Skip to content

fix(benchmarks): regenerate Harbor uv.lock files against public PyPI - #2254

Open
ianalloway wants to merge 1 commit into
block:mainfrom
ianalloway:cursor/public-harbor-lockfiles-187c
Open

fix(benchmarks): regenerate Harbor uv.lock files against public PyPI#2254
ianalloway wants to merge 1 commit into
block:mainfrom
ianalloway:cursor/public-harbor-lockfiles-187c

Conversation

@ianalloway

@ianalloway ianalloway commented Jul 21, 2026

Copy link
Copy Markdown

Fixes #2226

The committed Harbor lockfiles pointed at Block's Artifactory mirror (global.block-artifacts.com), so external contributors could not uv sync --frozen without internal credentials.

Changes

  • Regenerate both uv.lock files with --index-url https://pypi.org/simple
  • Add scripts/check-public-package-locks.sh and wire it into the Harbor CI workflow

Test plan

  • scripts/check-public-package-locks.sh passes
  • No global.block-artifacts.com refs remain in either lockfile
  • uv sync --frozen works without Artifactory credentials

Copilot AI review requested due to automatic review settings July 21, 2026 18:33
@ianalloway
ianalloway requested a review from a team as a code owner July 21, 2026 18:33
Copilot AI reviewed Jul 21, 2026

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@cameronhotchkies cameronhotchkies added the triage-ready Appropriate for agentic review label Jul 30, 2026
@cameronhotchkies

cameronhotchkies commented Jul 30, 2026

Copy link
Copy Markdown
Collaborator

🦾 DCO sign-off is failing on this PR. Each commit needs a Signed-off-by trailer matching your GitHub-verified email. See CONTRIBUTING.md — Sign your commits for how to add or rewrite the trailers.

@ianalloway

ianalloway commented Sep 6, 2026

Copy link
Copy Markdown
Author

Status 2026-09-06: approved, but has merge conflicts and failing DCO Check. Needs rebase onto main + Signed-off-by, then re-review/merge.

@ianalloway
ianalloway force-pushed the cursor/public-harbor-lockfiles-187c branch from 555a3a0 to f26fda5 Compare September 6, 2026 17:07
@github-actions

github-actions Bot commented Sep 6, 2026 •
edited
Loading

Copy link
Copy Markdown

🔐 Codex Security Review

Status: review required for the current range.

The current range is 3c7f288c60d67df78577b237e27c3dfc8831aaa1...90827a9aafb00a67bc8cc19397f3987c03ca6c6a.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 90827a9aafb00a67bc8cc19397f3987c03ca6c6a to authorize a new review.
Any previous review applies only to its recorded range.

@ianalloway
fix(benchmarks): regenerate Harbor uv.lock files against public PyPI
90827a9 
The committed Harbor lockfiles pointed at Block's Artifactory mirror
(global.block-artifacts.com), so external contributors could not
`uv sync --frozen` without internal credentials (block#2226).

Regenerate both lockfiles with --index-url https://pypi.org/simple and
add a CI check that rejects private package hosts in those files.

Signed-off-by: Ian Alloway <ianalloway@usf.edu>
@ianalloway
ianalloway force-pushed the cursor/public-harbor-lockfiles-187c branch from 23b586b to 90827a9 Compare September 8, 2026 13:26
@ianalloway

ianalloway commented Sep 8, 2026

Copy link
Copy Markdown
Author

Rebased onto latest main (Harbor locks regenerated against public PyPI). DCO green. Previous approval from @wpfleger96 may have been dismissed by the rebase — would appreciate a re-review when you have a moment.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort, defaults to Lite
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@wpfleger96 wpfleger96 wpfleger96 approved these changes

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

triage-ready Appropriate for agentic review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Regenerate Harbor uv.lock files against public PyPI

4 participants

@ianalloway @cameronhotchkies @wpfleger96