fix(installer): improve private-index recovery guidance

[Alex Bilyk (oleksandr-bilyk)]

Summary

• show a credential-safe command for reusing an existing pip mirror when uv cannot reach the public package index
• recommend UV_SYSTEM_CERTS=1 for current uv releases while retaining the legacy setting for uv versions older than 0.11
• cover the new recovery guidance in installer integration and static tests

Validation

• uv run --frozen ruff check tests/test_integration/test_install_scripts.py tests/test_integration/test_install_script_files.py
• uv run --frozen ty check tests/test_integration/test_install_scripts.py tests/test_integration/test_install_script_files.py
• PowerShell parser validation for install.ps1
• sh -n install.sh
• uv run --frozen pytest -q tests/test_integration/test_install_script_files.py (12 passed)
• uv run --frozen pytest -q -m install_scripts tests/test_integration/test_install_scripts.py -k "blocked_package_index_reports_guidance or blocked_index_offers_credential_safe_pip_bridge" (2 passed)
• Windows rename-fallback integration test (1 passed with the configured package mirror)

[Codecov Comments Bot (codecov-commenter)]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (main@e8f02e1). Learn more about missing BASE report.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #536   +/-   ##
=======================================
  Coverage        ?   92.30%           
=======================================
  Files           ?      175           
  Lines           ?    28231           
  Branches        ?        0           
=======================================
  Hits            ?    26059           
  Misses          ?     2172           
  Partials        ?        0           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Jason Robert (jrob5756)]

One blocking issue and one test-coverage gap, both around the new pip-to-uv index bridging logic.

Blocking:

• install.sh:322 — the pip index lookup isn't guarded before UV_DEFAULT_INDEX gets set and the installer reruns.

[Jason Robert (jrob5756)]

Two things from last time are done: the pip-to-uv bridge now guards against an empty lookup, and there's a test asserting the full rendered bridge sequence, not just pieces of it.

Everything else is still open.

CI is red on this commit, reported four separate ways:

• Install Scripts (ubuntu-latest) failed on run 35366975168, attempt 2: https://github.com/microsoft/conductor/actions/runs/35366975168/job/105685803280
• Changelog failed on run 35366975254, attempt 2: https://github.com/microsoft/conductor/actions/runs/35366975254/job/105685698456
• The check "CI / Install Scripts (ubuntu-latest)" is showing FAILURE for that same job.
• The check "Changelog / Changelog" is showing FAILURE for that same job.

All four point at the same two failing jobs. Get the commit green, then re-run review and verify checks before merging.

One more item carried over, recommended rather than blocking: install.sh:322 — the pip index lookup isn't guarded before UV_DEFAULT_INDEX gets set and the installer reruns. There's a test-coverage gap alongside it. The follow-up pass didn't examine this one, so it's coming through unexamined — take a look yourself before deciding whether it needs to block.

[Alex Bilyk (oleksandr-bilyk)]

Jason Robert (@jrob5756) Addressed the two red checks in a6a4303:

• fixed the POSIX nested printf rendering by using a fixed outer format, so the generated snippet preserves the literal %s\n
• added changelog.d/+installer-index-guidance.fixed.md for the new changelog contract

Local validation passed: changelog contract, sh -n install.sh, direct POSIX rendering assertion, static installer tests (12 passed), and focused blocked-index integration tests (2 passed).

The refreshed CI and Changelog runs are currently action_required with no jobs created and need maintainer approval. Please approve the fork workflows and re-review once they complete.

[Jason Robert (jrob5756)]

The empty pip index lookup is guarded now, coverage requires the full rendered bridge, and the changelog issue is fixed. Good progress.

One item from the earlier pass is still open. It was flagged recommended, but it actually bundles a blocking issue with a coverage gap, both in the new pip-to-uv index bridging logic: at install.sh:322, the pip index lookup still isn't guarded before UV_DEFAULT_INDEX gets set and the installer reruns. The follow-up analysis didn't check whether this landed, so I can't confirm it from here — worth a manual look before closing it out.

Still open:

• install.sh:322 — pip index lookup guard (blocking, per the original point)

[Alex Bilyk (oleksandr-bilyk)]

Manual Windows validation completed on September 22, 2026:
• Uninstalled the existing  conductor-cli  uv tool.
• Reinstalled from the current  fix/installer-index-guidance  checkout using:
 .\install.ps1 -Source C:\dev\conductor -Force -SkipPathUpdate 
• The installer detected  UV_DEFAULT_INDEX=internal=https://packagefeedproxy.microsoft.io/pypi/simple/ .
• Installation completed successfully.
• Verification passed:  Conductor v0.1.37 .
This validates the local-source installer path and internal-index handling on Windows. All CI checks are also green