uv version 0.4.23+ [[tool.uv.index]] option currently not supported

[fdorssers]

Hi all, I'm using Renovate for a repo that uses uv with dependencies both from the normal pypi index, as well as a private artifactory index. At the moment Renovate does not recognize the index definition pyproject.toml.

In 0.4.23 (PR, docs) uv introduced the option to define your indices in pyproject.toml as follows:

[project]
name = "project-name"
...
dependencies = [
    "boto3==1.35.42",
    "my-private-package==1.2.3"
]

[[tool.uv.index]]
name = "<index_name>"
url = "<private_artifactory_url>"
explicit = true

[tool.uv.sources]
my-private-package= { index = "<index_name>" }

Where verification with the private source can be done with a username and password set as environment variables with the names:

UV_INDEX_<index_name>_USERNAME=...
UV_INDEX_<index_name>_PASSWORD=...

Currently, even when I provide these environment variables to renovate, it does not recognize the packages. Below some examples from the logs:

build	30-Oct-2024 13:34:35	DEBUG: GET https://pypi.org/pypi/my-private-package/json = (code=ERR_NON_2XX_3XX_RESPONSE, statusCode=404 retryCount=0, duration=151) (repository=...)

...

build	30-Oct-2024 13:34:36	DEBUG: GET https://pypi.org/pypi/my-private-package/ = (code=ERR_NON_2XX_3XX_RESPONSE, statusCode=404 retryCount=0, duration=369) (repository=...)
build	30-Oct-2024 13:34:36	DEBUG: Datasource 404 (repository=...)
build	30-Oct-2024 13:34:36	       "datasource": "pypi",
build	30-Oct-2024 13:34:36	       "packageName": "my-private-package",
build	30-Oct-2024 13:34:36	       "url": "https://pypi.org/project/my-private-package/"
build	30-Oct-2024 13:34:36	DEBUG: Failed to look up pypi package my-private-package (repository=..., packageFile=pyproject.toml, dependency=my-private-package)

...

ld	30-Oct-2024 13:34:41	               {
build	30-Oct-2024 13:34:41	                 "packageName": "my-private-package",
build	30-Oct-2024 13:34:41	                 "depName": "my-private-package",
build	30-Oct-2024 13:34:41	                 "datasource": "pypi",
build	30-Oct-2024 13:34:41	                 "depType": "project.dependencies",
build	30-Oct-2024 13:34:41	                 "currentValue": "==0.0.1",
build	30-Oct-2024 13:34:41	                 "currentVersion": "0.0.1",
build	30-Oct-2024 13:34:41	                 "lockedVersion": "0.0.1",
build	30-Oct-2024 13:34:41	                 "updates": [],
build	30-Oct-2024 13:34:41	                 "versioning": "pep440",
build	30-Oct-2024 13:34:41	                 "warnings": [
build	30-Oct-2024 13:34:41	                   {
build	30-Oct-2024 13:34:41	                     "topic": "my-private-package",
build	30-Oct-2024 13:34:41	                     "message": "Failed to look up pypi package my-private-package"
build	30-Oct-2024 13:34:41	                   }
build	30-Oct-2024 13:34:41	                 ]
build	30-Oct-2024 13:34:41	               },

This currently prevents Renovate from:

1. Detecting updates for packages from the private index
2. Creating the lockfile for the dependencies

A minimal reproduction repository showcasing index url extraction is available here.

[rarkins]

At which point are things incorrect? I assume it is in the "extract" phase where registryUrls can be detected. If so, a reproduction is entirely possible because the problem is visible before the lookup happens.

[fdorssers]

At which point are things incorrect? I assume it is in the "extract" phase where registryUrls can be detected. If so, a reproduction is entirely possible because the problem is visible before the lookup happens.

Oh that's a good point. Hadn't thought of it like that. So I can make a reproducible example that's related to extracting the index url. That at least covers the first part. Actually verifying with an existing private index however will be a bit more tricky.

I'll make an example for that first part 👍 .

[fdorssers]

A minimal reproduction repository is now available here.

This covers:

• Index extraction from pyproject.toml
• Matching named indices against packages
• Using explicit=true situation

What the sample doesn't cover at the moment without an actual private index:

• Creating/updating lockfile.
• Verification using environment variables.

I'll see if I can find an easy place to host something privately, or if you have any suggestions for a location I'd be happy to hear that.

[fdorssers]

I have updated the example and it now points to an actual working alternative package index. This one however is currently still public.

Looks like on Cloudsmith I can also make a private one to test the environment variables. However from what I can see I can't set environment variables in the Renovate Github app and I don't want to just toss the secrets in the repo itself. Any suggestions? I'm happy to share them with anyone working on this.

[github-actions[bot]]

Hi there,

Get your discussion fixed faster by creating a minimal reproduction. This means a repository dedicated to reproducing this issue with the minimal dependencies and config possible.

Before we start working on your issue we need to know exactly what's causing the current behavior. A minimal reproduction helps us with this. Discussions without reproductions are less likely to be converted to Issues.

Please follow these steps:

1. Read our guide on creating a minimal reproduction.
2. Go to our minimal reproduction template repository.
3. Select the Use this template button to create a new repository based on the template.
4. Work on the minimal reproduction in your own repository.
5. Fill out the information in your repository's README.md.
6. Add the link to your reproduction to the first post of your Discussion. If you are not the original author, you can post a new comment with the link.

If you need help with running renovate on your minimal reproduction repository, please refer to our Running Renovate guide.
Good luck,

The Renovate team

[fdorssers]

Looks like it's partially related to discussion #31841 . Primary difference where parameters come from, how they're used (setting username and pass as environment variables), and what packages are checked against what index (explicit=True).

[rarkins]

Converted to issue: #32265