Recommend uv for local development

[danieleades]

this PR is a redux of #12817

now that pyproject.toml has standard support for dependency groups, it can be used with either pip or uv at the discretion of individual contributors.

This PR makes two changes:

• recommends UV as the workflow to use
• commits the UV lockfile so that contributors and CI use a consistent environment

---

note that there is more we can do around using the native UV interface in CI jobs rather than UV's pip-compatible layer, but i suggest saving this for future PRs

[AA-Turner]

Thanks!

What would the expectations be on updating uv.lock? When would we do this? Does dependabot have support for automatic updates?

A

[danieleades]

Thanks!

What would the expectations be on updating uv.lock? When would we do this? Does dependabot have support for automatic updates?

uv.lock would generally be updated whenever the dependencies change. dependabot supports updating the lockfile when it proposes updates. It's support is relatively new, so there are a few open issues on the dependabot repo for UV. I've been using it for a while without issues though.

Renovate has better support- it can also just refresh the lockfile without updating direct dependencies (which amounts to updating the project's transient dependencies). It's supported UV for a while now and is rock solid.

see https://docs.astral.sh/uv/guides/integration/dependency-bots/

[AA-Turner]

Cheers @danieleades

Should we add the YAML from https://docs.astral.sh/uv/guides/integration/dependency-bots/#dependabot to this PR?

I'd prefer not to adopt a new dependency bot if possible, dependabot is built-in to the platform and works decently enough.

A

[AA-Turner]

Thanks for seeing this through @danieleades

A