mirror of
https://github.com/jxxghp/MoviePilot.git
synced 2026-09-06 16:07:01 +08:00
feat: 使用 uv 锁定主程序依赖并强化插件恢复边界 (#6364)
This commit is contained in:
InfinityPacer
+14
-11
@@ -4,8 +4,9 @@
|
||||
|
||||
| Item | Detail |
|
||||
|---|---|
|
||||
| Language | Python 3.11+ |
|
||||
| CI Python version | Python 3.12 |
|
||||
| Language | Python 3.12+ |
|
||||
| Primary CI Python version | Python 3.12 |
|
||||
| Dependency compatibility CI | Supported platform matrix on Python 3.12, plus newer interpreter coverage on Linux x86_64 |
|
||||
| Async runtime | asyncio (native), integrated with FastAPI/Uvicorn |
|
||||
|
||||
---
|
||||
@@ -104,11 +105,12 @@
|
||||
|
||||
| Item | Detail |
|
||||
|---|---|
|
||||
| Runtime source | `requirements.in` — production/runtime dependencies only |
|
||||
| Dev/test/lint/build source | `requirements-dev.in` — includes runtime plus pytest, coverage tooling, pylint, and build support |
|
||||
| Compatibility entry | `requirements.txt` — delegates to `requirements.in`; not a committed cross-platform lock |
|
||||
| Runtime install | `pip install -r requirements.txt` |
|
||||
| Dev/test/lint/build install | `pip install -r requirements-dev.in` |
|
||||
| Project metadata | `pyproject.toml` — runtime dependencies in `[project].dependencies`, development tooling in `[dependency-groups].dev` |
|
||||
| Lock | `uv.lock` — committed resolution for Python 3.12+ and supported platforms |
|
||||
| Package manager | uv 0.12.5 |
|
||||
| Runtime install | `uv sync --locked --no-dev --no-install-project` |
|
||||
| Dev/test/lint/build install | `uv sync --locked` |
|
||||
| Supported platforms | Linux x86_64/arm64, macOS x86_64/arm64, Windows x64 |
|
||||
|
||||
---
|
||||
|
||||
@@ -127,9 +129,10 @@
|
||||
|
||||
| Tool | Purpose | Command |
|
||||
|---|---|---|
|
||||
| pytest | Test runner | `pytest tests/test_xxx.py` |
|
||||
| pylint | Static analysis | `pylint app/` |
|
||||
| safety | Dependency vulnerability scan | `safety check -r requirements.txt --policy-file=safety.policy.yml` |
|
||||
| pytest | Test runner | `uv run --locked --no-sync pytest tests/test_xxx.py` |
|
||||
| pylint | Static analysis | `uv run --locked --no-sync pylint app/` |
|
||||
| uv | Lock and environment consistency | `uv lock --check && uv pip check` |
|
||||
| safety | Manual dependency vulnerability scan | `uvx safety scan --target . --policy-file safety.policy.yml` |
|
||||
|
||||
---
|
||||
|
||||
@@ -142,4 +145,4 @@
|
||||
| Frontend | Vue/TypeScript SPA served from `public/`; source in `MoviePilot-Frontend` repo |
|
||||
| Frontend proxy | Local Node `service.js` proxies `/api` and `/cookiecloud` to the backend |
|
||||
|
||||
*Last Updated: 2026-05-25*
|
||||
*Last Updated: 2026-08-19*
|
||||
|
||||
+26
-30
@@ -7,16 +7,11 @@ This document is the project command reference, not an exhaustive shell allowlis
|
||||
## Development Environment Setup
|
||||
|
||||
```bash
|
||||
# Create and activate virtual environment
|
||||
python3 -m venv venv
|
||||
source venv/bin/activate # macOS / Linux
|
||||
.\venv\Scripts\activate # Windows
|
||||
# Create the locked development/test environment
|
||||
uv sync --locked
|
||||
|
||||
# Install runtime dependencies
|
||||
pip install -r requirements.txt
|
||||
|
||||
# Install development/test/lint/build dependencies
|
||||
pip install -r requirements-dev.in
|
||||
# Create a runtime-only environment
|
||||
uv sync --locked --no-dev --no-install-project
|
||||
```
|
||||
|
||||
---
|
||||
@@ -24,17 +19,21 @@ pip install -r requirements-dev.in
|
||||
## Dependency Management
|
||||
|
||||
```bash
|
||||
# Install runtime dependencies
|
||||
pip install -r requirements.txt
|
||||
# Verify that project metadata and lock agree
|
||||
uv lock --check
|
||||
|
||||
# Install test/lint/build dependencies
|
||||
pip install -r requirements-dev.in
|
||||
# Update the lock after editing pyproject.toml
|
||||
uv lock
|
||||
|
||||
# Verify installed dependency consistency
|
||||
uv pip check
|
||||
```
|
||||
|
||||
**Rules:**
|
||||
- Runtime dependencies belong in `requirements.in`.
|
||||
- Test, coverage, lint, and explicit build tooling belong in `requirements-dev.in`.
|
||||
- `requirements.txt` is a compatibility entry that delegates to `requirements.in`; do not replace it with a local cross-platform lock file.
|
||||
- Runtime dependencies belong in `[project].dependencies` in `pyproject.toml`.
|
||||
- Test, coverage, lint, and explicit build tooling belong in `[dependency-groups].dev`.
|
||||
- Commit the updated `uv.lock`; do not maintain or generate main-program requirements files.
|
||||
- Use uv 0.12.5 and Python 3.12+.
|
||||
|
||||
---
|
||||
|
||||
@@ -42,16 +41,16 @@ pip install -r requirements-dev.in
|
||||
|
||||
```bash
|
||||
# Run a specific test file
|
||||
pytest tests/test_xxx.py
|
||||
uv run --locked --no-sync pytest tests/test_xxx.py
|
||||
|
||||
# Run all tests
|
||||
pytest
|
||||
uv run --locked --no-sync pytest
|
||||
|
||||
# Run tests with verbose output
|
||||
pytest -v tests/test_xxx.py
|
||||
uv run --locked --no-sync pytest -v tests/test_xxx.py
|
||||
|
||||
# Run a specific test function
|
||||
pytest tests/test_xxx.py::test_function_name
|
||||
uv run --locked --no-sync pytest tests/test_xxx.py::test_function_name
|
||||
```
|
||||
|
||||
**Rules:**
|
||||
@@ -65,10 +64,10 @@ pytest tests/test_xxx.py::test_function_name
|
||||
|
||||
```bash
|
||||
# Run pylint on the application package
|
||||
pylint app/
|
||||
uv run --locked --no-sync pylint app/
|
||||
|
||||
# Run pylint on a specific module
|
||||
pylint app/chain/download.py
|
||||
uv run --locked --no-sync pylint app/chain/download.py
|
||||
```
|
||||
|
||||
**Rules:**
|
||||
@@ -80,15 +79,12 @@ pylint app/chain/download.py
|
||||
## Security Scan
|
||||
|
||||
```bash
|
||||
# Run safety check against the runtime compatibility entry
|
||||
safety check -r requirements.txt --policy-file=safety.policy.yml
|
||||
|
||||
# Save report to file
|
||||
safety check -r requirements.txt --policy-file=safety.policy.yml > safety_report.txt
|
||||
# Scan pyproject.toml and uv.lock
|
||||
uvx safety scan --target . --policy-file=safety.policy.yml
|
||||
```
|
||||
|
||||
**Rules:**
|
||||
- Run after runtime dependency changes; include `requirements-dev.in` when development/test/lint/build dependencies change.
|
||||
- Run manually after runtime or development dependency changes; this is not currently an automated CI job.
|
||||
- No new high-severity vulnerabilities may be introduced.
|
||||
|
||||
---
|
||||
@@ -132,7 +128,7 @@ curl -fsSL https://raw.githubusercontent.com/jxxghp/MoviePilot/v3/scripts/bootst
|
||||
|
||||
# Install backend dependencies
|
||||
moviepilot install deps
|
||||
moviepilot install deps --python python3.11
|
||||
moviepilot install deps --python python3.12
|
||||
moviepilot install deps --venv /path/to/venv
|
||||
moviepilot install deps --recreate
|
||||
|
||||
@@ -307,4 +303,4 @@ python -m scripts.generate_plugin_market_default \
|
||||
- The marked list must be nonempty and include `jxxghp/MoviePilot-Plugins`.
|
||||
- This command rewrites only `ConfigModel.PLUGIN_MARKET`; inspect the resulting diff before committing or packaging.
|
||||
|
||||
*Last Updated: 2026-08-06*
|
||||
*Last Updated: 2026-08-19*
|
||||
|
||||
@@ -11,7 +11,7 @@
|
||||
|
||||
## Python Version and Typing
|
||||
|
||||
- Target: **Python 3.11+**. CI runs Python 3.12.
|
||||
- Target: **Python 3.12+**. Python 3.12 is the primary CI version; compatibility CI also verifies newer interpreters.
|
||||
- **Type annotations are required** on all public methods and function signatures.
|
||||
- Use `Optional[X]` for nullable types (do not use `X | None` — keep consistency with the existing codebase style).
|
||||
- Use `Union[X, Y]` for multi-type parameters.
|
||||
@@ -114,11 +114,11 @@ except:
|
||||
|
||||
## What Not To Do
|
||||
|
||||
- Do not introduce new third-party libraries without placing them in the correct dependency entry: runtime packages in `requirements.in`, test/lint/build tooling in `requirements-dev.in`.
|
||||
- Do not introduce new third-party libraries without placing them in the correct `pyproject.toml` dependency group and updating `uv.lock`: runtime packages belong in `[project].dependencies`, test/lint/build tooling in `[dependency-groups].dev`.
|
||||
- Do not use `requests` or `httpx` directly for external HTTP calls - host code uses `RequestUtils` from `app/adapters/network/http.py`; plugins use `app.sdk.network`.
|
||||
- Do not issue raw SQLAlchemy queries from chains, modules, or endpoints — use the Oper classes in `app/db/oper/`.
|
||||
- Do not add TODO or FIXME without context. Only keep one if it is genuinely deferred and cannot be addressed in the current task.
|
||||
- Do not add noisy markers like `# change starts here`, `# important`, or `# this is a fix`.
|
||||
- Do not write comments that restate what the code already clearly says.
|
||||
|
||||
*Last Updated: 2026-08-14*
|
||||
*Last Updated: 2026-08-19*
|
||||
|
||||
@@ -6,10 +6,10 @@
|
||||
|
||||
```bash
|
||||
# Minimum: run tests directly related to the change
|
||||
pytest tests/test_<domain>.py
|
||||
uv run --locked --no-sync pytest tests/test_<domain>.py
|
||||
|
||||
# If the change affects common modules, startup flow, CLI, or agent runtime
|
||||
pytest
|
||||
uv run --locked --no-sync pytest
|
||||
```
|
||||
|
||||
### When to Expand Scope
|
||||
@@ -42,7 +42,7 @@ Run the full test suite when changing:
|
||||
## Static Analysis
|
||||
|
||||
```bash
|
||||
pylint app/
|
||||
uv run --locked --no-sync pylint app/
|
||||
```
|
||||
|
||||
- After any Python code change, ensure no new **error-level** pylint issues are introduced.
|
||||
@@ -54,10 +54,10 @@ pylint app/
|
||||
## Dependency Security Scan
|
||||
|
||||
```bash
|
||||
safety check -r requirements.txt --policy-file=safety.policy.yml
|
||||
uvx safety scan --target . --policy-file safety.policy.yml
|
||||
```
|
||||
|
||||
- Run after runtime dependency changes; scan the development dependency entry as well when `requirements-dev.in` changes.
|
||||
- Run manually after runtime or development dependency changes; Safety scans `pyproject.toml` and `uv.lock` directly, and this check is not currently an automated CI job.
|
||||
- No new high-severity vulnerabilities may be introduced.
|
||||
- If a vulnerability cannot be patched immediately, document it explicitly in the PR description.
|
||||
|
||||
@@ -131,11 +131,11 @@ Before marking any task as complete:
|
||||
|
||||
- [ ] Related pytest tests pass
|
||||
- [ ] No new pylint error-level issues in `pylint app/`
|
||||
- [ ] If dependencies changed: the package is in the correct runtime or dev dependency entry, and `safety check` passes for the affected entry
|
||||
- [ ] If dependencies changed: the package is in the correct `pyproject.toml` group, `uv.lock` is current, locked sync and `uv pip check` pass, and the manual Safety scan passes
|
||||
- [ ] If CLI behavior changed: `docs/cli.md` and related tests are updated
|
||||
- [ ] If MCP/API behavior changed: `docs/mcp-api.md` and related skill files are updated
|
||||
- [ ] If database schema changed: a new Alembic migration exists under `database/versions/`
|
||||
- [ ] No secrets are included in code, logs, or committed files
|
||||
- [ ] Public or cross-module contracts and non-obvious business behavior have useful Chinese documentation
|
||||
|
||||
*Last Updated: 2026-08-13*
|
||||
*Last Updated: 2026-08-19*
|
||||
|
||||
@@ -101,10 +101,10 @@ ci: improve docker build cache
|
||||
|
||||
When updating a dependency:
|
||||
|
||||
1. Decide the dependency layer: runtime packages go to `requirements.in`; test, coverage, lint, and explicit build tooling go to `requirements-dev.in`.
|
||||
2. Keep `requirements.txt` as the compatibility entry that delegates to `requirements.in`; do not commit a locally generated cross-platform lock file.
|
||||
3. Run `safety check -r requirements.txt --policy-file=safety.policy.yml`; include the dev dependency entry when `requirements-dev.in` changed.
|
||||
4. Run the full test suite: `pytest`.
|
||||
1. Decide the dependency layer: runtime packages go to `[project].dependencies`; test, coverage, lint, and explicit build tooling go to `[dependency-groups].dev`.
|
||||
2. Run `uv lock`, commit the updated `uv.lock`, and verify it with `uv lock --check`.
|
||||
3. Run `uv sync --locked`, `uv pip check`, and the manual `uvx safety scan --target . --policy-file safety.policy.yml` check.
|
||||
4. Run the full test suite: `uv run --locked --no-sync pytest`.
|
||||
|
||||
---
|
||||
|
||||
@@ -120,4 +120,4 @@ moviepilot update frontend
|
||||
|
||||
Bootstrap installer changes live in `scripts/bootstrap-local.sh`. Only modify this script if the task explicitly involves the bootstrap flow.
|
||||
|
||||
*Last Updated: 2026-05-25*
|
||||
*Last Updated: 2026-08-19*
|
||||
|
||||
Reference in New Issue
Block a user