fix(ci): regenerate uv.lock against public PyPI (was Netflix-internal)

The validate × 3 devcontainer CI failures were NOT environmental —
they were caused by this branch.

Root cause: commit 967b0db (PR-B1 big delete) was made on a Netflix
machine where uv was configured to use the internal mirror. The
subagent ran `uv lock` to regenerate after deleting deps, capturing
`pypi.netflix.net/simple` as the registry for every package and
`pypi.netflix.net/packages/<id>/<file>.whl` as the URL for every
wheel and sdist. main's lock points at public `pypi.org/simple` and
`files.pythonhosted.org/packages/...`.

When CI ran on GitHub Actions runners (no Netflix network access),
uv tried to fetch from `pypi.netflix.net` and timed out — surfacing
as "Failed to download cuda-bindings==12.9.4 / safetensors==0.7.0
/ nvidia-cuda-cupti-cu12==12.8.90 — request failed after 3 retries".
Devs running the same devcontainer locally on a Netflix machine
saw it work because their box could reach the internal mirror.

Fix: restore main's uv.lock and regenerate against public PyPI:
    UV_INDEX_URL=https://pypi.org/simple \
    UV_DEFAULT_INDEX=https://pypi.org/simple \
    uv lock

The regenerated lock has 311 pypi.org URLs and 0 pypi.netflix.net
URLs. The pytest `live` marker added in Wave 3 was the only real
pyproject.toml change in the branch — no dep deltas — so the lock's
package set matches what main resolves modulo a handful of
transitive bumps (loguru, mmh3, py-rust-stemmers, win32-setctime,
pillow 11.3.0).

This is the correct lock for upstream CI. Anyone working on a
Netflix box should rely on uv's index-URL override at install time
(or pin via UV_INDEX_URL in their shell), NOT bake the internal
mirror into the canonical lockfile that ships in the repo.
This commit is contained in:
chopratejas 2026-05-02 20:00:44 -07:00
parent f1aa12cebf
commit ce3b2f0b0b

8448
uv.lock generated

File diff suppressed because it is too large Load diff