build: update uv package index

eng/pack/templates/macos_64_env_gen.yml

@@ -8,6 +8,7 @@ steps:
   displayName: 'Pip Authenticate'
   inputs:
     artifactFeeds: 'internal/PythonWorker_Internal_PublicPackages'
+    onlyAddExtraIndex: false
 - task: UsePythonVersion@0
   inputs:
     versionSpec: ${{ parameters.pythonVersion }}
@@ -69,12 +70,6 @@ steps:
 #     args: '${{ parameters.pythonVersion }}'
 #   displayName: 'Build dependencies from source'
 #   condition: eq(variables['isRC'], 'true')
-- bash: |
-    pip install pip-audit
-    cd workers
-    pip-audit -r requirements.txt
-  displayName: 'Run vulnerability scan'
-  continueOnError: true
 - task: CopyFiles@2
   inputs:
     contents: '$(workerPath)'

eng/pack/templates/nix_arm64_env_gen.yml

@@ -8,6 +8,7 @@ steps:
   displayName: 'Pip Authenticate'
   inputs:
     artifactFeeds: 'internal/PythonWorker_Internal_PublicPackages'
+    onlyAddExtraIndex: false
 - task: UsePythonVersion@0
   inputs:
     versionSpec: ${{ parameters.pythonVersion }}
@@ -69,12 +70,6 @@ steps:
     args: '${{ parameters.pythonVersion }}'
   displayName: 'Build dependencies from scratch'
   condition: eq(variables['isRC'], 'true')
-- bash: |
-    pip install pip-audit
-    cd workers
-    pip-audit -r requirements.txt
-  displayName: 'Run vulnerability scan'
-  continueOnError: true
 - task: CopyFiles@2
   inputs:
     contents: '$(workerPath)'

eng/pack/templates/nix_env_gen.yml

@@ -8,6 +8,7 @@ steps:
   displayName: 'Pip Authenticate'
   inputs:
     artifactFeeds: 'internal/PythonWorker_Internal_PublicPackages'
+    onlyAddExtraIndex: false
 - task: UsePythonVersion@0
   inputs:
     versionSpec: ${{ parameters.pythonVersion }}
@@ -69,12 +70,6 @@ steps:
 #     args: '${{ parameters.pythonVersion }}'
 #   displayName: 'Build dependencies from source'
 #   condition: eq(variables['isRC'], 'true')
-- bash: |
-    pip install pip-audit
-    cd workers
-    pip-audit -r requirements.txt
-  displayName: 'Run vulnerability scan'
-  continueOnError: true
 - task: CopyFiles@2
   inputs:
     contents: '$(workerPath)'

eng/pack/templates/win_env_gen.yml

@@ -8,6 +8,7 @@ steps:
   displayName: 'Pip Authenticate'
   inputs:
     artifactFeeds: 'internal/PythonWorker_Internal_PublicPackages'
+    onlyAddExtraIndex: false
 - task: UsePythonVersion@0
   inputs:
     versionSpec: ${{ parameters.pythonVersion }}
@@ -68,12 +69,6 @@ steps:
 #     arguments: '${{ parameters.pythonVersion }}'
 #   displayName: 'Build dependencies from source'
 #   condition: eq(variables['isRC'], 'true')
-- bash: |
-    pip install pip-audit
-    cd workers
-    pip-audit -r requirements.txt
-  displayName: 'Run vulnerability scan'
-  continueOnError: true
 - task: CopyFiles@2
   inputs:
     contents: '$(workerPath)'

eng/scripts/install-dependencies.sh

@@ -1,6 +1,11 @@
 #!/bin/bash
 set -e
 
+# Forward PipAuthenticate's index URL to uv, which does not read pip's config.
+if [ -n "${PIP_INDEX_URL:-}" ] && [ -z "${UV_DEFAULT_INDEX:-}" ]; then
+  export UV_DEFAULT_INDEX="$PIP_INDEX_URL"
+fi
+
 # Install uv for faster dependency resolution / installation.
 python -m pip install --upgrade pip
 python -m pip install uv
@@ -24,7 +29,7 @@ fi
 
 # Install everything else in a single uv invocation so the resolver runs once
 # and all wheels are downloaded in parallel.
-$UV_PIP -U --prerelease=allow \
+$UV_PIP -U --prerelease=if-necessary-or-explicit \
     azure-functions \
     -e "$2/[dev]" \
     -e "$2/[test-http-v2]" \

eng/scripts/test-extensions.sh

@@ -1,14 +1,18 @@
 #!/bin/bash
 set -e
 
+if [ -n "${PIP_INDEX_URL:-}" ] && [ -z "${UV_DEFAULT_INDEX:-}" ]; then
+  export UV_DEFAULT_INDEX="$PIP_INDEX_URL"
+fi
+
 python -m pip install --upgrade pip
 python -m pip install uv
 
 UV_PIP="python -m uv pip install --system"
 
 $UV_PIP "setuptools>=62,<82.0"
 $UV_PIP -e $1/PythonExtensionArtifact/$3
-$UV_PIP --prerelease=allow -e workers/[test-http-v2]
-$UV_PIP -U --prerelease=allow -e workers/[test-deferred-bindings]
+$UV_PIP --prerelease=if-necessary-or-explicit -e workers/[test-http-v2]
+$UV_PIP -U --prerelease=if-necessary-or-explicit -e workers/[test-deferred-bindings]
 
 $UV_PIP -U -e workers/[dev]

eng/scripts/test-sdk.sh

@@ -1,6 +1,10 @@
 #!/bin/bash
 set -e
 
+if [ -n "${PIP_INDEX_URL:-}" ] && [ -z "${UV_DEFAULT_INDEX:-}" ]; then
+  export UV_DEFAULT_INDEX="$PIP_INDEX_URL"
+fi
+
 python -m pip install --upgrade pip
 python -m pip install uv
 
@@ -10,5 +14,5 @@ $UV_PIP "setuptools>=62,<82.0"
 $UV_PIP -e $1/PythonSdkArtifact
 $UV_PIP -e workers/[dev]
 
-$UV_PIP -U --prerelease=allow -e workers/[test-http-v2]
-$UV_PIP -U --prerelease=allow -e workers/[test-deferred-bindings]
+$UV_PIP -U --prerelease=if-necessary-or-explicit -e workers/[test-http-v2]
+$UV_PIP -U --prerelease=if-necessary-or-explicit -e workers/[test-deferred-bindings]

eng/templates/jobs/ci-dependency-check.yml

@@ -29,6 +29,7 @@ jobs:
         displayName: 'Pip Authenticate'
         inputs:
           artifactFeeds: ${{ parameters.ArtifactFeed }}
+          onlyAddExtraIndex: false
       - task: UsePythonVersion@0
         inputs:
           versionSpec: $(PYTHON_VERSION)
@@ -54,6 +55,9 @@ jobs:
         displayName: 'Set necessary variables'
       - bash: |
             echo "Checking azure_functions_worker (Python < 3.13)..."
+            if [ -n "${PIP_INDEX_URL:-}" ] && [ -z "${UV_DEFAULT_INDEX:-}" ]; then
+              export UV_DEFAULT_INDEX="$PIP_INDEX_URL"
+            fi
             cd workers
             python -m pip install --upgrade pip
             python -m pip install uv
@@ -67,6 +71,9 @@ jobs:
         condition: eq(variables['proxyWorker'], false)
       - bash: |
             echo "Checking proxy_worker (Python >= 3.13)..."
+            if [ -n "${PIP_INDEX_URL:-}" ] && [ -z "${UV_DEFAULT_INDEX:-}" ]; then
+              export UV_DEFAULT_INDEX="$PIP_INDEX_URL"
+            fi
             cd workers
             python -m pip install --upgrade pip
             python -m pip install uv
@@ -79,6 +86,9 @@ jobs:
         condition: eq(variables['proxyWorker'], true)
       - bash: |
             echo "Checking V1 Library Worker (Python >= 3.13)..."
+            if [ -n "${PIP_INDEX_URL:-}" ] && [ -z "${UV_DEFAULT_INDEX:-}" ]; then
+              export UV_DEFAULT_INDEX="$PIP_INDEX_URL"
+            fi
             cd runtimes/v1
             python -m pip install --upgrade pip
             python -m pip install uv
@@ -88,6 +98,9 @@ jobs:
         condition: eq(variables['proxyWorker'], true)
       - bash: |
             echo "Checking V2 Library Worker (Python >= 3.13)..."
+            if [ -n "${PIP_INDEX_URL:-}" ] && [ -z "${UV_DEFAULT_INDEX:-}" ]; then
+              export UV_DEFAULT_INDEX="$PIP_INDEX_URL"
+            fi
             cd runtimes/v2
             python -m pip install --upgrade pip
             python -m pip install uv

eng/templates/jobs/ci-emulator-tests.yml

@@ -31,6 +31,7 @@ jobs:
         displayName: 'Pip Authenticate'
         inputs:
           artifactFeeds: ${{ parameters.ArtifactFeed }}
+          onlyAddExtraIndex: false
       - bash: |
           echo "Disk space before cleanup:"
           df -h

eng/templates/jobs/ci-library-unit-tests.yml

@@ -23,6 +23,7 @@ jobs:
         displayName: 'Pip Authenticate'
         inputs:
           artifactFeeds: ${{ parameters.ArtifactFeed }}
+          onlyAddExtraIndex: false
       - task: UsePythonVersion@0
         inputs:
           versionSpec: $(PYTHON_VERSION)
@@ -38,7 +39,7 @@ jobs:
             # Remove internal feed for public builds
             sed -i '/_Internal_PublicPackages/d' nuget.config
           else
-            # Remove public feed for internal builds  
+            # Remove public feed for internal builds
             sed -i '/PythonWorker_PublicPackages[^_]/d' nuget.config
           fi
           echo "Updated nuget.config:"

eng/templates/jobs/ci-unit-tests.yml

@@ -31,6 +31,7 @@ jobs:
         displayName: 'Pip Authenticate'
         inputs:
           artifactFeeds: ${{ parameters.ArtifactFeed }}
+          onlyAddExtraIndex: false
       - bash: |
           echo "Disk space before cleanup:"
           df -h

eng/templates/official/jobs/build-library.yml

@@ -24,6 +24,7 @@ jobs:
         displayName: 'Pip Authenticate'
         inputs:
           artifactFeeds: 'public/PythonWorker_PublicPackages'
+          onlyAddExtraIndex: false
       - task: UsePythonVersion@0
         inputs:
           versionSpec: "3.13"
@@ -35,10 +36,4 @@ jobs:
           python -m pip install build
           cd ${{ parameters.PROJECT_DIRECTORY }}
           python -m build
-        displayName: 'Build ${{ parameters.PROJECT_NAME }}'
-      - bash: |
-          pip install pip-audit
-          cd ${{ parameters.PROJECT_DIRECTORY }}
-          pip-audit .
-        displayName: 'Run vulnerability scan'
-        continueOnError: true
+        displayName: 'Build ${{ parameters.PROJECT_NAME }}'

eng/templates/official/jobs/ci-core-tools-tests.yml

@@ -12,6 +12,7 @@ jobs:
       displayName: 'Pip Authenticate'
       inputs:
         artifactFeeds: 'internal/PythonWorker_Internal_PublicPackages'
+        onlyAddExtraIndex: false
     - task: UsePythonVersion@0
       displayName: 'Install Python'
       inputs:

eng/templates/official/jobs/ci-custom-image-tests.yml

@@ -15,6 +15,7 @@ jobs:
         displayName: 'Pip Authenticate'
         inputs:
           artifactFeeds: 'internal/PythonWorker_Internal_PublicPackages'
+          onlyAddExtraIndex: false
       - task: UsePythonVersion@0
         inputs:
           versionSpec: $(CUSTOM_PYTHON_VERSION)

eng/templates/official/jobs/ci-docker-dedicated-tests.yml

@@ -42,6 +42,7 @@ jobs:
         displayName: 'Pip Authenticate'
         inputs:
           artifactFeeds: 'internal/PythonWorker_Internal_PublicPackages'
+          onlyAddExtraIndex: false
       - task: UsePythonVersion@0
         inputs:
           versionSpec: $(PYTHON_VERSION)

eng/templates/official/jobs/ci-e2e-tests.yml

@@ -54,6 +54,7 @@ jobs:
         displayName: 'Pip Authenticate'
         inputs:
           artifactFeeds: 'internal/PythonWorker_Internal_PublicPackages'
+          onlyAddExtraIndex: false
       - bash: |
           echo "Disk space before cleanup:"
           df -h

eng/templates/official/jobs/ci-fc-tests.yml

@@ -27,6 +27,7 @@ jobs:
         displayName: 'Pip Authenticate'
         inputs:
           artifactFeeds: 'internal/PythonWorker_Internal_PublicPackages'
+          onlyAddExtraIndex: false
       - bash: |
           echo "Disk space before cleanup:"
           df -h
@@ -65,6 +66,9 @@ jobs:
         condition: and(eq(variables.isSdkRelease, false), eq(variables.isExtensionsRelease, false), eq(variables['USETESTPYTHONSDK'], false), eq(variables['USETESTPYTHONEXTENSIONS'], false))
 
       - bash: |
+          if [ -n "${PIP_INDEX_URL:-}" ] && [ -z "${UV_DEFAULT_INDEX:-}" ]; then
+            export UV_DEFAULT_INDEX="$PIP_INDEX_URL"
+          fi
           python -m pip install --upgrade pip
           python -m pip install uv
           UV_PIP="python -m uv pip install --system"

eng/templates/official/release/build-artifacts.yml

@@ -49,6 +49,7 @@ jobs:
         displayName: 'Pip Authenticate'
         inputs:
           artifactFeeds: 'internal/PythonWorker_Internal_PublicPackages'
+          onlyAddExtraIndex: false
       - ${{ if ne(parameters.libraryVersion, '') }}:
         - checkout: none
         - bash: |

eng/templates/shared/build-steps.yml

@@ -9,6 +9,7 @@ steps:
     displayName: 'Pip Authenticate'
     inputs:
       artifactFeeds: ${{ parameters.ArtifactFeed }}
+      onlyAddExtraIndex: false
   - task: UsePythonVersion@0
     inputs:
       versionSpec: ${{ parameters.PYTHON_VERSION }}
@@ -20,9 +21,4 @@ steps:
       python -m pip install build
       cd ${{ parameters.PROJECT_DIRECTORY }}
       python -m build
-    displayName: 'Build Python ${{ parameters.PROJECT_NAME }}'
-  - bash: |
-      pip install pip-audit
-      cd ${{ parameters.PROJECT_DIRECTORY }}
-      pip-audit -r requirements.txt
-    displayName: 'Run vulnerability scan'
+    displayName: 'Build Python ${{ parameters.PROJECT_NAME }}'

workers/tests/test_setup.py

@@ -30,7 +30,7 @@
 
 from invoke import task
 
-from utils.constants import EXTENSIONS_CSPROJ_TEMPLATE, NUGET_CONFIG
+from utils.constants import EXTENSIONS_CSPROJ_TEMPLATE
 
 ROOT_DIR = pathlib.Path(__file__).parent.parent
 BUILD_DIR = ROOT_DIR / 'build'
@@ -290,7 +290,7 @@ def install_extensions(extensions_dir):
             f.write(EXTENSIONS_CSPROJ_TEMPLATE)
 
     with open(extensions_dir / "NuGet.config", "w") as f:
-        f.write(NUGET_CONFIG)
+        f.write(ROOT_DIR.parent.joinpath("nuget.config").read_text())
 
     env = os.environ.copy()
     env["TERM"] = "xterm"  # ncurses 6.1 workaround

workers/tests/utils/constants.py

@@ -45,23 +45,6 @@
 </Project>
 """
 
-NUGET_CONFIG = """\
-<?xml version="1.0" encoding="UTF-8"?>
-<configuration>
-   <packageSources>
-      <add key="nuget.org"
-        value="https://www.nuget.org/api/v2/" />
-      <add key="azure_app_service"
-        value="https://www.myget.org/F/azure-appservice/api/v2" />
-      <add key="azure_app_service_staging"
-        value="https://www.myget.org/F/azure-appservice-staging/api/v2" />
-      <add key="buildTools"
-        value="https://www.myget.org/F/30de4ee06dd54956a82013fa17a3accb/" />
-      <add key="AspNetVNext"
-        value="https://www.myget.org/F/aspnetcore-dev/api/v3/index.json" />
-   </packageSources>
-</configuration>
-"""
 
 # PROJECT_ROOT refers to the path to azure-functions-python-worker
 # TODO: Find root folder without .parent