kubeflow/trainer
Migrate Python dependency management from pip-tools to uv
Fechada
#3.535 aberto em 20 de mai. de 2026
area/engprodgood first issuehelp wanted
Métricas do repositório
- Stars
- (2.112 estrelas)
- Métricas de merge de PR
- (Mesclagem média 10d 9h) (75 fundiu PRs em 30d)
Description
Summary
Migrate all Python services in the trainer repo from pip-tools (pip-compile) to uv for dependency locking and vulnerability scanning workflows.
Motivation
The kubeflow/sdk repo already uses uv for this purpose. Migrating trainer would:
- Eliminate the custom hack/scripts/update-source-dep.py script in favor of uv-native uv lock --upgrade-package and override-dependencies
- Align tooling across Kubeflow Python repos
- Simplify the OSV-Scanner auto-fix workflow
- Remove the need to pin pip-tools and track pip compatibility
Scope
- Replace pip-compile / pip-tools with uv lock for lockfile generation
- Update osv-scanner.yaml to use uv lock --upgrade-package + override pattern (reference: kubeflow/sdk)
- Update validate-lockfile.yaml to use uv lock --check
- Add helper scripts under .github/scripts/ (adapted from kubeflow/sdk)
- Delete hack/scripts/update-source-dep.py
- Replace requirements-lock.txt files with uv.lock
- Update Dockerfiles if they reference requirements-lock.txt
Components
- cmd/initializers/dataset
- cmd/initializers/model
- api/python_api
Reference
- kubeflow/sdk OSV-Scanner workflow: .github/workflows/osv-scanner.yaml