diff --git a/eng/pack/templates/macos_64_env_gen.yml b/eng/pack/templates/macos_64_env_gen.yml index de3c65fa..c7c181e5 100644 --- a/eng/pack/templates/macos_64_env_gen.yml +++ b/eng/pack/templates/macos_64_env_gen.yml @@ -8,6 +8,7 @@ steps: displayName: 'Pip Authenticate' inputs: artifactFeeds: 'internal/PythonWorker_Internal_PublicPackages' + onlyAddExtraIndex: false - task: UsePythonVersion@0 inputs: versionSpec: ${{ parameters.pythonVersion }} @@ -69,12 +70,6 @@ steps: # args: '${{ parameters.pythonVersion }}' # displayName: 'Build dependencies from source' # condition: eq(variables['isRC'], 'true') -- bash: | - pip install pip-audit - cd workers - pip-audit -r requirements.txt - displayName: 'Run vulnerability scan' - continueOnError: true - task: CopyFiles@2 inputs: contents: '$(workerPath)' diff --git a/eng/pack/templates/nix_arm64_env_gen.yml b/eng/pack/templates/nix_arm64_env_gen.yml index ef68cae4..f850ed7d 100644 --- a/eng/pack/templates/nix_arm64_env_gen.yml +++ b/eng/pack/templates/nix_arm64_env_gen.yml @@ -8,6 +8,7 @@ steps: displayName: 'Pip Authenticate' inputs: artifactFeeds: 'internal/PythonWorker_Internal_PublicPackages' + onlyAddExtraIndex: false - task: UsePythonVersion@0 inputs: versionSpec: ${{ parameters.pythonVersion }} @@ -69,12 +70,6 @@ steps: args: '${{ parameters.pythonVersion }}' displayName: 'Build dependencies from scratch' condition: eq(variables['isRC'], 'true') -- bash: | - pip install pip-audit - cd workers - pip-audit -r requirements.txt - displayName: 'Run vulnerability scan' - continueOnError: true - task: CopyFiles@2 inputs: contents: '$(workerPath)' diff --git a/eng/pack/templates/nix_env_gen.yml b/eng/pack/templates/nix_env_gen.yml index 4f5278fb..7ca47dd9 100644 --- a/eng/pack/templates/nix_env_gen.yml +++ b/eng/pack/templates/nix_env_gen.yml @@ -8,6 +8,7 @@ steps: displayName: 'Pip Authenticate' inputs: artifactFeeds: 'internal/PythonWorker_Internal_PublicPackages' + onlyAddExtraIndex: false - task: UsePythonVersion@0 inputs: versionSpec: ${{ parameters.pythonVersion }} @@ -69,12 +70,6 @@ steps: # args: '${{ parameters.pythonVersion }}' # displayName: 'Build dependencies from source' # condition: eq(variables['isRC'], 'true') -- bash: | - pip install pip-audit - cd workers - pip-audit -r requirements.txt - displayName: 'Run vulnerability scan' - continueOnError: true - task: CopyFiles@2 inputs: contents: '$(workerPath)' diff --git a/eng/pack/templates/win_env_gen.yml b/eng/pack/templates/win_env_gen.yml index 1027cc85..d64b0537 100644 --- a/eng/pack/templates/win_env_gen.yml +++ b/eng/pack/templates/win_env_gen.yml @@ -8,6 +8,7 @@ steps: displayName: 'Pip Authenticate' inputs: artifactFeeds: 'internal/PythonWorker_Internal_PublicPackages' + onlyAddExtraIndex: false - task: UsePythonVersion@0 inputs: versionSpec: ${{ parameters.pythonVersion }} @@ -68,12 +69,6 @@ steps: # arguments: '${{ parameters.pythonVersion }}' # displayName: 'Build dependencies from source' # condition: eq(variables['isRC'], 'true') -- bash: | - pip install pip-audit - cd workers - pip-audit -r requirements.txt - displayName: 'Run vulnerability scan' - continueOnError: true - task: CopyFiles@2 inputs: contents: '$(workerPath)' diff --git a/eng/scripts/install-dependencies.sh b/eng/scripts/install-dependencies.sh index e7e0dd00..edf7bb3a 100644 --- a/eng/scripts/install-dependencies.sh +++ b/eng/scripts/install-dependencies.sh @@ -1,6 +1,11 @@ #!/bin/bash set -e +# Forward PipAuthenticate's index URL to uv, which does not read pip's config. +if [ -n "${PIP_INDEX_URL:-}" ] && [ -z "${UV_DEFAULT_INDEX:-}" ]; then + export UV_DEFAULT_INDEX="$PIP_INDEX_URL" +fi + # Install uv for faster dependency resolution / installation. python -m pip install --upgrade pip python -m pip install uv @@ -24,7 +29,7 @@ fi # Install everything else in a single uv invocation so the resolver runs once # and all wheels are downloaded in parallel. -$UV_PIP -U --prerelease=allow \ +$UV_PIP -U --prerelease=if-necessary-or-explicit \ azure-functions \ -e "$2/[dev]" \ -e "$2/[test-http-v2]" \ diff --git a/eng/scripts/test-extensions.sh b/eng/scripts/test-extensions.sh index 3bd5adea..1d2228cc 100644 --- a/eng/scripts/test-extensions.sh +++ b/eng/scripts/test-extensions.sh @@ -1,6 +1,10 @@ #!/bin/bash set -e +if [ -n "${PIP_INDEX_URL:-}" ] && [ -z "${UV_DEFAULT_INDEX:-}" ]; then + export UV_DEFAULT_INDEX="$PIP_INDEX_URL" +fi + python -m pip install --upgrade pip python -m pip install uv @@ -8,7 +12,7 @@ UV_PIP="python -m uv pip install --system" $UV_PIP "setuptools>=62,<82.0" $UV_PIP -e $1/PythonExtensionArtifact/$3 -$UV_PIP --prerelease=allow -e workers/[test-http-v2] -$UV_PIP -U --prerelease=allow -e workers/[test-deferred-bindings] +$UV_PIP --prerelease=if-necessary-or-explicit -e workers/[test-http-v2] +$UV_PIP -U --prerelease=if-necessary-or-explicit -e workers/[test-deferred-bindings] $UV_PIP -U -e workers/[dev] \ No newline at end of file diff --git a/eng/scripts/test-sdk.sh b/eng/scripts/test-sdk.sh index cf5caf1e..a342670e 100644 --- a/eng/scripts/test-sdk.sh +++ b/eng/scripts/test-sdk.sh @@ -1,6 +1,10 @@ #!/bin/bash set -e +if [ -n "${PIP_INDEX_URL:-}" ] && [ -z "${UV_DEFAULT_INDEX:-}" ]; then + export UV_DEFAULT_INDEX="$PIP_INDEX_URL" +fi + python -m pip install --upgrade pip python -m pip install uv @@ -10,5 +14,5 @@ $UV_PIP "setuptools>=62,<82.0" $UV_PIP -e $1/PythonSdkArtifact $UV_PIP -e workers/[dev] -$UV_PIP -U --prerelease=allow -e workers/[test-http-v2] -$UV_PIP -U --prerelease=allow -e workers/[test-deferred-bindings] \ No newline at end of file +$UV_PIP -U --prerelease=if-necessary-or-explicit -e workers/[test-http-v2] +$UV_PIP -U --prerelease=if-necessary-or-explicit -e workers/[test-deferred-bindings] \ No newline at end of file diff --git a/eng/templates/jobs/ci-dependency-check.yml b/eng/templates/jobs/ci-dependency-check.yml index a3bdaa54..d31d1dd9 100644 --- a/eng/templates/jobs/ci-dependency-check.yml +++ b/eng/templates/jobs/ci-dependency-check.yml @@ -29,6 +29,7 @@ jobs: displayName: 'Pip Authenticate' inputs: artifactFeeds: ${{ parameters.ArtifactFeed }} + onlyAddExtraIndex: false - task: UsePythonVersion@0 inputs: versionSpec: $(PYTHON_VERSION) @@ -54,6 +55,9 @@ jobs: displayName: 'Set necessary variables' - bash: | echo "Checking azure_functions_worker (Python < 3.13)..." + if [ -n "${PIP_INDEX_URL:-}" ] && [ -z "${UV_DEFAULT_INDEX:-}" ]; then + export UV_DEFAULT_INDEX="$PIP_INDEX_URL" + fi cd workers python -m pip install --upgrade pip python -m pip install uv @@ -67,6 +71,9 @@ jobs: condition: eq(variables['proxyWorker'], false) - bash: | echo "Checking proxy_worker (Python >= 3.13)..." + if [ -n "${PIP_INDEX_URL:-}" ] && [ -z "${UV_DEFAULT_INDEX:-}" ]; then + export UV_DEFAULT_INDEX="$PIP_INDEX_URL" + fi cd workers python -m pip install --upgrade pip python -m pip install uv @@ -79,6 +86,9 @@ jobs: condition: eq(variables['proxyWorker'], true) - bash: | echo "Checking V1 Library Worker (Python >= 3.13)..." + if [ -n "${PIP_INDEX_URL:-}" ] && [ -z "${UV_DEFAULT_INDEX:-}" ]; then + export UV_DEFAULT_INDEX="$PIP_INDEX_URL" + fi cd runtimes/v1 python -m pip install --upgrade pip python -m pip install uv @@ -88,6 +98,9 @@ jobs: condition: eq(variables['proxyWorker'], true) - bash: | echo "Checking V2 Library Worker (Python >= 3.13)..." + if [ -n "${PIP_INDEX_URL:-}" ] && [ -z "${UV_DEFAULT_INDEX:-}" ]; then + export UV_DEFAULT_INDEX="$PIP_INDEX_URL" + fi cd runtimes/v2 python -m pip install --upgrade pip python -m pip install uv diff --git a/eng/templates/jobs/ci-emulator-tests.yml b/eng/templates/jobs/ci-emulator-tests.yml index 10d563fa..1838a7d8 100644 --- a/eng/templates/jobs/ci-emulator-tests.yml +++ b/eng/templates/jobs/ci-emulator-tests.yml @@ -31,6 +31,7 @@ jobs: displayName: 'Pip Authenticate' inputs: artifactFeeds: ${{ parameters.ArtifactFeed }} + onlyAddExtraIndex: false - bash: | echo "Disk space before cleanup:" df -h diff --git a/eng/templates/jobs/ci-library-unit-tests.yml b/eng/templates/jobs/ci-library-unit-tests.yml index d7d0a1a6..26e7b515 100644 --- a/eng/templates/jobs/ci-library-unit-tests.yml +++ b/eng/templates/jobs/ci-library-unit-tests.yml @@ -23,6 +23,7 @@ jobs: displayName: 'Pip Authenticate' inputs: artifactFeeds: ${{ parameters.ArtifactFeed }} + onlyAddExtraIndex: false - task: UsePythonVersion@0 inputs: versionSpec: $(PYTHON_VERSION) @@ -38,7 +39,7 @@ jobs: # Remove internal feed for public builds sed -i '/_Internal_PublicPackages/d' nuget.config else - # Remove public feed for internal builds + # Remove public feed for internal builds sed -i '/PythonWorker_PublicPackages[^_]/d' nuget.config fi echo "Updated nuget.config:" diff --git a/eng/templates/jobs/ci-unit-tests.yml b/eng/templates/jobs/ci-unit-tests.yml index 6db16880..c115eade 100644 --- a/eng/templates/jobs/ci-unit-tests.yml +++ b/eng/templates/jobs/ci-unit-tests.yml @@ -31,6 +31,7 @@ jobs: displayName: 'Pip Authenticate' inputs: artifactFeeds: ${{ parameters.ArtifactFeed }} + onlyAddExtraIndex: false - bash: | echo "Disk space before cleanup:" df -h diff --git a/eng/templates/official/jobs/build-library.yml b/eng/templates/official/jobs/build-library.yml index 7d140083..22641250 100644 --- a/eng/templates/official/jobs/build-library.yml +++ b/eng/templates/official/jobs/build-library.yml @@ -24,6 +24,7 @@ jobs: displayName: 'Pip Authenticate' inputs: artifactFeeds: 'public/PythonWorker_PublicPackages' + onlyAddExtraIndex: false - task: UsePythonVersion@0 inputs: versionSpec: "3.13" @@ -35,10 +36,4 @@ jobs: python -m pip install build cd ${{ parameters.PROJECT_DIRECTORY }} python -m build - displayName: 'Build ${{ parameters.PROJECT_NAME }}' - - bash: | - pip install pip-audit - cd ${{ parameters.PROJECT_DIRECTORY }} - pip-audit . - displayName: 'Run vulnerability scan' - continueOnError: true \ No newline at end of file + displayName: 'Build ${{ parameters.PROJECT_NAME }}' \ No newline at end of file diff --git a/eng/templates/official/jobs/ci-core-tools-tests.yml b/eng/templates/official/jobs/ci-core-tools-tests.yml index 61a723aa..4d118297 100644 --- a/eng/templates/official/jobs/ci-core-tools-tests.yml +++ b/eng/templates/official/jobs/ci-core-tools-tests.yml @@ -12,6 +12,7 @@ jobs: displayName: 'Pip Authenticate' inputs: artifactFeeds: 'internal/PythonWorker_Internal_PublicPackages' + onlyAddExtraIndex: false - task: UsePythonVersion@0 displayName: 'Install Python' inputs: diff --git a/eng/templates/official/jobs/ci-custom-image-tests.yml b/eng/templates/official/jobs/ci-custom-image-tests.yml index 9592d9b1..2a0f0dfc 100644 --- a/eng/templates/official/jobs/ci-custom-image-tests.yml +++ b/eng/templates/official/jobs/ci-custom-image-tests.yml @@ -15,6 +15,7 @@ jobs: displayName: 'Pip Authenticate' inputs: artifactFeeds: 'internal/PythonWorker_Internal_PublicPackages' + onlyAddExtraIndex: false - task: UsePythonVersion@0 inputs: versionSpec: $(CUSTOM_PYTHON_VERSION) diff --git a/eng/templates/official/jobs/ci-docker-dedicated-tests.yml b/eng/templates/official/jobs/ci-docker-dedicated-tests.yml index 8e875ce4..d732e2f9 100644 --- a/eng/templates/official/jobs/ci-docker-dedicated-tests.yml +++ b/eng/templates/official/jobs/ci-docker-dedicated-tests.yml @@ -42,6 +42,7 @@ jobs: displayName: 'Pip Authenticate' inputs: artifactFeeds: 'internal/PythonWorker_Internal_PublicPackages' + onlyAddExtraIndex: false - task: UsePythonVersion@0 inputs: versionSpec: $(PYTHON_VERSION) diff --git a/eng/templates/official/jobs/ci-e2e-tests.yml b/eng/templates/official/jobs/ci-e2e-tests.yml index 0ab7381c..334f4379 100644 --- a/eng/templates/official/jobs/ci-e2e-tests.yml +++ b/eng/templates/official/jobs/ci-e2e-tests.yml @@ -54,6 +54,7 @@ jobs: displayName: 'Pip Authenticate' inputs: artifactFeeds: 'internal/PythonWorker_Internal_PublicPackages' + onlyAddExtraIndex: false - bash: | echo "Disk space before cleanup:" df -h diff --git a/eng/templates/official/jobs/ci-fc-tests.yml b/eng/templates/official/jobs/ci-fc-tests.yml index f85c389e..ce8461d3 100644 --- a/eng/templates/official/jobs/ci-fc-tests.yml +++ b/eng/templates/official/jobs/ci-fc-tests.yml @@ -27,6 +27,7 @@ jobs: displayName: 'Pip Authenticate' inputs: artifactFeeds: 'internal/PythonWorker_Internal_PublicPackages' + onlyAddExtraIndex: false - bash: | echo "Disk space before cleanup:" df -h @@ -65,6 +66,9 @@ jobs: condition: and(eq(variables.isSdkRelease, false), eq(variables.isExtensionsRelease, false), eq(variables['USETESTPYTHONSDK'], false), eq(variables['USETESTPYTHONEXTENSIONS'], false)) - bash: | + if [ -n "${PIP_INDEX_URL:-}" ] && [ -z "${UV_DEFAULT_INDEX:-}" ]; then + export UV_DEFAULT_INDEX="$PIP_INDEX_URL" + fi python -m pip install --upgrade pip python -m pip install uv UV_PIP="python -m uv pip install --system" diff --git a/eng/templates/official/release/build-artifacts.yml b/eng/templates/official/release/build-artifacts.yml index 647f74a9..94a67725 100644 --- a/eng/templates/official/release/build-artifacts.yml +++ b/eng/templates/official/release/build-artifacts.yml @@ -49,6 +49,7 @@ jobs: displayName: 'Pip Authenticate' inputs: artifactFeeds: 'internal/PythonWorker_Internal_PublicPackages' + onlyAddExtraIndex: false - ${{ if ne(parameters.libraryVersion, '') }}: - checkout: none - bash: | diff --git a/eng/templates/shared/build-steps.yml b/eng/templates/shared/build-steps.yml index 5fcb66b7..743e1098 100644 --- a/eng/templates/shared/build-steps.yml +++ b/eng/templates/shared/build-steps.yml @@ -9,6 +9,7 @@ steps: displayName: 'Pip Authenticate' inputs: artifactFeeds: ${{ parameters.ArtifactFeed }} + onlyAddExtraIndex: false - task: UsePythonVersion@0 inputs: versionSpec: ${{ parameters.PYTHON_VERSION }} @@ -20,9 +21,4 @@ steps: python -m pip install build cd ${{ parameters.PROJECT_DIRECTORY }} python -m build - displayName: 'Build Python ${{ parameters.PROJECT_NAME }}' - - bash: | - pip install pip-audit - cd ${{ parameters.PROJECT_DIRECTORY }} - pip-audit -r requirements.txt - displayName: 'Run vulnerability scan' \ No newline at end of file + displayName: 'Build Python ${{ parameters.PROJECT_NAME }}' \ No newline at end of file diff --git a/workers/tests/test_setup.py b/workers/tests/test_setup.py index 2f785dcb..837f8342 100644 --- a/workers/tests/test_setup.py +++ b/workers/tests/test_setup.py @@ -30,7 +30,7 @@ from invoke import task -from utils.constants import EXTENSIONS_CSPROJ_TEMPLATE, NUGET_CONFIG +from utils.constants import EXTENSIONS_CSPROJ_TEMPLATE ROOT_DIR = pathlib.Path(__file__).parent.parent BUILD_DIR = ROOT_DIR / 'build' @@ -290,7 +290,7 @@ def install_extensions(extensions_dir): f.write(EXTENSIONS_CSPROJ_TEMPLATE) with open(extensions_dir / "NuGet.config", "w") as f: - f.write(NUGET_CONFIG) + f.write(ROOT_DIR.parent.joinpath("nuget.config").read_text()) env = os.environ.copy() env["TERM"] = "xterm" # ncurses 6.1 workaround diff --git a/workers/tests/utils/constants.py b/workers/tests/utils/constants.py index f78f133d..8911e356 100644 --- a/workers/tests/utils/constants.py +++ b/workers/tests/utils/constants.py @@ -45,23 +45,6 @@ """ -NUGET_CONFIG = """\ - - - - - - - - - - -""" # PROJECT_ROOT refers to the path to azure-functions-python-worker # TODO: Find root folder without .parent