fix(build): configure Docker pip mirrors with locked fallback [skip ci]

scripts/ci-install.py

@@ -70,12 +70,15 @@ def diagnostics():
 
 
 def main():
+    locked = "--locked" in sys.argv[1:]
+    prefix = "DOCKER" if locked else "CI"
+    label = "Docker build" if locked else "CI Job"
     diagnostics()
     indexes = list(
         dict.fromkeys(
             [
-                os.getenv("CI_PIP_INDEX_URL") or PRIMARY,
-                os.getenv("CI_PIP_FALLBACK_INDEX_URL") or FALLBACK,
+                os.getenv(f"{prefix}_PIP_INDEX_URL") or PRIMARY,
+                os.getenv(f"{prefix}_PIP_FALLBACK_INDEX_URL") or FALLBACK,
             ]
         )
     )
@@ -84,7 +87,7 @@ def main():
         if parsed.scheme != "https" or not parsed.hostname:
             raise SystemExit("CI pip indexes must be valid HTTPS URLs")
     for index in indexes:
-        print("Effective CI Job pip index host:", host(index), flush=True)
+        print(f"Effective {label} pip index host:", host(index), flush=True)
         result = subprocess.run(
             [
                 sys.executable,
@@ -99,8 +102,7 @@ def main():
                 "30",
                 "--index-url",
                 index,
-                "-e",
-                ".[test]",
+                *(["-r", "requirements.lock"] if locked else ["-e", ".[test]"]),
             ],
             env=install_env(index),
             stdout=subprocess.PIPE,

scripts/production-deploy.py

@@ -364,6 +364,12 @@ class Deploy:
         command = ["build", "--pull", "-t", image]
         now = datetime.now(UTC).isoformat()
         for key, value in {
+            "DOCKER_PIP_INDEX_URL": self.env.get("DOCKER_PIP_INDEX_URL")
+            or "https://mirrors.tuna.tsinghua.edu.cn/pypi/web/simple",
+            "DOCKER_PIP_FALLBACK_INDEX_URL": self.env.get(
+                "DOCKER_PIP_FALLBACK_INDEX_URL"
+            )
+            or "https://pypi.org/simple",
             "DEBIAN_MIRROR": self.env.get("DEBIAN_MIRROR") or "deb.debian.org",
             "DEBIAN_SECURITY_MIRROR": self.env.get("DEBIAN_SECURITY_MIRROR")
             or "deb.debian.org",