Using uv with a private package index

Ravenstash exposes PyPI-compatible package indexes and upload workflows while rvs keeps repository URLs and reusable credentials out of project files and shell history.

Select the private repository

rvs auth login --profile work
rvs account use org:acme
rvs art select platform/packages

Install with uv

rvs art select platform/packages
rvs uv pip install internal-sdk==1.2.3

The repository target becomes uv’s package source for that invocation. Temporary authentication exists only for the command that rvs launches.

Build and publish

rvs art select platform/packages
rvs uv build
rvs uv publish

Open the release in Ravenstash and install the exact version in a clean environment. Publish a new version whenever artifact contents change.

Keep one protected dependency source

Connect the official PyPI mirror when the project also needs public dependencies. Eligible releases resolve through the same Ravenstash target and approved files stay cached for repeat builds.

One controlled source reduces dependency-confusion risk. Security scanning checks mirrored packages, while minimum package age delays brand-new releases during the period when a compromised update is most likely to spread unnoticed.

CI

Store an organization-owned automation token as RVS_TOKEN in the CI secret manager, then run the same target-explicit workflow:

rvs art select platform/packages
rvs uv sync --locked
rvs uv build
rvs uv publish

If a package is unavailable, confirm the selected target, connected PyPI mirror, and minimum package-age setting. For the complete workflow, see the PyPI quickstart, install reference, and publish reference.