Using uv with a private package index

Ravenstash exposes PyPI-compatible package indexes and upload workflows while rvs keeps repository URLs and reusable credentials out of project files and shell history.

Select the private repository

rvs auth login --profile work
rvs account switch AcmeHQ
rvs art select platform/packages

Install with uv

rvs art select platform/packages
rvs uv pip install internal-sdk==1.2.3

The selected repository becomes uv’s package source for that command. Temporary access lasts only for the command that rvs launches.

Build and publish

rvs art select platform/packages
rvs uv build
rvs uv publish

rvs shows the destination and planned files before uploading. Review them, then confirm the publish.

Open the release in Ravenstash and install the exact version in a clean environment. Publish a new version whenever package contents change.

Keep one protected dependency source

Connect the official PyPI mirror when the project also needs public dependencies. Eligible releases resolve through the same Ravenstash target and approved files stay cached for repeat builds.

One controlled source reduces dependency-confusion risk. Security scanning checks mirrored packages, while minimum package age delays brand-new releases during the period when a compromised update is most likely to spread unnoticed. See how upstream package resolution works for how a private package name takes priority over a public one.

CI

Store an organization-owned automation token as RVS_TOKEN in the CI secret manager, then run the same target-explicit workflow:

rvs art select platform/packages
rvs uv sync --locked
rvs uv build
rvs uv --rvs-yes publish

If a package is unavailable, confirm the selected target, connected PyPI mirror, and minimum package-age setting. For the complete workflow, see the PyPI quickstart, install reference, and publish reference.