Use uv (#206)

Signed-off-by: Prabhu Subramanian <[email protected]>

Author: prabhu

.github/workflows/pythonapp.yml

@@ -14,6 +14,8 @@ jobs:
       fail-fast: false
     steps:
     - uses: actions/checkout@v4
+    - name: Install uv
+      uses: astral-sh/setup-uv@v5
     - name: Set up Python
       uses: actions/setup-python@v5
       with:
@@ -32,24 +34,24 @@ jobs:
     - name: Install dependencies
       run: |
         python -m pip install --upgrade pip
-        pip install ".[dev]"
+        uv sync --all-extras --dev
     - name: Lint with flake8
       run: |
-        flake8 . --count --show-source --exit-zero --statistics
+        uv run flake8 . --count --show-source --exit-zero --statistics
     - name: Test with pytest
       run: |
-        pytest --cov=vdb test
+        uv run pytest --cov=vdb test
       env:
         PYTHONPATH: .
         TEST_VDB_HOME: vdb_data
     - name: Generate SBOM with cdxgen
       run: |
         npm install -g @cyclonedx/cdxgen
         cdxgen -t python -o bom.json . -p --profile research
-        pip install ".[all]"
-        python vdb/cli.py --download-image
-        python vdb/cli.py --bom bom.json
+        uv sync --all-extras --dev
+        uv run vdb --download-image
+        uv run vdb --bom bom.json
     - name: CLI tests
       run: |
-        python vdb/cli.py --search "pkg:maven/org.springframework/[email protected]"
-        python vdb/cli.py --search "pkg:maven/org.hibernate.orm/[email protected]"
+        uv run vdb --search "pkg:maven/org.springframework/[email protected]"
+        uv run vdb --search "pkg:maven/org.hibernate.orm/[email protected]"

.github/workflows/pythonpublish.yml

@@ -20,6 +20,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@v4
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
@@ -36,13 +38,14 @@ jobs:
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install setuptools wheel twine build
+          uv sync --all-extras --dev
       - name: Build
         run: |
-          python3 -m build
+          uv build
       - name: Publish package distributions to PyPI
         if: startsWith(github.ref, 'refs/tags/')
-        uses: pypa/gh-action-pypi-publish@release/v1
+        run: |
+          uv publish
       - name: Generate SBOM with cdxgen
         run: |
           npm install -g @cyclonedx/cdxgen
@@ -84,7 +87,7 @@ jobs:
       - name: Build and push Docker images
         uses: docker/build-push-action@v5
         with:
-          context: contrib/mcp-server-vdb
+          context: packages/mcp-server-vdb
           platforms: linux/amd64,linux/arm64
           push: true
           tags: ${{ steps.meta.outputs.tags }}

README.md

@@ -275,12 +275,22 @@ if db_lib.needs_update():
 
 ## Model Context Protocol (MCP) server
 
-Refer to the [readme](./contrib/mcp-server-vdb/README.md)
+Refer to the [readme](./packages/mcp-server-vdb/README.md)
 
 ## Read .vdb6 files in other languages
 
 .vdb6 files are standard SQLite database files. Use any modern sqlite library to read and query them. There is a mini [deno example](./contrib/deno-vdb/README.md) in this repo for demonstration.
 
+## Local development
+
+Setup uv by following the official [documentation](https://docs.astral.sh/uv/).
+
+```shell
+uv sync --all-extras --dev
+uv run depscan --help
+uv run pytest
+```
+
 ## License
 
 MIT

contrib/mcp-server-vdb/.dockerignore packages/mcp-server-vdb/.dockerignorecontrib/mcp-server-vdb/.dockerignore renamed to packages/mcp-server-vdb/.dockerignore

@@ -23,13 +23,29 @@ classifiers = [
 ]
 
 dependencies = [
-    "appthreat-vulnerability-db[oras]>=6.2.3",
+    "appthreat-vulnerability-db[oras]",
     "mcp[cli]>=1.2.1",
 ]
 
 [build-system]
-requires = ["hatchling"]
-build-backend = "hatchling.build"
+requires = ["setuptools>=61", "wheel", "build"]
+build-backend = "setuptools.build_meta"
+
+[project.optional-dependencies]
+dev = [
+    "black",
+    "bandit",
+    "flake8",
+    "pylint",
+    "pytest",
+    "pytest-cov",
+]
 
 [project.scripts]
 mcp-server-vdb = "mcp_server_vdb:main"
+
+[tool.pytest.ini_options]
+addopts="--showlocals -v --cov-report=term-missing --no-cov-on-fail --cov vdb"
+testpaths = [
+    "test"
+]