feat: uv rollout part 1

[joshuarli]

this is part 1 of a 3-stage rollout

stage 1 (install uv):

• (sentry) install uv (via devenv), add uv.lock, use uv in dev + ci
• (getsentry) same thing except production build remains unchanged (it'll use the old requirements files)

stage 2 (switch to uv for prod):

• (getsentry) bin/bump_sentry.py and image build changes to use uv+uv.lock

stage 3 (cleanup):

• (sentry) delete requirement.txts (and anything else related to them), and self-hosted build changes to use uv
• (getsentry) same as sentry

---

note: dev requirements were added via this, then i manually pinned all other transitive dependencies by diffing frozen states

import re
import subprocess

frozen = {}

with open("requirements-dev-frozen.txt", "r") as f:
    for spec in f.readlines():
        spec = spec.strip()
        if not spec or spec[0] in '-#':
            continue
        name, version = spec.split("==")
        frozen[name] = version

PACKAGE_NAME = re.compile(r"(=|>|<)")

with open("requirements-dev.txt", "r") as f:
    for spec in f.readlines():
        spec = spec.strip()
        if not spec or spec[0] in '-#':
            continue
        name = PACKAGE_NAME.split(spec, maxsplit=1)[0]
        subprocess.call(("uv", "add", "--dev", f"{name}=={frozen[name]}"))

[joshuarli]

instead of forcing everyone to global devenv 1.22.0 (which adds uv) i could also import guard this so the 1st sync updates local devenv to 1.22.0 then if uv is available, it can branch to calling uv sync

but by the time i remove requirements.txts (part 3) that compatibility will be for nothing, and there will be plenty of people who haven't done the first sync to update local devenv

so i'm thinking let's just keep it simple and require devenv update

[asottile-sentry]

[cursor]

Bug: Script Fails Handling Package Extras

The bump_version script fails to handle dependencies declared with extras (e.g., sentry-sdk[http2]>=...) in pyproject.toml. extract_packages incorrectly includes these extras in the extracted package names, leading to a mismatch when compared against the args.package (CLI input), which typically lacks extras. This causes the script to incorrectly report the package as missing and exit. Additionally, the uv add command constructed by the script drops any extras, risking their removal or incorrect updates in pyproject.toml.