Skip to content

Conversation

cloudsmith-iduffy
Copy link

@cloudsmith-iduffy cloudsmith-iduffy commented Jun 23, 2025

When somebody has a custom global index-url defined in their pip conf pip-compile ends up placing it into the generated requirements.txt

Not only does it place in the index url, it also places any authentication credentials.

By exposing PIP_TOOLS_EMIT_INDEX_URL as an environment variable we will enable users with a custom global index-url set to change the default behaviour of pip-compile to false using the envvar.

Contributor checklist
  • Included tests for the changes.
  • PR title is short, clear, and ready to be included in the user-facing changelog.
Maintainer checklist
  • Verified one of these labels is present: backwards incompatible, feature, enhancement, deprecation, bug, dependency, docs or skip-changelog as they determine changelog listing.
  • Assign the PR to an existing or new milestone for the target version (following Semantic Versioning).

cloudsmith-iduffy and others added 2 commits June 23, 2025 09:29
When somebody has a custom global index-url defined in their pip conf pip-compile ends up placing it into the generated requirements.txt

Not only does it place in the index url, it also places any authentication credentials.

By exposing PIP_TOOLS_EMIT_INDEX_URL as an environment variable we will enable users with a custom global index-url set to change the default behaviour of pip-compile to false for including it via an envvar.
@@ -640,7 +640,6 @@ This will be indicated in the output with one of the following suffixes:
- [pip-compile-multi](https://pip-compile-multi.readthedocs.io/en/latest/) - pip-compile command wrapper for multiple cross-referencing requirements files.
- [pipdeptree](https://github.com/tox-dev/pipdeptree) to print the dependency tree of the installed packages.
- `requirements.in`/`requirements.txt` syntax highlighting:

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

unrelated change

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think that's the unstable prettier hook inserting noise.
If the initial commit is rebased (discarding the pre-commit.ci fixup), it shouldn't happen again, since we removed that hook.

@@ -640,7 +640,6 @@ This will be indicated in the output with one of the following suffixes:
- [pip-compile-multi](https://pip-compile-multi.readthedocs.io/en/latest/) - pip-compile command wrapper for multiple cross-referencing requirements files.
- [pipdeptree](https://github.com/tox-dev/pipdeptree) to print the dependency tree of the installed packages.
- `requirements.in`/`requirements.txt` syntax highlighting:
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
- `requirements.in`/`requirements.txt` syntax highlighting:
- `requirements.in`/`requirements.txt` syntax highlighting:

@@ -295,6 +295,7 @@ def _get_default_option(option_name: str) -> Any:
"--emit-index-url/--no-emit-index-url",
is_flag=True,
default=True,
envvar="PIP_TOOLS_EMIT_INDEX_URL",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This probably needs tests and docs.

@webknjaz webknjaz requested a review from sirosen July 9, 2025 12:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants