Use configured repositories as sources by default

[abn]

This change adds globally configured extra repositories from config.toml as dependency sources. These are added after project specific sources and before PyPI.

The motivation behind this change was to enable a cleaner configuration of private repositories/mirrors under automated pipeline build environments without hard coding repository configurations within the project sources. Additionally, this provides functionality similar to pip's extra_index config allowing global configuration of repositories.

Pull Request Check List

This is just a reminder about the most common mistakes. Please make sure that you tick all appropriate boxes. But please read our contribution guide at least once, it will save you unnecessary review cycles!

• Added tests for changed code.
• Updated documentation for changed code.

Note: If your Pull Request introduces a new feature or changes the current behavior, it should be based
on the develop branch. If it's a bug fix or only a documentation update, it should be based on the master branch.

If you have any questions to any of the points above, just submit and ask! This checklist is here to help you, not to deter you from contributing!

Resolves: #625

[abn]

@sdispater would be good get your thoughts on this one. Happy to make any changes as required.

[sdispater]

This PR is superseded by #908 which introduces a way to specify a source as the default

[abn]

@sdispater the feature being worked on in #908 is going to be definitely helpful. However, if I am understanding the change there, it is different to what was intended here.

In #908, only repositories configured in the project's pyproject.toml is accounted for. The intention here was to use repositories configured in poetry's global config.toml without the need to add a source for those in every project.

Is this behaviour intended to be added as part of #908?

[drunkwcodes]

What is your use case?

I think it is convenient for changing dependency without changing pyproject.toml.

But it also tends to bypass pyproject.toml and make it obsolete.
I can't find a use case by myself to see this as a requirement.

[abn]

@drunkwcodes for what it is worth, example scenarios are mentioned in the description.

Expanding on that, having a global configuration has merits in the context of production use cases and build pipelines. Final application builds might use specific repositories that might only be accessible from build environments. In addition, this has the potential to assist developer workflows, for example in scenarios where a devpi servers are used.

The implementation proposed falls back to global repositories, ie. packages are searched first in repositories configured by the project configuration and if they are not found, we fallback to global repositories.

[abn]

@drunkwcodes but assert repositories.index(source_local) < repositories.index(source_global) does.

[github-actions]

This pull request has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.