Skip to content

Regenerate Harbor uv.lock files against public PyPI #2226

Description

@delkc

🤖 Reported by Codex during the public-release documentation audit.

Summary

The Harbor benchmark lockfiles contain package sources and artifact URLs for Block's internal Artifactory mirror instead of public PyPI:

  • benchmarks/harbor-buzz-orchestra/uv.lock: 1,589 references to global.block-artifacts.com
  • benchmarks/harbor-buzz-orchestra/testbed/uv.lock: 1,645 references to global.block-artifacts.com

Neither adjacent pyproject.toml explicitly configures that index, so the lockfiles appear to have captured a developer-global uv configuration when they were generated.

Impact

External contributors may be unable to run uv sync --frozen for these benchmark environments without access to Block's package mirror. The committed files also expose an organization-specific dependency endpoint that is not part of the open-source setup.

Suggested fix

  1. Regenerate both lockfiles in a clean environment with public PyPI explicitly selected, for example with https://pypi.org/simple as the default index.
  2. Run uv sync --frozen for both projects from an environment without Block credentials or package-index configuration.
  3. Consider adding a CI check that rejects organization-only package hosts in committed lockfiles.

Acceptance criteria

  • Neither lockfile contains global.block-artifacts.com or another private package host.
  • Both benchmark environments install successfully with uv sync --frozen using public dependencies only.
  • Existing benchmark tests still pass.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions