chore: add uv skeleton plugin

[thomasschafer]

Pull Request Submission Checklist

• Follows CONTRIBUTING guidelines
• Commit messages
  are release-note ready, emphasizing
  what was changed, not how.
• Includes detailed description of changes
• Contains risk assessment (Low | Medium | High) - n/a
• Highlights breaking API changes (if applicable) - n/a
• Links to automated tests covering new functionality
• Includes manual testing instructions (if necessary)
• Updates relevant GitBook documentation (PR link: ___) - n/a
• Includes product update to be announced in the next stable release notes - n/a

What does this PR do?

This PR adds a minimal uv plugin, which just returns a fixed dep-graph. For now it is not wired up to anything so there will be no functional changes from this PR.

How should this be manually tested?

For now it cannot be tested end-to-end, as there is still work to do to hook everything up, but you can review the unit tests.

What's the product update that needs to be communicated to CLI users?

None

[snyk-tim]

Can we double check whether the target file for uv should be pyproject.toml or uv.lock

[thomasschafer]

Just checked and using Poetry we see pyproject.toml in the UI - will make a ticket to address

[snyk-tim]

I think this is where some of the complexity occurs, where pyproject.toml is package manager agnostic and requires the companion poetry.local and uv.lock to differentiate.

[thomasschafer]

Yeah it will need some investigation - it looks like detection is purely based on lockfile here, then the CLI calls the Python plugin with poetry.lock, and then the Python plugin maps from lockfile to manifest here which is why we see pyproject.toml in the UI