chore: migrate from PDM to uv for dependency management

[dphoria]

Migrates the project from PDM to uv for dependency management.

• Replace pdm.lock with uv.lock, update pyproject.toml (dependency-groups)
• Use uv in CI (setup-uv, uv sync, uv run) and Dockerfile
• Update .gitignore for uv (.uv/) and remove PDM entries
• Update README setup instructions

Made with Cursor

---

Note

Medium Risk
Build/CI and container dependency resolution is changing end-to-end; risk is mainly around lockfile parity and environment reproducibility across workflows and Docker images.

Overview
Migrates Python dependency management from PDM to uv across GitHub Actions and Docker builds, swapping pdm sync/run/install usage for uv sync/run and updating caching to key off uv.lock.

Replaces pdm.lock with a generated uv.lock, updates pyproject.toml to use dependency-groups (and drops PDM-specific config), refreshes .gitignore to ignore uv artifacts, and updates the README install instructions to use uv.

^{Written by Cursor Bugbot for commit bd58653. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

This is the final PR Bugbot will review for you during this billing cycle

Your free Bugbot reviews will reset on March 1

Details

You are on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle.

To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

[cursor]

Dockerfile missing --frozen flag for reproducible builds

Medium Severity

The uv sync command in the Dockerfile lacks a --frozen or --locked flag, replacing the safety check that PDM's --check flag provided. Without it, if uv.lock and pyproject.toml are out of sync, uv sync will silently re-resolve dependencies during the Docker build instead of failing, leading to non-reproducible production builds. The uv documentation recommends --frozen for Dockerfiles.

 

[cursor]

Unpinned uv image tag reduces Docker build reproducibility

Low Severity

Using ghcr.io/astral-sh/uv:latest copies an unpinned version of uv into the build. A new uv release could change dependency resolution behavior or introduce breaking changes, causing unexpected build failures or different dependency installations across builds. The uv Docker guide recommends pinning to a specific version tag.