Use pinned pypi-shipped uv through CFS rather than uv native installer (#46296)

* cutover to use pypi uv
* fix up order of operations. We ALWAYS want UsePythonVersion -> AuthDevFeed --> Install UV globally from pypi -> prepend path so uv is always available.

Author: scbedd

eng/pipelines/aggregate-reports.yml

@@ -29,6 +29,10 @@ stages:
             inputs:
               versionSpec: '$(PythonVersion)'
 
+          - template: /eng/pipelines/templates/steps/auth-dev-feed.yml
+            parameters:
+              EnableTwineAuth: false
+
           - template: /eng/pipelines/templates/steps/use-venv.yml
 
           - template: /eng/pipelines/templates/steps/analyze_dependency.yml

eng/pipelines/templates/jobs/ci.yml

@@ -213,6 +213,12 @@ jobs:
       condition: succeededOrFailed()
       inputs:
         versionSpec: $(PythonVersion)
+
+    - template: /eng/pipelines/templates/steps/auth-dev-feed.yml
+      parameters:
+        DevFeedName: ${{ parameters.DevFeedName }}
+        EnableTwineAuth: false
+
     - template: /eng/pipelines/templates/steps/use-venv.yml
 
     - template: /eng/common/pipelines/templates/steps/check-spelling.yml
@@ -281,10 +287,14 @@ jobs:
           - task: UsePythonVersion@0
             inputs:
               versionSpec: '3.12'
-          - template: /eng/pipelines/templates/steps/use-venv.yml
+
           - template: ../steps/auth-dev-feed.yml
             parameters:
               DevFeedName: ${{ parameters.DevFeedName }}
+              EnableTwineAuth: false
+
+          - template: /eng/pipelines/templates/steps/use-venv.yml
+
           - template: /eng/common/pipelines/templates/steps/save-package-properties.yml
             parameters:
               ServiceDirectory: ${{parameters.ServiceDirectory}}
@@ -322,11 +332,13 @@ jobs:
           - task: UsePythonVersion@0
             inputs:
               versionSpec: '3.12'
-          - template: /eng/pipelines/templates/steps/use-venv.yml
 
           - template: ../steps/auth-dev-feed.yml
             parameters:
               DevFeedName: ${{ parameters.DevFeedName }}
+              EnableTwineAuth: false
+
+          - template: /eng/pipelines/templates/steps/use-venv.yml
 
           - pwsh: |
               $ErrorActionPreference = 'Stop'

eng/pipelines/templates/steps/auth-dev-feed.yml

@@ -43,4 +43,7 @@ steps:
         } else {
           Write-Host "##[warning]PIP_INDEX_URL not set - uv will fall back to public PyPI."
         }
+        # Force any managed Python downloads to go directly to GitHub releases
+        # rather than the default CDN (releases.astral.sh).
+        Write-Host "##vso[task.setvariable variable=UV_PYTHON_INSTALL_MIRROR]https://github.com/astral-sh/python-build-standalone/releases/download"
       displayName: 'Configure UV Authentication'

eng/pipelines/templates/steps/build-extended-artifacts.yml

@@ -28,6 +28,7 @@ steps:
   - template: auth-dev-feed.yml
     parameters:
       DevFeedName: ${{ parameters.DevFeedName }}
+      EnableTwineAuth: false
 
   - task: UsePythonVersion@0
     displayName: 'Use Python 3.13'

eng/pipelines/templates/steps/build-package-artifacts.yml

@@ -32,18 +32,19 @@ steps:
       Paths:
         - '**'
 
-  # Authenticate to Azure Artifacts feed immediately after checkout to prevent 401 errors
-  # Public feeds have upstream sources enabled and require authentication for passthrough to pypi.org
-  - template: auth-dev-feed.yml
-    parameters:
-      DevFeedName: ${{ parameters.DevFeedName }}
-
   - task: UsePythonVersion@0
     displayName: 'Use Python $(PythonVersion)'
     condition: and(succeeded(), or(eq(variables['ENABLE_EXTENSION_BUILD'], 'true'), eq('${{ parameters.ArtifactSuffix }}', 'linux')))
     inputs:
       versionSpec: $(PythonVersion)
 
+  # Authenticate to Azure Artifacts feed immediately after checkout to prevent 401 errors
+  # Public feeds have upstream sources enabled and require authentication for passthrough to pypi.org
+  - template: auth-dev-feed.yml
+    parameters:
+      DevFeedName: ${{ parameters.DevFeedName }}
+      EnableTwineAuth: false
+
   - template: /eng/pipelines/templates/steps/use-venv.yml
 
   - template: /eng/common/pipelines/templates/steps/set-test-pipeline-version.yml@self

eng/pipelines/templates/steps/build-test.yml

@@ -26,13 +26,14 @@ steps:
     parameters:
       versionSpec: '${{ parameters.PythonVersion }}'
 
-  - template: /eng/pipelines/templates/steps/use-venv.yml
-
   # Authenticate to Azure Artifacts feed immediately after checkout to prevent 401 errors
   # Public feeds have upstream sources enabled and require authentication for passthrough to pypi.org
   - template: /eng/pipelines/templates/steps/auth-dev-feed.yml
     parameters:
       DevFeedName: ${{ parameters.DevFeedName }}
+      EnableTwineAuth: false
+
+  - template: /eng/pipelines/templates/steps/use-venv.yml
 
   - template: /eng/common/pipelines/templates/steps/set-test-pipeline-version.yml
     parameters:

eng/pipelines/templates/steps/install-uv.yml

@@ -1,26 +1,13 @@
-
 steps:
-  - task: Bash@3
-    displayName: 'Install uv (Linux/macOS)'
-    inputs:
-      targetType: inline
-      script: |
-        curl -LsSf https://astral.sh/uv/install.sh | sh
-    condition: or(eq(variables['Agent.OS'], 'Linux'), eq(variables['Agent.OS'], 'Darwin'))
-
-  - task: Bash@3
-    inputs:
-      targetType: inline
-      script: |
-        echo "##vso[task.prependpath]$HOME/.local/bin"
-    displayName: 'Prepend path for MacOS'
-    condition: eq(variables['Agent.OS'], 'Darwin')
+  - pwsh: |
+      $ErrorActionPreference = 'Stop'
+      $PSNativeCommandUseErrorActionPreference = $true
+      $indexUrl = if ($env:PIP_INDEX_URL) { $env:PIP_INDEX_URL } else { 'https://pkgs.dev.azure.com/azure-sdk/public/_packaging/azure-sdk-for-python/pypi/simple/' }
+      python -m pip install uv==0.11.6 --index-url $indexUrl
 
-  - task: PowerShell@2
-    displayName: 'Install uv (Windows)'
-    inputs:
-      targetType: inline
-      script: |
-        iex (irm https://astral.sh/uv/install.ps1)
-        Write-Host "##vso[task.prependpath]$env:USERPROFILE\.local\bin"
-    condition: eq(variables['Agent.OS'], 'Windows_NT')
+      # prepend the path to the installed uv to the PATH so that it can be used in subsequent steps without needing to know the exact path or relying
+      # the global python instance being prepended on the PATH
+      $scriptsDir = python -c "import sysconfig; print(sysconfig.get_path('scripts'))"
+      $env:PATH = "$scriptsDir$([System.IO.Path]::PathSeparator)$env:PATH"
+      Write-Host "##vso[task.prependpath]$scriptsDir"
+    displayName: 'Install uv'

eng/pipelines/templates/steps/run_apistub.yml

@@ -5,11 +5,6 @@ parameters:
 
 # Please use `$(TargetingString)` to refer to the python packages glob string. This variable is set from resolve-package-targeting.yml.
 steps:
-  - pwsh: |
-      Write-Host "##vso[task.setvariable variable=PIP_INDEX_URL]https://pypi.python.org/simple"
-    displayName: Reset PIP Index For APIStubGen
-    condition: and(succeededOrFailed(), eq(variables['Skip.ApiStubGen'],'true'))
-
   - task: UsePythonVersion@0
     displayName: 'Use Python 3.10'
     inputs: