migrate generated projects from poetry to uv (CMEM-8075)

[peterfreytag]

Summary

Generated projects switch from Poetry to uv (CMEM-8075). This is a major release (10.0.0): every project migrates through copier update, and the runbook is in CHANGELOG.md.

 src/pyproject.toml.jinja
-  [tool.poetry] + poetry-core / poetry-dynamic-versioning
+  [project] (PEP 621) + [dependency-groups] dev (PEP 735)
+  hatchling + uv-dynamic-versioning, sdist pinned to the package dir
+  [tool.uv] required-version >=0.11.7 (the eccenca image's uv)
 src/Taskfile.yaml
-  poetry:install / poetry run …
+  uv:install / uv run …          (every other task keeps its name)
 src/.gitlab-ci.yml
-  before_script: poetry config …   cache .venv on poetry.lock
+  variables: UV_CACHE_DIR, UV_LOCKED   cache .uv-cache on uv.lock
 src/.github/workflows/{check,publish}.yml
-  setup-python + snok/install-poetry
+  astral-sh/setup-uv@v10.3.0 (UV_LOCKED in check; uv build + uv publish)
 src/.pre-commit-config.yaml, .claude/, READMEs   no Poetry left
 Taskfile.yaml (root)
+  copier via uvx; check:build:case asserts sdist shape and git-derived version

Evidence

• task check: all six cases render, sync, pass their own checks and pass the new artifact check.
• Eccenca CI image (eccenca-python:v3.13.13, uv 0.11.7): uv lock, UV_LOCKED sync, pytest, build, export, cache prune --ci and task check all pass inside it.
  • Before: a floor of >=0.12 would have refused to run there.
• Version strings after a tag:
  • Before (Poetry): 1.2.4.dev1+<sha>
  • After (uv): 1.2.4.dev1+<sha>
  • A tagged sdist installed outside git reports 1.2.3.
• sdist contents: same file list as the poetry-core build except .gitignore, which hatchling always includes. A warning header was added to it.
• Negative check: adding tests to the sdist makes check:build:case fail with sdist must not ship tests/.
• Dev dependencies in trivy: --include-dev-deps on uv.lock scans 85 packages, against 32 without it.
• Migration runbook, tested on a Poetry project with humanize locked at 4.0.0 under ^4.0.0:
  • Before (fresh uv lock): 4.16.0
  • After (runbook step 4): stays at 4.0.0

Not covered by any automated check here, so the pilots must confirm:

• GitLab's lint and a real run of the generated .gitlab-ci.yml
• a real GitHub Actions run of the generated workflows
• a TestPyPI upload or cmemc install of a built package

Merge Danger

Door: two-way for the merge, one-way for the release.

Merging to develop reverts cleanly. Once v10.0.0 is tagged, any project that runs copier update replaces its Poetry setup and has to follow the runbook.

Blast Radius: every generated project.

Each project's own TaskfileCustom.yaml, .gitlab-ci-custom.yml and CLAUDE.md are not updated. Any poetry call in them breaks and has to be fixed by hand (at least cmem-plugin-base and cmem-plugin-apify). The ticket makes green pipelines in the pilots cmem-plugin-random (GitLab) and cmem-plugin-yaml (GitHub) a requirement before tagging.

🤖 Generated with Claude Code

[github-actions]

No description provided.