feat: modernize to uv + pyproject.toml + python-semantic-release

[irfanuddinahmad]

Summary

Modernize auth-backends to uv + pyproject.toml (PEP 621/735) + python-semantic-release.

Part of openedx/public-engineering#506 (tracked in public-engineering#516).

• Move auth_backends/ to src/auth_backends/ — per the confirmed decision on public-engineering#506 (2026-07-15) that src/ layout is in scope this cycle, precedented by xblock-core/xblock-extras
• Replace setup.py/setup.cfg with pyproject.toml (PEP 621 static metadata)
• Switch from pip-compile to uv with PEP 735 dependency groups (test-base, test, quality, ci, dev); commit uv.lock
• Update tox.ini to use tox-uv with uv-venv-lock-runner
• Update CI (ci.yml) to use astral-sh/setup-uv, SHA-pin all actions, add fetch-depth: 0 so setuptools-scm sees tags
• Add python-semantic-release + release.yml, replacing the old tag-triggered pypi-publish.yml (stored PyPI token, unpinned pypa/gh-action-pypi-publish@release/v1); publish to PyPI via OIDC trusted publishing instead
• commitlint.yml already existed and needed no changes

Removed

Deleted files: setup.py, setup.cfg, requirements/ (all .in/.txt files), .github/workflows/pypi-publish.yml

Removed Makefile targets: $(COMMON_CONSTRAINTS_TXT) wget target and the pyjwt/social-auth-core constraint-stripping sed steps in upgrade (no longer needed — edx_lint write_uv_constraints handles constraints now)

Not included

No ruff/lint-tooling changes — pylint/pycodestyle/edx-lint are left exactly as configured before (no isort config existed in setup.cfg to port); this migration is tooling-only, not a linting overhaul.

Versioning

Dynamic — setuptools-scm derives the package version from git tags (version_scheme = "only-version", local_scheme = "no-local-version", fallback_version = "0.0.0"). Confirmed the latest git tag (v5.0.0, via git tag --sort=-v:refname) matches the latest version actually published on PyPI (5.0.0), so the first automated release from python-semantic-release should compute a version strictly newer than 5.0.0.

Testing Notes

Verified locally:

• uv lock resolves cleanly (uv lock --check passes)
• uv sync --group dev succeeds
• uv run tox — all three envs pass: django52 (21 tests), quality (pycodestyle + pylint), check_keywords
• python -m build (the exact build_command semantic-release will invoke) produces a correct wheel: entry points n/a, SPDX license expression, README-as-long-description, and edx_auth_backends-5.0.0.dist-info/licenses/LICENSE.txt all verified by inspecting the built wheel's METADATA/file list; test files (tests/*) are correctly excluded from the wheel
• Coverage scope change: the new standard omit (*/tests/*, etc.) drops the reported package coverage from 99% to 98% (a one-time ~1% drop from no longer counting test files' own trivially-covered statements) — well within the existing codecov.yml's 95% project/patch thresholds, so no codecov.yml change was needed for this repo (unlike some sibling repos in this effort where the drop was larger)
• src/ layout: verified uv sync gives an importable editable install (import auth_backends resolves to src/auth_backends/__init__.py) and python -m build produces a wheel with auth_backends/* at its root (the src/ prefix is a source-tree-only convention). This repo has no mypy config to verify against.

Could not verify locally (needs CI / a maintainer):

• The actual GitHub Actions run (uv caching behavior, secrets.CODECOV_TOKEN availability)
• Whether the OPENEDX_SEMANTIC_RELEASE_GITHUB_TOKEN org secret (used by release.yml to let python-semantic-release push the release commit/tag) is configured for this repo
• PyPI trusted publisher (OIDC) is not yet configured for edx-auth-backends, as far as I can tell — this needs a maintainer with PyPI project-owner access to add openedx/auth-backends's release.yml / publish_to_pypi environment as a trusted publisher on pypi.org. This is not a blocker for merging this PR, but the first automated release will fail at the publish_to_pypi job until it's set up.

Known out-of-scope gap: upgrade-python-requirements.yml

.github/workflows/upgrade-python-requirements.yml calls the org's shared reusable
workflow (openedx/.github/.github/workflows/upgrade-python-requirements.yml), which
hardcodes ADD_PATHS="requirements" (plus a scripts/**/requirements* glob) for the
PR-creation step, with no add_paths-style input exposed on its workflow_call
(confirmed by reading its source directly). Now that requirements/ is deleted, this
scheduled job will keep running but will never see uv.lock/pyproject.toml changes
as a match for its hardcoded add-paths glob — it won't fail, it'll just silently stop
producing real dependency-upgrade PRs. This can't be fixed from this repo alone (it
requires parameterizing or auto-detecting in the centrally-owned reusable workflow) —
flagging it here rather than leaving it as a silent gap, same treatment as the PyPI
OIDC item above.

Code reviewer notes

• six remains a runtime dependency even though it's only imported by auth_backends/tests/test_backends.py, not by any production module — carried forward unchanged from the old install_requires since this migration doesn't touch actual dependency behavior.
• auth_backends/__init__.py's __version__ now reads from importlib.metadata instead of being hardcoded, to avoid it going stale after the first tag-less commit.
• release.yml's action pins (python-semantic-release/python-semantic-release@v10.6.1, publish-action@v10.6.1, actions/upload-artifact@v7, actions/download-artifact@v8) intentionally use plain version tags, matching openedx/XBlock's actual production release.yml exactly — earlier sibling PRs in this same effort SHA-pinned these and 3 of 5 turned out to have fabricated/swapped SHAs, so this repo deliberately does not repeat that. Only pypa/gh-action-pypi-publish is SHA-pinned (ba38be9e461d3875417946c167d0b5f3d385a247 = the real commit for tag v1.14.1, verified via gh api repos/pypa/gh-action-pypi-publish/commits/<sha>), because @release/v1 is a floating branch with a confirmed production failure history.
• tox.ini's check_keywords env and db_keyword_overrides.yml/manage.py mechanism (from edx-django-release-util) are unchanged in behavior, just switched to dependency_groups = test and verified passing locally.

---

This PR was created with Claude Code.

[openedx-webhooks]

Thanks for the pull request, @irfanuddinahmad!

This repository is currently unmaintained.

🔘 Find a technical reviewer

To get help with finding a technical reviewer, reach out to the community contributions project manager for this PR:

1. On the right-hand side of the PR, find the Contributions project, click the caret in the top right corner to expand it, and check the "Primary PM" field for the name of your project manager.
2. Find their GitHub handle here.

Once you've gone through the following steps feel free to tag them in a comment and let them know that your changes are ready for engineering review.

🔘 Get product approval

If you haven't already, check this list to see if your contribution needs to go through the product review process.

• If it does, you'll need to submit a product proposal for your contribution, and have it reviewed by the Product Working Group.
  • This process (including the steps you'll need to take) is documented here.
• If it doesn't, simply proceed with the next step.

🔘 Provide context

To help your reviewers and other members of the community understand the purpose and larger context of your changes, feel free to add as much of the following information to the PR description as you can:

• Dependencies

  This PR must be merged before / after / at the same time as ...

• Blockers

  This PR is waiting for OEP-1234 to be accepted.

• Timeline information

  This PR must be merged by XX date because ...

• Partner information

  This is for a course on edx.org.

• Supporting documentation
• Relevant Open edX discussion forum threads

🔘 Get a green build

If one or more checks are failing, continue working on your changes until this is no longer the case and your build turns green.

Details

---

Where can I find more information?

If you'd like to get more details on all aspects of the review process for open source pull requests (OSPRs), check out the following resources:

• Overview of Review Process for Community Contributions
• Pull Request Status Guide
• Making changes to your pull request

When can I expect my changes to be merged?

Our goal is to get community contributions seen and reviewed as efficiently as possible.

However, the amount of time that it takes to review and merge a PR can vary significantly based on factors such as:

• The size and impact of the changes that it introduces
• The need for product review
• Maintenance status of the parent repository

💡 As a result it may take up to several weeks or months to complete a review and merge your PR.