Stop internal PyPI proxy URLs from leaking into uv.lock

.github/workflows/push.yml

@@ -425,11 +425,6 @@ jobs:
       - name: Verify that generated files are up to date
         run: |
           go tool -modfile=tools/task/go.mod task --force generate-check
-          # pydabs-codegen's `uv run` rewrites uv.lock with the JFrog pypi proxy
-          # URLs that setup-jfrog configures (and drops some size fields), whereas
-          # the committed locks use pypi.org. That churn is environment noise, not
-          # codegen drift, so discard it before diffing.
-          git checkout -- python/uv.lock python/codegen/uv.lock
           # Register untracked files with intent-to-add so `git diff` reports new
           # files (e.g. a newly generated command) too, not just modifications.
           git add --intent-to-add .

Taskfile.yml

@@ -295,15 +295,23 @@ tasks:
     cmds:
       - ./tools/check_deadcode.py
 
+  check-uv-lock:
+    desc: Fail if a Databricks PyPI proxy URL leaked into a uv.lock
+    # pydabs-codegen reverts this proxy-URL churn after regenerating; this is a
+    # backstop against a proxy URL reaching a committed lock any other way.
+    cmds:
+      - "! git grep -lF databricks.com -- '*uv.lock'"
+
   checks:
-    desc: Run quick checks (tidy, whitespace, links, deadcode)
+    desc: Run quick checks (tidy, whitespace, links, deadcode, uv.lock)
     # Sequential: `tidy` rewrites go.mod/go.sum and any future tidy work
     # touching more paths should not race with whitespace/link scanners.
     cmds:
       - task: tidy
       - task: ws
       - task: links
       - task: deadcode
+      - task: check-uv-lock
 
   install-pythons:
     desc: Install Python 3.9-3.13 via uv

python/Taskfile.yml

@@ -81,6 +81,11 @@ tasks:
       # Generated code is fixed and formatted by the global ruff (see ../ruff.toml).
       - uvx ruff@0.15.17 check --fix databricks databricks_tests || true
       - uvx ruff@0.15.17 format
+      # The `uv run` invocations above rewrite the lockfiles with the internal
+      # *.databricks.com PyPI proxy URL when uv/pip is proxy-configured (locally
+      # or via setup-jfrog in CI). That is environment noise, not codegen output;
+      # revert it so the committed locks stay on pypi.org.
+      - git checkout -- uv.lock codegen/uv.lock
 
   pydabs-build:
     desc: Build pydabs wheel