feat: Add UV package manager support for Python projects

Add support for parsing Python projects managed with the UV package
manager (https://docs.astral.sh/uv/). Two new package data handlers are
added in packagedcode.pypi:

- UvPyprojectTomlHandler parses pyproject.toml files containing a
  [tool.uv] table. It collects the standard PEP 621 [project] metadata,
  optional-dependencies, and PEP 735 [dependency-groups] (with
  include-group references skipped as forward references).
- UvLockHandler parses uv.lock files. Each [[package]] entry becomes a
  pinned, virtual resolved package; the editable root project entry is
  skipped since it is parsed independently from pyproject.toml. SHA-256
  hashes and the exact sdist URL recorded in the lock file are
  preserved, and PyPI URLs are populated via get_pypi_urls.

A shared BaseUvPythonLayout assembles the package by walking from
either pyproject.toml or uv.lock to its sibling, mirroring the existing
Poetry layout. PyprojectTomlHandler is updated to skip pyproject.toml
files that belong to a UV project so that the dedicated handler runs.

Test fixtures are derived from python-attrs/attrs 26.1.0
(https://github.com/python-attrs/attrs, MIT-licensed) and trimmed to
the relevant parts for parser and end-to-end package-assembly coverage.

Refs: #4501
Signed-off-by: Guillem Serra Cazorla <gserracazorla@gmail.com>
Signed-off-by: Guillem Serra Cazorla <guillem@meta.com>

Author: GuillemSeCa

CHANGELOG.rst

@@ -4,6 +4,14 @@ Changelog
 Next release
 --------------
 
+- Add support for the Python UV package manager. Two new package data
+  handlers parse ``pyproject.toml`` files containing a ``[tool.uv]`` table
+  and ``uv.lock`` lockfiles, including PEP 735 ``[dependency-groups]``,
+  and the package assembly walks both files together so that the project
+  metadata and the resolved transitive dependencies are reported as a
+  single Python package.
+  https://github.com/aboutcode-org/scancode-toolkit/issues/4501
+
 v3.5.0 - 2026-01-15
 -------------------
 

src/packagedcode/__init__.py

@@ -174,6 +174,8 @@
     pypi.PyprojectTomlHandler,
     pypi.PoetryPyprojectTomlHandler,
     pypi.PoetryLockHandler,
+    pypi.UvPyprojectTomlHandler,
+    pypi.UvLockHandler,
     pypi.PythonEditableInstallationPkgInfoFile,
     pypi.PythonEggPkgInfoFile,
     pypi.PythonInstalledWheelMetadataFile,

src/packagedcode/pypi.py

@@ -790,6 +790,20 @@ Package type:  pypi
   description:       Python setup.py
   path_patterns:    '*setup.py'
 --------------------------------------------
+Package type:  pypi
+  datasource_id:     pypi_uv_lock
+  documentation URL: https://docs.astral.sh/uv/concepts/projects/sync/#the-uvlock-file
+  primary language:  Python
+  description:       Python UV lockfile
+  path_patterns:    '*uv.lock'
+--------------------------------------------
+Package type:  pypi
+  datasource_id:     pypi_uv_pyproject_toml
+  documentation URL: https://docs.astral.sh/uv/concepts/projects/
+  primary language:  Python
+  description:       Python UV pyproject.toml
+  path_patterns:    '*pyproject.toml'
+--------------------------------------------
 Package type:  pypi
   datasource_id:     pypi_wheel
   documentation URL: https://peps.python.org/pep-0427/