Issue #3707

[pt-klein-bae]

Adds a new path in uvinstall that attempts to use uv sync if pyproject.toml is present but not uv.lock

Decided to add new path so it preserves the fallback uv pip install option.

Addresses #3707

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.00%. Comparing base (1b3f529) to head (da763a6).
⚠️ Report is 125 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3709      +/-   ##
==========================================
+ Coverage   79.31%   80.00%   +0.68%     
==========================================
  Files         885      885              
  Lines       65365    65382      +17     
  Branches     2543     2543              
==========================================
+ Hits        51846    52309     +463     
+ Misses      12847    12409     -438     
+ Partials      672      664       -8     

Flag	Coverage Δ
frontend	66.01% <ø> (+2.33%)	⬆️
python	81.86% <ø> (+0.33%)	⬆️
ruby-api	82.24% <ø> (ø)
ruby-backend	84.43% <ø> (+0.35%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[jmthomas]

@mcosgriff please review

[mcosgriff]

pyproject.toml with a uv.lock is the standard path we want to support so that will remain path 1 with path 2 being the fallback. This was intended as a path for plugins have not been updated yet with a uv.lock file. The indexes in the pyproject.toml were not being using because -r "${GEM_PATH}/pyproject.toml" was not being passed into teh elif [ -f "${GEM_PATH}/pyproject.toml" ]; then branch and -i <pypi_url> was being passed into that uv pip install command.

The fallback step can be rewritten like

if [ -f "${GEM_PATH}/requirements.txt" ]; then
    uv_offline_then_online pip install --python "${VENV_DIR}" ${UV_ARGS} -r "${GEM_PATH}/requirements.txt"
    RESULT=$?
elif [ -f "${GEM_PATH}/pyproject.toml" ]; then
    uv_offline_then_online pip install --python "${VENV_DIR}" ${UV_ARGS} -r "${GEM_PATH}/pyproject.toml"
    RESULT=$?
else
    echo "ERROR: No requirements.txt, pyproject.toml, or uv.lock found in ${GEM_PATH}"
    exit 1
fi

Also make sure the Pypi URL is set in Administrator Console > Setting, that is the value that gets passed into uvinstall

# Build the argv array for pypi index and trusted-host arguments.
def self.build_pypi_args(pypi_url)
  args = ["-i", pypi_url]
  args += ["--trusted-host", URI.parse(pypi_url).host] unless ENV['PIP_ENABLE_TRUSTED_HOST'].nil?
  args
end

[mcosgriff]

See comments

[pt-klein-bae]

Thanks Jason for improving the MR!

Quick response to Matthew's comments:

uv pip install by design does not respect [[tool.uv.index]] so sticking with pip won't solve the issue. Also, in my case, we need more than 1 'pypi_url'.. Most packages are installed from our pypi proxy, but we have a few custom ones we install from Gitlab, potentially from different project repositories, so there's at least 2 urls.

Understand that pyproject.toml and uv.lock are preferred, but the current behavior for just pyproject.toml is not as one would expect, after having used uv for some time now. It took me a few hours of troubleshooting to realize/understand why my custom [[tool.uv.index]] (that I use all the time elsewhere) were not being used. If path 1 is really where you're headed, it would be better to just have pyproject.toml without uv.lock throw an error.

[mcosgriff]

uv pip install by design does not respect [[tool.uv.index]]

uv pip install does respect [[tool.uv.index]]

[project]
name = "index-demo"
version = "0.0.0"
requires-python = ">=3.11"
dependencies = ["cowsay>=5", "boltons>=21"]

[tool.uv]
package = false

[[tool.uv.index]]
name = "repo-a"
url = "http://127.0.0.1:9101/simple"

[[tool.uv.index]]
name = "repo-b"
url = "http://127.0.0.1:9102/simple"

❯ uv pip install --python .venv  --default-index https://pypi.org/simple .           
⠸ index-demo==0.0.0                                                                                                                                                                                                                                                                                                                                                                                                              error: Request failed after 3 retries in 7.8s
  Caused by: Failed to fetch: `http://127.0.0.1:9101/simple/boltons/`
  Caused by: error sending request for url (http://127.0.0.1:9101/simple/boltons/)
  Caused by: client error (Connect)
  Caused by: tcp connect error
  Caused by: Connection refused (os error 61)

Where the indexes are not respected is when the command is run outside of the project directory

❯ uv pip install --python ./uv-test/.venv  --default-index https://pypi.org/simple ./uv-test
Using Python 3.13.15 environment at: uv-test/.venv
Resolved 3 packages in 142ms
      Built index-demo @ file:///Users/mcosgriff/Development/uv-test                                                                                                                                                                                                                                                                                                                                                             
Prepared 1 package in 372ms
Installed 3 packages in 3ms
 + boltons==26.1.0
 + cowsay==6.1
 + index-demo==0.0.0 (from file:///Users/mcosgriff/Development/uv-test)

Root cause is ours: passing a bare ${GEM_PATH} directory target with no project context, so uv never discovered the plugin's [tool.uv] table. --project "${GEM_PATH}" + -r "${GEM_PATH}/pyproject.toml" fixes it — and the -r half also drops the build, which deletes the recovery block at lines 158–186.

Path 2: Fallback becomes

if [ -f "${GEM_PATH}/requirements.txt" ]; then
    echo "Installing from requirements.txt via uv pip install"
    uv_offline_then_online pip install --python "${VENV_DIR}" ${UV_ARGS} -r "${GEM_PATH}/requirements.txt"
    RESULT=$?
elif [ -f "${GEM_PATH}/pyproject.toml" ]; then
    echo "Installing from pyproject.toml via uv pip install"
    uv_offline_then_online pip install --python "${VENV_DIR}" --project "${GEM_PATH}" ${UV_ARGS} -r "${GEM_PATH}/pyproject.toml"
    RESULT=$?
else
    echo "ERROR: No requirements.txt, pyproject.toml, or uv.lock found in ${GEM_PATH}"
    exit 1
fi

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[pt-klein-bae]

uv pip install by design does not respect [[tool.uv.index]]

uv pip install does respect [[tool.uv.index]]

Thanks for the easy-to-follow example, and good call. Indeed it does, I guess I skipped the part in the initial summary about "If one uses uv pip install . in the project directory containing the pyproject.toml file on Linux, the tool.uv.sources table is respected" and jumped straight to the next post.

Updated based on your recommendation