fix: correct uv sync/export flags that silently dropped project deps

Found via real CI runs after opening the PR (unit tests, Quality
Others, and the ReadTheDocs build all failed):

1. Makefile's test-requirements used `uv sync --only-group testing`,
   which EXCLUDES [project.dependencies] entirely (confirmed: `--only-group`
   replaces the dependency set rather than adding to it, unlike `--group`).
   This meant Django, XBlock, and the rest of the actual application were
   never installed for test runs -- ModuleNotFoundError: No module named
   'xblock' on every unit test shard. Fixed to
   `--no-default-groups --group testing`, matching what tox-uv itself
   generates for the equivalent tox environment.

2. .readthedocs.yaml had the same bug in its doc-requirements.txt export
   (`--only-group doc`). Since [project.dependencies] were excluded from
   that export, the subsequent `pip install -e .` resolved the whole
   dependency tree completely unconstrained by uv.lock's
   [tool.uv].constraint-dependencies -- picking setuptools==82.0.1 (violates
   setuptools<82) and Django==6.0.6 (violates Django<6.0). The setuptools
   violation broke fs/pyfilesystem2's pkg_resources import, crashing the
   Sphinx build via Django app loading. Fixed to `--group doc` plus
   `--no-deps` on the `pip install -e .` step, so dependencies only ever
   come from the properly-constrained export.

3. scripts/xsslint_config.py's SKIP_DIRS didn't exclude .venv. Under the
   old pip-compile system, dependencies installed into the system Python
   outside the repo checkout, so this never mattered. Now that `uv sync`
   creates .venv/ inside the checkout, xsslint's directory walk (which
   defaults to scanning the whole cwd) swept up thousands of vendored
   third-party files, inflating violations from 64 (the accepted baseline)
   to 316.

Verified all three: real pytest run (59 passed) plus full Django
`manage.py check` for both LMS and CMS against the corrected
test-requirements; a local simulation of the RTD build job sequence
confirms Django==5.2.15/setuptools==81.0.0 (both constraint-compliant)
and a successful Sphinx build.

Audited every other `--only-group` usage introduced in this migration
(assets.txt compat export, semgrep.yml) -- both are intentionally
project-dependency-free, matching the original files' documented
behavior, and their CI checks already passed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: 2 people

.readthedocs.yaml

@@ -7,16 +7,20 @@ build:
   jobs:
     post_create_environment:
       - pip install uv
-      # Export the `doc` dependency-group to a plain requirements.txt so it can be
-      # installed into RTD's own managed virtualenv below, rather than a separate
-      # uv-managed one -- this keeps RTD's normal sphinx auto-build detection intact.
-      # constraint-dependencies (e.g. setuptools<82, needed by fs/pyfilesystem2) are
-      # applied automatically as part of this export, so no separate pre-pinning step
-      # is needed the way requirements/pip-tools.txt used to provide.
-      - uv export --frozen --no-hashes --only-group doc -o doc-requirements.txt
+      # Export [project.dependencies] *and* the `doc` group together (--group, not
+      # --only-group -- the latter excludes [project.dependencies] entirely, which
+      # would leave Django/XBlock/etc. for `pip install -e .` below to resolve on
+      # its own, unconstrained by uv.lock's [tool.uv].constraint-dependencies, e.g.
+      # picking setuptools>=82 and breaking fs/pyfilesystem2's pkg_resources import)
+      # to a plain requirements.txt, installed into RTD's own managed virtualenv
+      # below rather than a separate uv-managed one -- this keeps RTD's normal
+      # sphinx auto-build detection intact.
+      - uv export --frozen --no-hashes --group doc --no-emit-project -o doc-requirements.txt
     post_install:
       - python -m pip install -r doc-requirements.txt
-      - python -m pip install -e .
+      # --no-deps: dependencies are already installed, pinned, from doc-requirements.txt
+      # above; this step only registers the local package itself for import.
+      - python -m pip install -e . --no-deps
 
 sphinx:
   configuration: docs/conf.py

Makefile

@@ -76,8 +76,8 @@ dev-requirements: ## install development environment requirements
 base-requirements: ## install only production/runtime dependencies
 	uv sync --no-default-groups --frozen
 
-test-requirements: ## install only testing dependencies (used by CI and tox)
-	uv sync --only-group testing --frozen
+test-requirements: ## install production dependencies plus the testing group (used by CI and tox)
+	uv sync --no-default-groups --group testing --frozen
 
 requirements: dev-requirements ## install development environment requirements
 

scripts/xsslint_config.py

@@ -21,6 +21,7 @@
 # Define the directories that should be ignored by the script.
 SKIP_DIRS = (
     '.git',
+    '.venv',
     '.pycharm_helpers',
     'common/static/xmodule/modules',
     'common/static/bundles',