feat: migrate codejail sandbox to its own uv project (uv migration 3/5)

Gives requirements/edx-sandbox/ its own standalone pyproject.toml +
uv.lock, independent of the main app's dependency graph (codejail
intentionally runs untrusted code in a separate, isolated venv).

[tool.edx_lint].uv_constraints holds only the subset of the root
constraints relevant to this environment's deps (numpy, lxml,
setuptools) -- uv/edx-lint have no cross-project constraint chaining
equivalent to pip-compile's "-c ../constraints.txt", so root and
sandbox constraints are now independently maintained (documented in
requirements/edx-sandbox/README.rst).

base.txt is regenerated as a `uv export` compatibility artifact (the
README documents it as a supported, if unstable, direct pip-install
target). releases/*.txt are untouched -- they're frozen historical
snapshots, not part of any active compile loop; README now documents
cutting future ones via `uv export` instead of pip-compile.

Part of openedx/public-engineering#543 (3 of 5).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: 2 people

Makefile

@@ -64,7 +64,7 @@ pull_translations: clean_translations  ## pull translations via atlas
 detect_changed_source_translations: ## check if translation files are up-to-date
 	i18n_tool changed
 
-pre-requirements: ## install Python requirements for running pip-tools (still needed for requirements/edx-sandbox and scripts/*, which aren't on uv yet)
+pre-requirements: ## install Python requirements for running pip-tools (still needed for scripts/*, which aren't on uv yet)
 	pip install -r requirements/pip-tools.txt
 
 local-requirements: ## no-op; `uv sync` (used by the targets below) already installs -e . itself
@@ -81,19 +81,22 @@ test-requirements: ## install production dependencies plus the testing group (us
 
 requirements: dev-requirements ## install development environment requirements
 
-# requirements/edx-sandbox (codejail's isolated sandbox environment) and the
-# scripts/* one-off script directories are not yet migrated to uv (tracked in
-# https://github.com/openedx/public-engineering/issues/543) and are still
+# The scripts/* one-off script directories are not yet migrated to uv (tracked
+# in https://github.com/openedx/public-engineering/issues/543) and are still
 # compiled with pip-compile below. Order is important: files must appear
 # after everything they include!
 REQ_FILES = \
-	requirements/edx-sandbox/base \
 	scripts/xblock/requirements \
 	scripts/user_retirement/requirements/base \
 	scripts/user_retirement/requirements/testing \
 	scripts/structures_pruning/requirements/base \
 	scripts/structures_pruning/requirements/testing
 
+# uv-managed sub-projects, each with their own pyproject.toml + uv.lock,
+# independent of the root project's dependency graph.
+UV_SUBPROJECTS = \
+	requirements/edx-sandbox
+
 define COMMON_CONSTRAINTS_TEMP_COMMENT
 # This is a temporary solution to override the real common_constraints.txt\n# In edx-lint, until the pyjwt constraint in edx-lint has been removed.\n# See BOM-2721 for more details.\n# Below is the copied and edited version of common_constraints\n
 endef
@@ -152,7 +155,21 @@ compile-requirements: pre-requirements ## Regenerate uv.lock for the root projec
 		export REBUILD=''; \
 	done
 
-upgrade: $(COMMON_CONSTRAINTS_TXT) ## update all dependencies (uv.lock for the root project, pip-compile for the not-yet-migrated sub-projects) to the latest releases satisfying our constraints
+	@for d in $(UV_SUBPROJECTS); do \
+		echo ; \
+		echo "== $$d ===============================" ; \
+		uv run --no-project --with edx-lint edx_lint write_uv_constraints $$d/pyproject.toml && \
+		(cd $$d && uv lock ${UV_LOCK_OPTS}) && \
+		( \
+			echo "# GENERATED FILE, DO NOT EDIT DIRECTLY."; \
+			echo "# Compatibility export for anyone still 'pip install -r $$d/base.txt'"; \
+			echo "# directly instead of using uv. Source of truth: $$d/pyproject.toml / uv.lock."; \
+			(cd $$d && uv export --frozen --no-hashes --no-emit-project); \
+		) > $$d/base.txt \
+		|| exit 1; \
+	done
+
+upgrade: $(COMMON_CONSTRAINTS_TXT) ## update all dependencies (uv.lock for the root project and uv sub-projects, pip-compile for the not-yet-migrated sub-projects) to the latest releases satisfying our constraints
 	$(MAKE) compile-requirements COMPILE_OPTS="--upgrade" UV_LOCK_OPTS="--upgrade"
 
 upgrade-package: ## update just one package to the latest usable release

requirements/edx-sandbox/README.rst

@@ -10,22 +10,27 @@ within ``<script type="loncapa/python">`` ProblemBlock tags.
 Files in this directory
 ***********************
 
-base.in
-=======
+pyproject.toml / uv.lock
+=========================
 
-This is the current set of requirements or the edx-sandbox environment, and it
-is used to generate the ``.txt`` files described below. These requirements
-share some constraints with the general edx-platform requirements (via
-``../constraints.txt``), but otherwise, they are completely separate.
+This is the current set of requirements for the edx-sandbox environment,
+managed with `uv <https://docs.astral.sh/uv/>`_ independently of the main
+edx-platform application. ``[tool.edx_lint].uv_constraints`` holds only the
+subset of the root ``pyproject.toml``'s constraints that are actually
+relevant to this environment's dependencies -- uv/edx-lint have no equivalent
+to pip-compile's ``-c ../constraints.txt`` cross-project chaining, so these
+are maintained independently from the root ones.
 
-Installing the edx-sandbox environment from this file is **unsupported** and
-**unstable**, because the packages are not pinned.
+Regenerate ``uv.lock`` (and the ``base.txt`` compatibility export below) by
+running ``make compile-requirements`` or ``make upgrade`` from the repo root
+-- see the root ``Makefile``'s ``UV_SUBPROJECTS`` loop.
 
 base.txt
 ========
 
-These are the latest requirement pins for edx-sandbox. They are regularly
-updated with the latest compatible versions of each package.
+A ``uv export`` of ``uv.lock``, kept for anyone still
+``pip install -r requirements/edx-sandbox/base.txt`` directly instead of
+using uv. **This is a generated file -- do not edit directly.**
 
 Installing the edx-sandbox environment from this file is **supported** yet
 **unstable**. Breaking package upgrades and Python langugae upgrades will
@@ -36,7 +41,10 @@ releases/
 
 Starting with Quince, every named Open edX release adds one of these files.
 They contain the requirement pins corresponding to ``base.txt`` at the time of
-each release.
+each release. These are frozen, historical snapshots -- they are not
+regenerated by ``make upgrade`` and are not managed by uv. Cut a new one at
+release time with ``uv export --project requirements/edx-sandbox --no-hashes
+--no-emit-project -o requirements/edx-sandbox/releases/<name>.txt``.
 
 Installing the edx-sandbox environment from the *latest* release file is
 **supported** and **stable**. Installing the edx-sandbox environment from

requirements/edx-sandbox/base.in

@@ -1,21 +1,24 @@
-#
-# This file is autogenerated by pip-compile with Python 3.12
-# by the following command:
-#
-#    make upgrade
-#
-cffi==2.0.0
+# GENERATED FILE, DO NOT EDIT DIRECTLY.
+# Compatibility export for anyone still 'pip install -r requirements/edx-sandbox/base.txt'
+# directly instead of using uv. Source of truth: requirements/edx-sandbox/pyproject.toml / uv.lock.
+# This file was autogenerated by uv via the following command:
+#    uv export --frozen --no-hashes --no-emit-project
+cffi==2.0.0 ; platform_python_implementation != 'PyPy'
     # via cryptography
 chem==2.0.0
-    # via -r requirements/edx-sandbox/base.in
-click==8.4.1
+    # via edx-sandbox
+click==8.4.2
     # via nltk
 codejail-includes==2.0.0
-    # via -r requirements/edx-sandbox/base.in
+    # via edx-sandbox
+colorama==0.4.6 ; sys_platform == 'win32'
+    # via
+    #   click
+    #   tqdm
 contourpy==1.3.3
     # via matplotlib
 cryptography==49.0.0
-    # via -r requirements/edx-sandbox/base.in
+    # via edx-sandbox
 cycler==0.12.1
     # via matplotlib
 fonttools==4.63.0
@@ -24,10 +27,9 @@ joblib==1.5.3
     # via nltk
 kiwisolver==1.5.0
     # via matplotlib
-lxml[html-clean]==5.3.2
+lxml==5.3.2
     # via
-    #   -c requirements/constraints.txt
-    #   -r requirements/edx-sandbox/base.in
+    #   edx-sandbox
     #   lxml-html-clean
     #   openedx-calc
 lxml-html-clean==0.4.4
@@ -37,52 +39,51 @@ markupsafe==3.0.3
     #   chem
     #   openedx-calc
 matplotlib==3.11.0
-    # via -r requirements/edx-sandbox/base.in
+    # via edx-sandbox
 mpmath==1.3.0
     # via sympy
 networkx==3.6.1
-    # via -r requirements/edx-sandbox/base.in
+    # via edx-sandbox
 nltk==3.9.4
     # via
-    #   -r requirements/edx-sandbox/base.in
     #   chem
+    #   edx-sandbox
 numpy==1.26.4
     # via
-    #   -c requirements/constraints.txt
     #   chem
     #   contourpy
     #   matplotlib
     #   openedx-calc
     #   scipy
 openedx-calc==5.0.0
-    # via -r requirements/edx-sandbox/base.in
+    # via edx-sandbox
 packaging==26.2
     # via matplotlib
 pillow==12.2.0
     # via matplotlib
-pycparser==3.0
+pycparser==3.0 ; implementation_name != 'PyPy' and platform_python_implementation != 'PyPy'
     # via cffi
 pyparsing==3.3.2
     # via
-    #   -r requirements/edx-sandbox/base.in
     #   chem
+    #   edx-sandbox
     #   matplotlib
     #   openedx-calc
 python-dateutil==2.9.0.post0
     # via matplotlib
 random2==1.0.2
-    # via -r requirements/edx-sandbox/base.in
-regex==2026.5.9
+    # via edx-sandbox
+regex==2026.6.28
     # via nltk
 scipy==1.17.1
     # via
-    #   -r requirements/edx-sandbox/base.in
     #   chem
+    #   edx-sandbox
 six==1.17.0
     # via python-dateutil
 sympy==1.14.0
     # via
-    #   -r requirements/edx-sandbox/base.in
+    #   edx-sandbox
     #   openedx-calc
-tqdm==4.68.2
+tqdm==4.68.3
     # via nltk

requirements/edx-sandbox/base.txt

@@ -0,0 +1,57 @@
+[project]
+name = "edx-sandbox"
+version = "0.1"
+requires-python = ">=3.12"
+dependencies = [
+    "chem", # A helper library for chemistry calculations
+    "cryptography", # Implementations of assorted cryptography algorithms
+    "lxml[html_clean]", # XML parser
+    "matplotlib", # 2D plotting library
+    "networkx", # Utilities for creating, manipulating, and studying network graphs
+    "nltk", # Natural language processing; used by the chem package
+    "openedx-calc",
+    "pyparsing", # Python Parsing module
+    "random2", # Implementation of random module that works identically under Python 2 and 3
+    "scipy", # Math, science, and engineering library
+    "sympy", # Symbolic math library
+    "codejail-includes", # CodeJail manages execution of untrusted code in secure sandboxes.
+]
+
+[tool.uv]
+# This isn't installed as a package itself -- it's just a locked dependency
+# set that gets resolved into codejail's isolated sandbox venv.
+package = false
+
+#  DO NOT EDIT constraint-dependencies DIRECTLY.
+#  This list is managed by `edx_lint write_uv_constraints`
+#  and will be overwritten the next time `make upgrade` is run.
+#  - GLOBAL constraints: edit edx_lint/files/common_constraints.txt
+#  - REPO-SPECIFIC constraints: edit [tool.edx_lint].uv_constraints in this file
+constraint-dependencies = [
+    "Django<6.0",
+    "elasticsearch<7.14.0",
+    "numpy<2.0.0",
+    "lxml==5.3.2",
+    "setuptools<82",
+]
+[tool.edx_lint]
+# Only the subset of the root pyproject.toml's constraints that are actually
+# relevant to this environment's dependencies. uv/edx-lint have no equivalent
+# to pip-compile's "-c ../constraints.txt" cross-project chaining, so these
+# are independently maintained from the root ones -- see README.rst.
+uv_constraints = [
+    # Needed at least until elasticsearch (used by the main edx-platform app,
+    # not this environment) is upgraded past 7.15 -- see the root
+    # pyproject.toml's [tool.edx_lint].uv_constraints for the full rationale.
+    "numpy<2.0.0",
+    # lxml and xmlsec need to be constrained because the latest version builds
+    # against a newer version of libxml2 than what we're running with -- see
+    # the root pyproject.toml's [tool.edx_lint].uv_constraints for the full
+    # rationale.
+    "lxml==5.3.2",
+    # setuptools 82.0.0 removed pkg_resources from its distribution, but fs
+    # (pyfilesystem2) still uses pkg_resources for namespace package
+    # declarations -- see the root pyproject.toml's
+    # [tool.edx_lint].uv_constraints for the full rationale.
+    "setuptools<82",
+]