RTECO-992 - Added support for uv package manager by agrasth · Pull Request #3436 · jfrog/jfrog-cli

agrasth · 2026-04-15T11:52:30Z

All tests have passed. If this feature is not already covered by the tests, new tests have been added.
The pull request is targeting the master branch.
The code has been validated to compile successfully by running go vet ./....
The code has been formatted properly using go fmt ./....

Adds jf uv — a transparent wrapper over the uv CLI with Artifactory credential injection, build-info collection, and full support for all uv subcommands (sync, lock, add, remove, build, publish, run, tree, etc.).

How it works

jf uv <args> behaves identically to uv <args> with two additions:

Credential injection — Artifactory index credentials are set as UV_INDEX_* env vars before calling uv, following UV's own auth priority chain (env vars → embedded URL → netrc → jf config)
Build-info collection — after the command completes, dependency and artifact information is recorded locally for later publishing via jf rt bp

Typical workflow

jf uv sync    --build-name myapp --build-number $BUILD_NUM   # collect deps
jf uv build   --build-name myapp --build-number $BUILD_NUM   # build wheel/sdist
jf uv publish --build-name myapp --build-number $BUILD_NUM   # upload + record artifacts
jf rt bp myapp $BUILD_NUM                                     # publish build-info

CI/Integration notes

Fully compatible with UV_INDEX_URL, UV_DEFAULT_INDEX, and UV_INDEX_*_USERNAME/PASSWORD env vars — jf defers to any native auth already present
[dependency-groups] (PEP 735) and [tool.uv.dev-dependencies] both supported; --no-dev, --only-dev, --group, --only-group, --no-group, --all-groups all respected via uv pip list ground truth
jf uv run --script <file> collects build-info from the script's own inline dependencies (not the surrounding project)
Command is marked Hidden: true pending migration of the definition to jfrog-cli-artifactory

Test coverage

Added uv_test.go with integration tests covering: sync/lock/add/remove/build/publish pipelines, all auth methods, virtual/local/remote repo combinations, build-info verification (deps, artifacts, requestedBy chains, sha1/md5), --module, --server-id, --project, dev/group dependency handling, and CI/VCS properties.

bhanurp · 2026-04-25T07:11:32Z

command definition should be part of jfrog-cli-artifactory

bhanurp · 2026-04-25T07:15:23Z

+        if: matrix.os.name != 'macos'
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11.5"


Can we have a matrix step with latest version of python as well.

Added python-version as a matrix dimension: ["3.11.5", "3.x"]. The 3.x entry always resolves to the latest stable Python 3 via actions/setup-python.

bhanurp · 2026-04-25T07:17:07Z

+
+      - name: Setup UV
+        if: matrix.os.name != 'macos'
+        uses: astral-sh/setup-uv@v5


same with uv package manager as well create matrix step and check if it possible to fetch lastest version always.

Added uv-version as a matrix dimension: ["0.6.17", "latest"]. The astral-sh/setup-uv action supports version: "latest" to always fetch the newest release. The version input is now templated from the matrix.

bhanurp · 2026-04-25T07:21:27Z

 			Action:          PoetryCmd,
 		},
+		{
+			Name:            "uv",


let's mark the command as hidden for now.

Added Hidden: true to the uv command definition. The command definition will move to jfrog-cli-artifactory in a follow-up.

bhanurp · 2026-04-25T07:24:08Z

+}
+
+// uvPyprojectToml holds the [tool.uv] fields we need from pyproject.toml.
+type uvPyprojectToml struct {


we don't need nested structs here and isn't github.com/BurntSushi/toml library used for parsing toml files?

Replaced the anonymous nested struct in uvPyprojectToml with a named uvToolUv type and reused the existing uvIndexEntry type for the index slice. github.com/BurntSushi/toml was already the parser in use.

bhanurp · 2026-04-25T07:29:41Z

+						log.Info("UV auth [publish]: using UV_PUBLISH_USERNAME/PASSWORD (native, step 2b)")
+					default:
+						// deployerRepo is already resolved (CLI flag > pyproject.toml) before auth block.
+						switch {


is this nested switch block? Looks like a code smell. Please avoid.

Removed the nested switch entirely. The fallback path is now extracted into uvInjectPublishCredentials which uses early returns instead of nesting.

bhanurp · 2026-04-25T07:30:19Z

+					//            (when index and publish URL share the same Artifactory host,
+					//             the index native credentials are valid for publish too)
+					//   Fallback: jf server config (only if publish host == jf config host)
+					switch {


Please refactor this entire block.

Refactored into two flat functions: uvApplyPublishAuth (single-level switch over all 5 priority steps) and uvInjectPublishCredentials (early-return guards for steps 4b and fallback). Call site is now a single line.

…d, flat structs and no nested switch in publish auth

…emove UV helpers from cli.go and buildinfo.go

… macOS matrix slot

Update python.NewNativeUvCommand() call to python.NewNativeUVCommand() to match the renamed identifier in jfrog-cli-artifactory.

…ctives

…traversal false positive

agrasth requested a deployment to frogbot April 15, 2026 11:52 — with GitHub Actions Waiting

agrasth force-pushed the feature/RTECO-992 branch from 5f863ce to ce3bc96 Compare April 15, 2026 17:33

agrasth requested a deployment to frogbot April 15, 2026 17:34 — with GitHub Actions Waiting

agrasth marked this pull request as ready for review April 24, 2026 09:09

agrasth added 3 commits April 24, 2026 15:32

RTECO-992 - Added support for uv package manager

81746ed

Fix minor issues

37818b9

Updated dependecies

37ae599

agrasth force-pushed the feature/RTECO-992 branch from ce3bc96 to 37ae599 Compare April 24, 2026 10:13

agrasth requested a deployment to frogbot April 24, 2026 10:13 — with GitHub Actions Waiting

Merge branch 'master' into feature/RTECO-992

5e92f7e

agrasth requested a deployment to frogbot April 24, 2026 10:14 — with GitHub Actions Waiting

agrasth added the safe to test Approve running integration tests on a pull request label Apr 24, 2026

bhanurp requested changes Apr 25, 2026

View reviewed changes

Address PR review: CI matrix for python/uv versions, hidden uv comman…

d3bf9e5

…d, flat structs and no nested switch in publish auth

agrasth requested a deployment to frogbot April 27, 2026 04:20 — with GitHub Actions Waiting

agrasth requested a deployment to frogbot April 27, 2026 05:34 — with GitHub Actions Waiting

Slim down UV: delegate to NativeUvCommand in jfrog-cli-artifactory, r…

2cf421e

…emove UV helpers from cli.go and buildinfo.go

agrasth force-pushed the feature/RTECO-992 branch from bbea393 to 2cf421e Compare April 27, 2026 05:48

agrasth requested a deployment to frogbot April 27, 2026 05:48 — with GitHub Actions Waiting

Fix uv_test.go compile errors, rename UvInstall→Uv, fastci@v1, remove…

8e1665c

… macOS matrix slot

agrasth requested a deployment to frogbot April 27, 2026 06:03 — with GitHub Actions Waiting

agrasth requested a deployment to frogbot April 27, 2026 06:33 — with GitHub Actions Waiting

Update project.UV and NativeUVCommand references after acronym rename

c94d20b

Update python.NewNativeUvCommand() call to python.NewNativeUVCommand() to match the renamed identifier in jfrog-cli-artifactory.

agrasth force-pushed the feature/RTECO-992 branch from ae57501 to c94d20b Compare April 27, 2026 06:51

agrasth requested a deployment to frogbot April 27, 2026 06:51 — with GitHub Actions Waiting

agrasth requested a deployment to frogbot April 28, 2026 03:09 — with GitHub Actions Waiting

UV: fix help text redundant keyword, update go.mod local replace dire…

eba1156

…ctives

agrasth force-pushed the feature/RTECO-992 branch from 4d1e242 to eba1156 Compare April 28, 2026 03:21

agrasth requested a deployment to frogbot April 28, 2026 03:22 — with GitHub Actions Waiting

Fix lint: Checksum embedded selector, unused params, gosec G703 path …

be01399

…traversal false positive

agrasth requested a deployment to frogbot April 28, 2026 04:42 — with GitHub Actions Waiting

agrasth requested a deployment to frogbot April 28, 2026 06:17 — with GitHub Actions Waiting

agrasth requested a review from bhanurp April 28, 2026 06:18

agrasth added safe to test Approve running integration tests on a pull request and removed safe to test Approve running integration tests on a pull request labels Apr 28, 2026

naveenku-jfrog approved these changes Apr 28, 2026

View reviewed changes

Fix gosec G703: move #nosec to same line as os.WriteFile

247b05e

agrasth force-pushed the feature/RTECO-992 branch from b2938f8 to 247b05e Compare April 28, 2026 10:05

agrasth requested a deployment to frogbot April 28, 2026 10:05 — with GitHub Actions Waiting

Conversation

agrasth commented Apr 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

How it works

Typical workflow

CI/Integration notes

Test coverage

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

agrasth commented Apr 15, 2026 •

edited

Loading