Skip to content

TEST - fix uv/repox 401 in serializer-runner (do not merge, port to sonar-python-enterprise) #2301

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
mary-georgiou wants to merge 1 commit into
base: master
Choose a base branch
from
Draft

TEST - fix uv/repox 401 in serializer-runner (do not merge, port to sonar-python-enterprise) #2301

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions python-frontend/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -190,6 +190,16 @@
<argument>--fail_fast</argument>
<argument>${failStubGenerationFast}</argument>
</arguments>
<!--
uv authenticates the "repox" index declared in typeshed_serializer/pyproject.toml via
UV_INDEX_REPOX_USERNAME/PASSWORD. It does not read pip.conf, so the Artifactory reader
credentials that config-maven already exports for the job must be re-exposed under the
names uv expects, or every cache-cold package install 401s against sonarsource-pypi.
-->
<environmentVariables>
<UV_INDEX_REPOX_USERNAME>${env.ARTIFACTORY_USERNAME}</UV_INDEX_REPOX_USERNAME>
<UV_INDEX_REPOX_PASSWORD>${env.ARTIFACTORY_ACCESS_TOKEN}</UV_INDEX_REPOX_PASSWORD>
</environmentVariables>
Comment on lines +193 to +202

@gitar-bot gitar-bot Bot Sep 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Bug: Unset ARTIFACTORY_* env vars clobber local uv credentials

${env.ARTIFACTORY_USERNAME} / ${env.ARTIFACTORY_ACCESS_TOKEN} only resolve inside the CI job. On a developer machine (or any run outside build-maven), those env vars are absent, so Maven passes the parameter through unresolved — the child process gets UV_INDEX_REPOX_USERNAME=${env.ARTIFACTORY_USERNAME} (literal) or an empty value. Because the vars are now always present in the environment of the uv run children spawned by runners/serializer_runner.py, uv treats them as explicit credentials for the default repox index and sends them as Basic auth, so it no longer falls back to .netrc/keyring, and it also overrides any real UV_INDEX_REPOX_USERNAME/_PASSWORD the developer exported in their shell (exec-maven-plugin's <environmentVariables> are merged on top of the inherited environment). Result: mvn -DgenerateTypeshedStubs ... starts 401'ing locally for exactly the developers who previously had working repox auth. Gate the env vars so they are only set when the credentials actually exist.

Fix 1: Only inject the uv index credentials when ARTIFACTORY_ACCESS_TOKEN is present in the environment (CI), leaving local runs untouched. 
<!-- python-frontend/pom.xml: drop <environmentVariables> from the execution and
     add a second profile that only contributes them when the CI credentials exist.
     Maven merges executions with the same id across active profiles. -->
<profile>
  <id>uv-repox-credentials</id>
  <activation>
    <property><name>env.ARTIFACTORY_ACCESS_TOKEN</name></property>
  </activation>
  <properties>
    <uv.index.repox.username>${env.ARTIFACTORY_USERNAME}</uv.index.repox.username>
    <uv.index.repox.password>${env.ARTIFACTORY_ACCESS_TOKEN}</uv.index.repox.password>
  </properties>
  <!-- ... exec-maven-plugin/serializer-runner execution carrying only
       <environmentVariables> that reference the two properties above ... -->
</profile>
  • Apply fix
Fix 2: Map the Artifactory credentials to uv's index env vars in the runner itself, only when both are set, so local runs keep their own auth. 
# python-frontend/typeshed_serializer/runners/serializer_runner.py
def _uv_env() -> dict:
    env = os.environ.copy()
    user, token = env.get('ARTIFACTORY_USERNAME'), env.get('ARTIFACTORY_ACCESS_TOKEN')
    if user and token:
        env.setdefault('UV_INDEX_REPOX_USERNAME', user)
        env.setdefault('UV_INDEX_REPOX_PASSWORD', token)
    return env

# then pass env=_uv_env() to every subprocess.run([...'uv'...]) call
# (in _run_serialize and _run_tests) and revert the pom.xml change.
  • Apply fix

Check a box to apply a fix or reply for a change | Was this helpful? React with 👍 / 👎

Comment on lines +199 to +202

@gitar-bot gitar-bot Bot Sep 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Quality: uv repox auth wired only at the Maven exec call site

The credentials are injected solely into the serializer-runner exec goal, but the same repox default index is also consumed by docker/cmd.sh (uv sync + uv run ..., launched via docker/docker-compose.yml, which forwards only USER_ID/GROUP_ID) and by the repo-root pyproject.toml, which declares the identical [[tool.uv.index]] block. Anyone regenerating stubs through the documented container path still gets the 401 this PR fixes for the Maven path. Wiring the mapping where uv is invoked (see the runner-side fix above) plus passing ARTIFACTORY_USERNAME/ARTIFACTORY_ACCESS_TOKEN through docker-compose's environment: would cover all call sites.

Forward the repox credentials to the container so uv sync in cmd.sh authenticates too (compose's :- default keeps them empty/unset when absent).:

# python-frontend/typeshed_serializer/docker/docker-compose.yml
services:
  typeshed-serializer:
    # ...
    environment:
      UV_INDEX_REPOX_USERNAME: ${ARTIFACTORY_USERNAME:-}
      UV_INDEX_REPOX_PASSWORD: ${ARTIFACTORY_ACCESS_TOKEN:-}
  • Apply fix

Check the box to apply the fix or reply for a change | Was this helpful? React with 👍 / 👎

<useMavenLogger>true</useMavenLogger>
</configuration>
<goals>
Expand Down
Loading