fix: normalize package URLs in check_uv_lock_public_urls --fix - #1675
Merged
sd-db merged 3 commits intoSep 10, 2026
Merged
Conversation
`--fix` rewrote the 114 source registries but left the 1512 artifact URLs pointing at whichever index produced the lock, so on a mirrored index the check it runs immediately afterwards still failed and the URLs had to be substituted by hand. Only the host is rewritten, and only for URLs shaped like the public artifact tree: the /packages/ path identifies the artifact and the hash recorded beside it is what guarantees integrity. A URL without that path is left for the check to report rather than rewritten on a guess. Co-authored-by: Isaac <no-reply@databricks.com>
moomindani
requested review from
jprakash-db,
saishreeeee and
sd-db
as code owners
September 10, 2026 00:45
Co-authored-by: Isaac <no-reply@databricks.com>
Coverage report
This PR does not seem to contain any modification to coverable code. |
sd-db
approved these changes
Sep 10, 2026
sd-db
left a comment
sd-db
left a comment
Collaborator
There was a problem hiding this comment.
Changes look good, thx !! Will look to merge post some more internal testing.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
scripts/check_uv_lock_public_urls.py --fixnormalizes thesource = { registry = ... }entries but not the artifacturlentries, and the check it runs immediately afterwards requires both. On a lock produced against a mirrored index that means--fixrewrites 114 registries, leaves 1512 package URLs, and then reports failure — so the URLs have to be substituted by hand before the pre-commit hook will pass.This came up while raising four dependency bounds (#1670, #1671, #1672, #1673): every one of them needed the same manual substitution after
uv lock.--fixnow rewrites the host of URLs shaped like the public artifact tree. Only the host changes: the/packages/path identifies the artifact and the hash recorded beside it is what guarantees integrity, so the rewrite cannot silently point at different content. A URL without a/packages/path is not a mirror of that tree, so rewriting its host would be a guess — those are left for the check to report.The
--fixsummary line now reports both counts, sofix_uv_lockreturns a(registry_count, url_count)pair.Testing
New
tests/unit/test_check_uv_lock_public_urls.py(6 tests) covers the check on a public and a mirrored lock, the fix on both, path and hash preservation, and the non-mirror URL left alone. Three of them fail against the current script.End to end on this repo: regenerating
uv.lockagainst a mirrored index and running--fixalone now produces a file byte-identical to the committeduv.lock, anduv lock --checkagrees.Unit suite 1349 passed, 4 skipped;
code-qualityclean.Checklist
CHANGELOG.mdand added information about my change to the "dbt-databricks next" section.dbt-databricks-pr-readyproject skill for this PR and addressed its merge-readiness feedback