chore(deps): move Python pins to pyproject.toml and uv.lock

requirements-dev.txt and scripts/site/requirements.txt are replaced by one
pyproject.toml (site and dev dependency groups) and a committed uv.lock.
CI installs from the lock with `uv export --locked`, so a pin edited
without `uv lock` fails the build, and the exported requirements carry
hashes. Dependabot's two pip entries become one uv entry.

HOL's registry scan flags the repo for a missing lockfile and its
Maintenance component credits a package manifest and a lockfile (#512).

Closes #512

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: TMHSDigital

.github/dependabot.yml

@@ -11,30 +11,15 @@ updates:
       github-actions:
         patterns:
           - "*"
-  - package-ecosystem: "pip"
-    directory: "/scripts/site"
-    schedule:
-      interval: "weekly"
-    target-branch: "main"
-    commit-message:
-      prefix: "chore(deps)"
-    groups:
-      site-build:
-        patterns:
-          - "*"
-  - package-ecosystem: "pip"
+  # pyproject.toml + uv.lock hold every Python pin (the site and dev groups),
+  # so one entry bumps both files together (#512).
+  - package-ecosystem: "uv"
     directory: "/"
     schedule:
       interval: "weekly"
     target-branch: "main"
     commit-message:
       prefix: "chore(deps)"
-    # requirements-dev.txt pulls in scripts/site/requirements.txt with -r, so
-    # without this the site pins get two identical PRs (site-build and
-    # dev-tools) on every bump. The /scripts/site entry owns them.
-    ignore:
-      - dependency-name: "jinja2"
-      - dependency-name: "markupsafe"
     groups:
       dev-tools:
         patterns:

.github/workflows/pages.yml

@@ -101,9 +101,13 @@ jobs:
         with:
           python-version: "3.12"
           cache: pip
-          cache-dependency-path: scripts/site/requirements.txt
+          cache-dependency-path: uv.lock
 
-      - run: pip install -r scripts/site/requirements.txt
+      - name: Install locked site dependencies (pyproject.toml + uv.lock)
+        run: |
+          pip install uv==0.8.5
+          uv export --locked --only-group site --no-emit-project -o "$RUNNER_TEMP/requirements.txt"
+          pip install -r "$RUNNER_TEMP/requirements.txt"
 
       - name: Build landing page (vendored template)
         run: python scripts/site/build_site.py --repo-root . --out docs

.github/workflows/validate.yml

@@ -40,10 +40,15 @@ jobs:
           fi
           echo "VERSION valid: $version"
 
-      - name: Validate skill and rule frontmatter (parsed YAML, first block only)
+      # --locked fails the build when pyproject.toml changed without `uv lock`.
+      - name: Install locked dev dependencies (pyproject.toml + uv.lock)
         run: |
-          pip install -r requirements-dev.txt
-          python3 tests/check_frontmatter.py
+          pip install uv==0.8.5
+          uv export --locked --only-group dev --no-emit-project -o "$RUNNER_TEMP/requirements.txt"
+          pip install -r "$RUNNER_TEMP/requirements.txt"
+
+      - name: Validate skill and rule frontmatter (parsed YAML, first block only)
+        run: python3 tests/check_frontmatter.py
 
       - name: Validate snippet Python syntax
         run: |
@@ -152,9 +157,13 @@ jobs:
         with:
           python-version: "3.12"
           cache: pip
-          cache-dependency-path: scripts/site/requirements.txt
+          cache-dependency-path: uv.lock
 
-      - run: pip install -r scripts/site/requirements.txt
+      - name: Install locked site dependencies (pyproject.toml + uv.lock)
+        run: |
+          pip install uv==0.8.5
+          uv export --locked --only-group site --no-emit-project -o "$RUNNER_TEMP/requirements.txt"
+          pip install -r "$RUNNER_TEMP/requirements.txt"
 
       - name: Build landing page into docs/
         run: python scripts/site/build_site.py --repo-root . --out docs
@@ -463,8 +472,11 @@ jobs:
         with:
           python-version: "3.12"  # pinned: the runner image's python3 moves (#495)
 
-      - name: Install pinned dev requirements (the release-gate mirror test reads YAML)
-        run: pip install -r requirements-dev.txt
+      - name: Install locked dev dependencies (the release-gate mirror test reads YAML)
+        run: |
+          pip install uv==0.8.5
+          uv export --locked --only-group dev --no-emit-project -o "$RUNNER_TEMP/requirements.txt"
+          pip install -r "$RUNNER_TEMP/requirements.txt"
 
       - name: Harness unit tests
         run: python3 tests/smoke/test_harness.py -v

CONTRIBUTING.md

@@ -14,8 +14,8 @@ The fastest useful contributions are small and need no Blender run:
 - **Pick up a starter issue:** issues labelled
   [`good first issue`](https://github.com/TMHSDigital/Blender-Developer-Tools/labels/good%20first%20issue).
 
-Then: fork, branch, `pip install -r requirements-dev.txt`,
-`python tests/run_all.py`, and open a PR with a DCO sign-off (`git commit -s`;
+Then: fork, branch, `uv sync`,
+`uv run python tests/run_all.py`, and open a PR with a DCO sign-off (`git commit -s`;
 see the end of this file). Examples and showcase pieces have more gates
 (falsifiers, exit-code tables, renders); read their sections first.
 
@@ -40,10 +40,14 @@ see the end of this file). Examples and showcase pieces have more gates
    exit-code, gallery, link and packaging gates, plus the tooling tests):
 
    ```bash
-   pip install -r requirements-dev.txt
-   python tests/run_all.py            # or: python tests/run_all.py -k catalog
+   uv sync                                   # pins: pyproject.toml + uv.lock
+   uv run python tests/run_all.py            # or: ... tests/run_all.py -k catalog
    ```
 
+   No uv yet? `pip install uv` first. If you change a pin in
+   `pyproject.toml`, run `uv lock` and commit `uv.lock` with it; CI fails on a
+   stale lock.
+
    Blender smoke runs in CI on 5.2 LTS and 4.5 LTS; to run an example locally,
    see `tests/smoke/run_example.py`.
 

pyproject.toml

@@ -0,0 +1,33 @@
+# The repo's Python tooling pins, locked in uv.lock (#512). Nothing here is a
+# published package: the content ships as a plugin, and VERSION is the release
+# source of truth. Blender itself is not a pip package; see CLAUDE.md
+# "Blender Runtime Discovery" for the smoke tests.
+#
+#   uv sync                     # dev group: everything tests/run_all.py needs
+#   uv run python tests/run_all.py
+#
+# CI installs from the lock with `uv export --locked`, so a pyproject edit
+# without a matching `uv lock` fails the build.
+[project]
+name = "blender-developer-tools"
+version = "0.0.0"  # placeholder required by the [project] table; VERSION is real
+requires-python = ">=3.12"
+dependencies = []
+
+[dependency-groups]
+# The landing and 404 build (scripts/site/build_site.py).
+site = [
+    "Jinja2==3.1.6",
+    "MarkupSafe==3.0.4",
+]
+# Every Validate check that does not need Blender.
+dev = [
+    { include-group = "site" },
+    "PyYAML==6.0.3",
+    "numpy==2.5.4",
+    "Pillow==13.0.0",
+]
+
+[tool.uv]
+package = false
+default-groups = ["dev"]

requirements-dev.txt

@@ -1,8 +1,8 @@
 #!/usr/bin/env python3
 """Run every Validate check locally in one command (#364). No Blender needed.
 
-    pip install -r requirements-dev.txt
-    python tests/run_all.py            # all checks, summary at the end
+    uv sync                            # pins from pyproject.toml + uv.lock
+    uv run python tests/run_all.py     # all checks, summary at the end
     python tests/run_all.py -k gallery # only checks whose name contains "gallery"
 
 It runs every tests/check_*.py and tests/test_*.py, the smoke-harness tests,