Consider substitute pip with uv

[mlodic]

see Greedybear change: GreedyBear-Project/GreedyBear#1027 (comment)

We need to evaluate if it is worth it and if we don't lose any feature

[ayushgupta704]

Hey @mlodic,
Looked into the uv migration ( GreedyBear Pr 1027). Here’s the what it would mean for our project IntelOwl

• Modularity (No feature loss): We swap the multiple requirements/*.txt files for dependency groups in a single pyproject.toml. Same flexibility, plus a secure uv.lock file.

• Docker & System Libs: No issues with django-auth-ldap. We just keep libldap2-dev in the apt install step, and uv compiles the C extensions perfectly (while speeding up the build).

• CI/CD : The shared Certego .github workflows expect pip. To use uv, we either have to diverge and maintain our own Actions, or write a wrapper to intercept the upstream pip commands.

Do you think the speed and security improvements are worth the extra CI maintenance?I know GreedyBear already made the switch, but IntelOwl is a much heavier. GreedyBear is relatively lightweight, so stepping away from the shared Certego .github workflows wasn't a massive maintenance penalty for them.
For us, it's different. Diverging from pip means taking on significantly more manual upkeep, especially since we have a heavier codebase and complex dependencies (like django-auth-ldap requiring system-level C-libraries) that are tightly coupled to that standard infrastructure.
if we diverge to uv, we stop inheriting those upstream CI/CD updates. We’d have to manually update and fix our own GitHub Actions every single time the Certego org changes its testing, linting, or security standards.

If you're open to it, I can spin up a quick PoC (pyproject.toml + Dockerfile) so we can benchmark the actual build times.
Thanks

[mlodic]

Intelowl doesnt use the .github from Certego

[ayushgupta704]

Thanks for clarifying! Since we don’t rely on the Certego .github workflows, the extra CI maintenance isn’t a concern anymore. I can start a PR.if this approach aligns with your expectations.

[mlodic]

you can start experimenting

[Abhishek9639]

Greetings @mlodic,
I’d like to work on this issue. I can start by evaluating the feasibility of replacing pip with uv and ensure no features are lost.
I noticed this was assigned to @ayushgupta704 around 2 weeks ago, but there haven’t been any recent updates, so I’d be happy to take this forward. Please assign this to me if that works.
Thanks

[ayushgupta704]

Hi @Abhishek9639,
Thanks for your interest! I’ve already completed the work for this issue (PR #3615 ). As mentioned by mlodic, it will be considered after the current release.

[Abhishek9639]

Thanks for the update
Appreciate the work on this. I’ll wait for the release and would be happy to help with testing or any follow-ups if needed.

[github-actions]

This issue has been marked as stale because it has had no activity for 30 days. If you are still working on this, please provide some updates.