fix(drone): use AUTH_URL and private index in quality gate

.drone.yml

@@ -1,21 +1,3 @@
-# Drone standard — Type A: PyPI package
-#
-# Canonical pipeline for internal Python libraries that ship a wheel/sdist to
-# the private index (dagpipe, doc-forge, hexa, mail-intake, mongo-ops,
-# omniread, openapi-first, py-jwt).
-#
-# Two pipelines ship together:
-#   build-and-publish-pypi   — tag-triggered build + quality gate + publish.
-#   backfill-pypi-from-tags  — custom-triggered replay of every git tag that is
-#                              missing from the index (disaster recovery).
-#
-# Secrets (Drone): PIP_REPO_URL, PIP_USERNAME, PIP_PASSWORD.
-# Copy to <repo>/.drone.yml unchanged; the package name and version are read
-# from pyproject.toml, so no per-repo edits are required.
-#
-# Version guard: the tag build fails unless the git tag equals the version in
-# pyproject.toml (see the versioning standard). This stops a tag from looking
-# like a release while silently publishing nothing.
 ---
 kind: pipeline
 type: docker
@@ -67,8 +49,12 @@ steps:
     commands:
       - pip install --upgrade pip build
       - |
-        AUTH_URL="https://${PIP_USERNAME}:${PIP_PASSWORD}@$(echo "${PIP_REPO_URL#*://}" | sed 's:/*$::')/simple"
-        pip install --index-url "$AUTH_URL" --extra-index-url https://pypi.org/simple/ -U ".[dev]" "pydoclint>=0.9.1"
+        if [ -z "$PIP_REPO_URL" ] || [ -z "$PIP_USERNAME" ] || [ -z "$PIP_PASSWORD" ]; then
+          echo "PIP_REPO_URL / PIP_USERNAME / PIP_PASSWORD are not set" >&2
+          exit 1
+        fi
+      - AUTH_URL="https://$PIP_USERNAME:$PIP_PASSWORD@$(echo "$PIP_REPO_URL" | sed -E 's|^[a-zA-Z]+://||; s|/*$||')/simple"
+      - pip install --index-url "$AUTH_URL" --extra-index-url https://pypi.org/simple/ -U ".[dev]" "pydoclint>=0.9.1"
       - echo "Running quality gate..."
       - python -m black --check .
       - python -m ruff check .