tree 312f0d249ef404bd7035b76240acc969f656bfeb
parent 381762af4e3e7d1c83e827aec9bb14b4c477f492
author Ted Kaplan <ted.kaplan@bedrockrobotics.com> 1791165405 +0000
committer GitHub <noreply@github.com> 1791165405 +0000
gpgsig -----BEGIN PGP SIGNATURE-----
 
 wsFcBAABCAAQBQJqwwPuCRC1aQ7uu5UhlAAAOscQAJ2v1cXReGitfk8hUt4/b6no
 FJNHSV2eu5tzK7tTs4a6Q22s/CS0UxXdzCZ2XTnWM+4PjTNReTzQunKF6FkD/w+k
 Qu+vOkG1GD12r6KaFWlMMZYbCVljZM2swNlJboee4r0AI5jFPpFBf8wwbSVwENC3
 wPQHg7mjtEr1XEROTGWi/p0fmKOB3ukWXhONOKHj8P+Mr/Rygidi3FXY+WqLidqf
 cp3FV4yjZfxvtV3Nt4HA/tEHkCcwwOk3CrWxtXJMTMVELYzh/EiqZoTMQVBy8FVJ
 oCF7Unj3mXFeDb2YyBktBNrvROg7V8uUA1rAvCqwvLcP+NVva/9/6DLwtbbyYI4O
 5rE6g4k11UhS7A+LLWmIe5gtHOopND90HhmjpTdZ4KMVOZWuONQZ3tRGTX7iBQ8j
 NMn8CQX3wEe318iRwk1kBCm3oSv2ubjMXUHDp6AuyPVzGZGi7M2xbvtCETezKL8w
 On1OPZ+YUrY8mL8Jw4mq7G6akOMMZA+meYZE7JSKgmyfSBimV5+TQsl+wmJD+h2C
 2C1wqPORgw9qbMkXKQHRcc/QJq+e42YbWfYkkViGJEcIIbGvMxslDqvjMx0IMR5V
 ifKVzc0xHxLMbyd9dCdeNhRpD5z3o6la+Vp/mUFkyGwQTJ1V3y5/oGVJ+s3pdZ+S
 WmKfwLhZu69nUiX6xzEX
 =7qb5
 -----END PGP SIGNATURE-----
 

fix(pypi): build uv.lock git sources with pip (#4209)

`pip.parse(uv_lock = ...)` passes a git-sourced package's raw uv source
string (`https://host/repo?rev=<ref>#<commit>`) to the Bazel downloader
as a URL, which cannot fetch a git repository (#4139). #4086 fixed the
invalid repo name for these sources but kept the URL, so they still fail
at fetch time.

This makes uv.lock git sources match how a `foo @ git+...` line from a
requirements file is already handled:

- The src gets an empty `url` and `filename`, so `_whl_repo` takes the
existing pip path instead of the downloader.
- The requirement line becomes a pip direct reference, `foo @ git+<repo
url>@<commit>`, pinned to the commit uv resolved rather than the
requested `rev`/`tag`/`branch`. Before, it was `foo==<version>`, which
pip cannot satisfy for a VCS-only version such as `0.12.0a0+39be1c6`.
- A `subdirectory` query parameter carries over as
`#subdirectory=<dir>`. uv percent-encodes it
(`subdirectory=python%2Ffoo`) and pip reads the fragment as a literal
path, so it is decoded. I checked both against uv 0.9.30 and pip 26.2.1:
pip fails on the encoded form with "does not appear to be a Python
project" and builds the decoded one.

Tests: updated `test_uv_lock_vcs_entry` for the new src shape and added
`test_uv_lock_vcs_entry_subdirectory`.
`//tests/pypi/parse_requirements/...` and `//tests/pypi/hub_builder/...`
pass. End to end, a large monorepo using `pip.parse(uv_lock = ...)`
builds its git-sourced `torchdata` dependency against this branch via
`--override_module`; we have been carrying the same change as a patch on
2.3.1.

Fixes #4139