How to resolve a variable that has a dependency

[waterworthd-cim]

I have a python project that uses uv and we use aws codeartifact as a private pypi repository. In my pyproject.toml I have an entry that sets the codeartifact repo, i.e.

[[tool.uv.index]]
name = "{name}"
url = "https:{domain}-{account_id}.d.codeartifact.{region}.amazonaws.com/pypi/{name}/simple/"

A side-effect of this is any use of uvx to run other build tools requires codeartifact authentication.

I'm trying to build a docker image tagged with the current project version

# need to export TASK_X_ENV_PRECEDENCE=1
dotenv:
  - '.env.codeartifact' # generated by codeartifact:login
 
tasks:
  build:
    desc: builds dockerfile
    vars:
      DOCKER_BUILD_OPTIONS: "--build-arg UV_INDEX_URL=${UV_INDEX_URL}"
      DOCKER_COMPOSE_FILE: 'docker/docker-compose.yml'
      DOCKER_TAG: 
        sh: uvx --from commitizen cz version -p
    deps:
      - codeartifact:login
      - uv:lock
    cmds:
      - task DOCKER_COMPOSE_FILE={{.DOCKER_COMPOSE_FILE}} docker:build DOCKER_BUILD_OPTIONS="{{.DOCKER_BUILD_OPTIONS}}" DOCKER_TAG={{.DOCKER_TAG}}

Here codeartifact:login is an imported taskfile that auth's with codeartifact and updates a .env file with the various vars required.

My issue is because I'm using DOCKER_TAG: sh: uvx --from commitizen cz version -p appears to execute before deps but it's dependent on codeartifact:login

A secondary issue is I have various other imported taskfiles (commitizen, pre-commit etc) and in each I've used uvx to invoke the tool. But then in each of these I have to import my codeartifact taskfile again (as internal) and make each imported task also depend on codeartifact:login - so it gets called multiple times

I have two questions:

How can I set {{.DOCKER_TAG}} by running uvx --from commitizen cz version -p such that I can ensure codeartifact:login has been run first?

Can I set codeartifact:login to be some sort of global dependency that's always run before any task is excecuted and any variable resolved?

Finally is there a better/canonical approach to this issue?

(what I really wanted to do is create a cz:version task that's depended on codeartifact:login that executes uvx --from commitizen cz version -p and "returns" the output to {{.DOCKER_TAG}} but taskfile doesn't appear to work that way