Query Azure Artifacts Feed for Existing Version when Determining Built Version

[ScottCarda-MS]

Summary

set_version.py computes the next package version on every publish build by
querying the list of already-published versions. Previously it made a raw call
to public PyPI (https://pypi.python.org/pypi/azure-quantum/json). With the
network-isolation / CFS policy now enforced on the build agents, direct
connections to public registries are blocked, so that call fails
(PermissionError: [WinError 10013]).

This PR reworks the version logic to read the published version history from the
allowed Azure Artifacts feed (via the credentialed PIP_INDEX_URL that
PipAuthenticate@1 already provides) instead of contacting PyPI directly, while
preserving the existing version-numbering behavior on the release path.

What changed

Source of version data: PyPI JSON API → PEP 503 simple index

• Reads the package's simple index from PIP_INDEX_URL (set by
  PipAuthenticate@1 to the Azure Artifacts feed in CI). The feed's simple
  index proxies its PyPI upstream live, so it returns the full published
  history.
• Falls back to https://pypi.org/simple only for local runs where
  PIP_INDEX_URL is not set.
• Parses versions from distribution filenames with an anchored regex rather than
  consuming a JSON payload. Removes the json import.

Credential handling (feed auth)

• The feed requires authentication. The credential embedded in PIP_INDEX_URL
  is moved out of the URL and into a Basic Authorization header (urllib does
  not use URL userinfo directly).
• All logging and error messages use a sanitized URL with the userinfo
  stripped, so the token is never printed.

Version parsing

• Anchored regex (azure[-_]quantum-<version> + archive/wheel-tag boundary)
  captures only this package's own versions and never a version-like token
  appearing elsewhere on the index page.
• Unexpected formats (legacy 4-part like 0.11.2004.2825, or alpha/beta like
  ...b1) are skipped, not truncated into fabricated 3-part versions.
• Explicit PEP 440 ordering via _version_sort_key for the supported subset
  (major.minor.patch optionally .devN / .rcN), where dev < rc < final.

Error handling

• HTTPError (non-2xx responses) and URLError (connection problems) from
  urlopen are caught and re-raised as a RuntimeError with the sanitized URL
  and the status/reason, for a clear and consistent failure message.

Safety guards (fail loud, never publish a wrong number)

• Empty-list guard: raises if the index returns no versions, instead of
  silently computing a low version that would collide with an existing release.
• Existing-version guard: raises if the computed version already exists in
  the published list, to avoid republishing an existing version.

Diagnostics

• Prints the index host, the count of versions retrieved, and the
  most recent version, to make it easy to confirm the index returned a sane
  published history.

Tests

test_set_version.py adds coverage (8 tests total, all passing):

• Regex matches wheels/sdists/.zip, name normalization, and .dev/.rc.
• Regex skips unsupported filenames (4-part, b1, other packages, download
  paths).
• Version sort orders pre-releases before finals with correct numeric ordering.
• Sort key rejects unsupported segments.
• get_build_version sorts before selecting; empty list and already-existing
  computed version each raise RuntimeError.

Verification

• python -m pytest test_set_version.py -q → 8 passed.
• Live end-to-end get_build_version("patch", "dev") returns the expected next
  version from the full published history.
• Confirmed in-pipeline that the feed (not PyPI) is contacted and the full
  version list is returned under the enforced network-isolation policy.

Notes for reviewers

• CI wiring (PipAuthenticate@1, PIP_INDEX_URL, network-isolation settings)
  is already in place from the prior isolation-policy merge; no YAML changes are
  included here.
• Local runs still use the public PyPI simple index anonymously, so the script
  works without feed credentials during development.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[ScottCarda-MS]

/azp run

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[Copilot]

Pull request overview

Updates set_version.py to derive the next package version from a PEP 503 “simple” index (preferring PIP_INDEX_URL for CI/Azure Artifacts) instead of calling the PyPI JSON API, and adds sorting/guards to make version selection more robust.

Changes:

• Switch version discovery from PyPI JSON (/pypi/<pkg>/json) to parsing a PEP 503 simple index page, with support for basic-auth embedded in PIP_INDEX_URL.
• Add a custom version sort key for major.minor.patch[.devN|.rcN] and additional guards (empty index / duplicate computed version).
• Add diagnostic logging about the selected index host and retrieved versions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[ScottCarda-MS]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).