image
 
+# Install uv.
+COPY --from=ghcr.io/astral-sh/uv:0.5.8 /uv /bin/uv
+
 # Install system packages only needed for building dependencies or installing
 # the package.
 COPY inithome/scripts/install-dependency-packages.sh .
 RUN ./install-dependency-packages.sh
 
 # Create a Python virtual environment.
 ENV VIRTUAL_ENV=/opt/venv
-RUN python -m venv $VIRTUAL_ENV
+RUN uv venv $VIRTUAL_ENV
 
 # Ensure we use the virtualenv.
 ENV PATH="$VIRTUAL_ENV/bin:$PATH"
 
 # Install inithome.
 COPY . /workdir
 WORKDIR /workdir
-RUN pip install --no-cache-dir ./inithome
+RUN uv pip install --compile-bytecode --no-cache ./inithome
 
 FROM base-image AS runtime-image
 

client/pyproject.toml

@@ -19,44 +19,45 @@ classifiers = [
 ]
 requires-python = ">=3.12"
 dependencies = [
-  "httpx<0.28.0",  # Remove once respx PR#278 is merged
-  "httpx_sse",
-  "pydantic>2",
-  "pydantic-settings",
-  "pyyaml",
-  "safir",
-  "shortuuid",
-  "structlog",
-  "websockets<14",  # We should update, but it will take some work
-  "greenlet",  # Not a dependency on Mac, but is on Linux
+    "httpx<0.28.0",  # https://github.com/lundberg/respx/issues/277
+    "httpx_sse",
+    "pydantic>2",
+    "pydantic-settings",
+    "pyyaml",
+    "safir",
+    "shortuuid",
+    "structlog",
+    "websockets<14",  # We should update, but it will take some work
 ]
 
 dynamic = ["version"]
 
 [project.optional-dependencies]
 dev = [
-  "coverage[toml]",
-  "mypy",
-  "pre-commit",
-  "pytest",
-  "pytest-asyncio",
-  "pytest-cov",
-  "pytest-mock",
-  "respx",
-  "ruff",
-  "types-PyYAML",
+    "coverage[toml]",
+    "mypy",
+    "pytest",
+    "pytest-asyncio",
+    "pytest-cov",
+    "pytest-mock",
+    "pytest-sugar",
+    "respx",
+    "types-PyYAML",
 ]
 
 [project.urls]
+Homepage = "https://nublado.lsst.io"
 Source = "https://github.com/lsst-sqre/nublado"
+"Change log" = "https://nublado.lsst.io/changelog.html"
+"Issue tracker" = "https://github.com/lsst-sqre/nublado/issues"
 
 [build-system]
-requires = ["setuptools>=61", "wheel", "setuptools_scm[toml]>=6.2"]
+requires = [
+    "setuptools>=61",
+    "setuptools_scm[toml]>=6.2"
+]
 build-backend = "setuptools.build_meta"
 
-[tool.setuptools_scm]
-root = ".."
-
 [tool.coverage.run]
 parallel = true
 branch = true
@@ -79,29 +80,9 @@ exclude_lines = [
     "if TYPE_CHECKING:"
 ]
 
-[tool.mypy]
-disallow_untyped_defs = true
-disallow_incomplete_defs = true
-ignore_missing_imports = true
-local_partial_types = true
-plugins = ["pydantic.mypy"]
-no_implicit_reexport = true
-show_error_codes = true
-strict_equality = true
-warn_redundant_casts = true
-warn_unreachable = true
-warn_unused_ignores = true
-
-[tool.pydantic-mypy]
-init_forbid_extra = true
-init_typed = true
-warn_required_dynamic_aliases = true
-warn_untyped_fields = true
-
 [tool.pytest.ini_options]
 asyncio_mode = "strict"
 asyncio_default_fixture_loop_scope = "function"
-
 filterwarnings = [
     # Bug in aiojobs
     "ignore:with timeout\\(\\) is deprecated:DeprecationWarning"
@@ -116,3 +97,5 @@ filterwarnings = [
 # listed in python_files.
 python_files = ["tests/*.py", "tests/*/*.py"]
 
+[tool.setuptools_scm]
+root = ".."