chore: drop unreferenced NVIDIA package indexes

[zywind]

Summary

Removes two [[indexes]] entries from cuda_deps.toml (and the regenerated
pyproject.toml block) that the resolver cannot reach:

• nv-shared-pypi-local -> https://urm.nvidia.com/artifactory/api/pypi/nv-shared-pypi-local/simple
• nvidia-pypi-public -> https://pypi.nvidia.com

Both have been declared since the initial commit, carried over when the project
moved off NVIDIA's internal GitLab, and copied verbatim into cuda_deps.toml
by #655.

Why they are inert

Both are explicit = true, which in uv means the index is consulted only for
packages that name it in [tool.uv.sources]. No package names either one:

index -> packages bound via [tool.uv.sources]
  pytorch-cu129                ['-', 'cu129']
  flashinfer-jit-cache-cu129   ['cu129']
  pytorch-cpu                  ['cpu']
  nv-shared-pypi-local         NOT IN SOURCES
  nvidia-pypi-public           NOT IN SOURCES
  flashinfer-cubin             ['cpu', 'cu129']
  vllm-v0-26-0-cu129           ['cu129']

Every nvidia-* package in the lock resolves from PyPI or
download.pytorch.org instead.

This does not stop pypi.nvidia.com being used

Worth stating explicitly, since it looks contradictory in the lock:
nvidia-cublas-cu12 is resolved from the PyTorch cu129 index but its wheels are
hosted on pypi.nvidia.com — PyTorch's index links to NVIDIA's host rather
than rehosting the artifacts.

[[package]]
name = "nvidia-cublas-cu12"
source = { registry = "https://download.pytorch.org/whl/cu129" }
wheels = [
    { url = "https://pypi.nvidia.com/nvidia-cublas-cu12/..." },
]

That download follows the URL recorded in uv.lock and is unaffected by
whether the index is declared here.

Verification

Regenerating and relocking leaves uv.lock byte-identical across all 356
packages — the strongest available evidence that neither index participated in
resolution:

$ python tools/gen_cuda_deps.py cuda_deps.toml --pyproject pyproject.toml
$ uv lock
Resolved 356 packages in 2ms
$ git diff --quiet uv.lock && echo "byte-identical"
byte-identical

• mise run lock-check passes
• mise run format-check passes
• pytest tests/test_gen_cuda_deps.py -- 19 passed

Notes for reviewers

Two places still mention these names; neither is affected, but flagging so a
grep does not cause confusion:

• CONTRIBUTING.md:870 documents that the internal NMP service pulls
  nemo-safe-synthesizer from nv-shared-pypi-local. That is about how NMP
  consumes this package, not how this project resolves its own dependencies, so
  it is unaffected.
• tests/test_gen_cuda_deps.py uses nvidia-pypi-public in inline fixture data
  to exercise the generator's index = binding support. The generator still
  supports it; the real config just does not use it. If binding
  nvidia-cublas to that index was intended at some point, that would be a
  deliberate change (re-adding index = "nvidia-pypi-public" to the cublas
  entry) rather than a reason to keep an orphaned declaration.

Pre-Review Checklist

• mise run format && mise run check
• mise run test passes locally (targeted: tests/test_gen_cuda_deps.py)

Other Notes

Config-only change. No dependency versions change and uv.lock is untouched.

Summary by CodeRabbit

• Chores
  • Updated package installation configuration by removing two obsolete package sources.
  • Existing package indexes and CUDA-related configuration remain unchanged.
  • No user-facing functionality or public APIs were changed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: fdacfde5-fd17-4721-8a31-ce380f2f2f10

📥 Commits

Reviewing files that changed from the base of the PR and between d806aaf and 91f8ada.

📒 Files selected for processing (2)

• cuda_deps.toml
• pyproject.toml

💤 Files with no reviewable changes (2)

• pyproject.toml
• cuda_deps.toml

📜 Recent review details

⏰ Context from checks skipped due to timeout. (1)

• GitHub Check: Greptile Review

---

Walkthrough

The change removes two explicit CUDA package indexes from cuda_deps.toml and pyproject.toml. Remaining package indexes and CUDA source configuration are unchanged.

Changes

CUDA package index cleanup

Layer / File(s)	Summary
Remove explicit package indexes cuda_deps.toml, pyproject.toml	Removed the nv-shared-pypi-local and nvidia-pypi-public index definitions from both dependency configurations.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• NVIDIA-NeMo/Safe-Synthesizer#655: Modifies the dependency metadata in the same two configuration files.

Suggested labels: chore

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the removal of unreferenced NVIDIA package indexes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch yunfeng/remove-unused-nvidia-indexes

---

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

Removes two unused explicit NVIDIA package indexes from the CUDA dependency source configuration and its generated pyproject.toml block.

• Removes nv-shared-pypi-local and nvidia-pypi-public.
• Keeps the source configuration and generated project metadata synchronized.
• Does not alter dependency versions or lockfile resolution.

Confidence Score: 5/5

The PR appears safe to merge with no actionable correctness, security, or dependency-resolution issues identified.

The removed explicit indexes have no active source bindings, and the authoritative CUDA configuration remains synchronized with the generated project metadata.

Important Files Changed

Filename	Overview
cuda_deps.toml	Removes two explicit indexes that have no active package source bindings.
pyproject.toml	Mirrors the source configuration change in the generated uv index block.

_{Reviews (1): Last reviewed commit: "chore: drop unreferenced NVIDIA package ..." | Re-trigger Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!