Use uv for Docker build

Use uv to install packages in the Docker build, and configure uv
to verify package hashes if provided but accept package entries that
have no hashes. This allows dropping the update-deps-no-hashes
Makefile target, which was needed because pip install wouldn't accept
mixed hash and no-hash requirements files.

Update Python and pre-commit dependencies.

.pre-commit-config.yaml

@@ -8,7 +8,7 @@ repos:
       - id: trailing-whitespace
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.6.3
+    rev: v0.6.4
     hooks:
       - id: ruff
         args: [--fix, --exit-non-zero-on-fix]

Dockerfile

@@ -20,6 +20,9 @@ RUN ./install-base-packages.sh && rm ./install-base-packages.sh
 
 FROM base-image AS install-image
 
+# Install uv.
+COPY --from=ghcr.io/astral-sh/uv:0.4.9 /uv /bin/uv
+
 # Install system packages only needed for building dependencies.
 COPY scripts/install-dependency-packages.sh .
 RUN ./install-dependency-packages.sh
@@ -31,17 +34,15 @@ RUN python -m venv $VIRTUAL_ENV
 # Make sure we use the virtualenv
 ENV PATH="$VIRTUAL_ENV/bin:$PATH"
 
-# Put the latest pip and setuptools in the virtualenv
-RUN pip install --upgrade --no-cache-dir pip setuptools wheel
-
 # Install the app's Python runtime dependencies
 COPY requirements/main.txt ./requirements.txt
-RUN pip install --quiet --no-cache-dir -r requirements.txt
+RUN uv pip install  --compile-bytecode --verify-hashes --no-cache \
+    -r requirements.txt
 
 # Install the application.
 COPY . /workdir
 WORKDIR /workdir
-RUN pip install --no-cache-dir .
+RUN uv pip install --compile-bytecode --no-cache .
 
 FROM base-image AS runtime-image
 

Makefile

@@ -4,13 +4,12 @@ help:
 	@echo "make init - Set up dev environment"
 	@echo "make update - Update pinned dependencies and run make init"
 	@echo "make update-deps - Update pinned dependencies"
-	@echo "make update-deps-no-hashes - Pin dependencies without hashes"
 
 .PHONY: init
 init:
 	pip install --upgrade pip uv
-	uv pip install -r requirements/main.txt -r requirements/dev.txt \
-	    -r requirements/tox.txt
+	uv pip install --verify-hashes -r requirements/main.txt \
+	    -r requirements/dev.txt -r requirements/tox.txt
 	uv pip install --editable .
 	rm -rf .tox
 	uv pip install --upgrade pre-commit
@@ -30,14 +29,3 @@ update-deps:
 	    --output-file requirements/dev.txt requirements/dev.in
 	uv pip compile --upgrade --universal --generate-hashes		\
 	    --output-file requirements/tox.txt requirements/tox.in
-
-# Useful for testing against a Git version of a dependency.
-.PHONY: update-deps-no-hashes
-update-deps-no-hashes:
-	pip install --upgrade uv
-	uv pip compile --upgrade --universal				\
-	    --output-file requirements/main.txt pyproject.toml
-	uv pip compile --upgrade --universal				\
-	    --output-file requirements/dev.txt requirements/dev.in
-	uv pip compile --upgrade --universal				\
-	    --output-file requirements/tox.txt requirements/tox.in

requirements/dev.txt

@@ -363,9 +363,9 @@ pluggy==1.5.0 \
     --hash=sha256:2cffa88e94fdc978c4c574f15f9e59b7f4201d439195c3715ca9e2486f1d0cf1 \
     --hash=sha256:44e1ad92c8ca002de6377e165f3e0f1be63266ab4d554740532335b9d75ea669
     # via pytest
-pytest==8.3.2 \
-    --hash=sha256:4ba08f9ae7dcf84ded419494d229b48d0903ea6407b030eaec46df5e6a73bba5 \
-    --hash=sha256:c132345d12ce551242c87269de812483f5bcc87cdbb4722e48487ba194f9fdce
+pytest==8.3.3 \
+    --hash=sha256:70b98107bd648308a7952b06e6ca9a50bc660be218d53c257cc1fc94fda10181 \
+    --hash=sha256:a6853c7375b2663155079443d2e45de913a911a11d669df02a50814944db57b2
     # via
     #   -r requirements/dev.in
     #   pytest-asyncio
@@ -420,9 +420,9 @@ typing-extensions==4.12.2 \
     # via
     #   -c requirements/main.txt
     #   mypy
-urllib3==2.2.2 \
-    --hash=sha256:a448b2f64d686155468037e1ace9f2d2199776e17f0a46610480d311f73e3472 \
-    --hash=sha256:dd505485549a7a552833da5e6063639d0d177c04f23bc3864e41e5dc5f612168
+urllib3==2.2.3 \
+    --hash=sha256:ca899ca043dcb1bafa3e262d73aa25c465bfb49e0bd9dd5d59f1d0acba2f8fac \
+    --hash=sha256:e7d814a81dad81e6caf2ec9fdedb284ecc9c73076b62654547cc64ccdcae26e9
     # via
     #   -c requirements/main.txt
     #   requests