🐛 fix(pip): set PIP_USER=0 to prevent --user installs in virtualenvs

When users have pip configured globally to install packages with --user
(via pip config --user), pip attempts to use this inside tox virtualenvs
where user site-packages aren't visible, causing installation failures.

This was fixed in tox 3 but the patch was lost during the tox 4 rewrite.

Fixes #3010

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: gaborbernat

docs/changelog/3010.bugfix.rst

@@ -0,0 +1,2 @@
+Set ``PIP_USER=0`` environment variable when running pip commands in virtualenvs to prevent pip from attempting
+``--user`` installs when users have ``pip config --user`` configured globally — by :user:`gaborbernat`.

pyproject.toml

@@ -57,8 +57,8 @@ dependencies = [
   "platformdirs>=4.9.1",
   "pluggy>=1.6",
   "pyproject-api>=1.10",
-  "tomli>=2.4; python_version<'3.11'",
-  "typing-extensions>=4.15; python_version<'3.11'",
+  "tomli>=2.4; python_version < '3.11'",
+  "typing-extensions>=4.15; python_version < '3.11'",
   "virtualenv>=20.36.1",
 ]
 optional-dependencies.completion = [
@@ -96,8 +96,8 @@ test = [
   "pytest-timeout>=2.4",
   "pytest-xdist>=3.8",
   "re-assert>=1.1",
-  "setuptools>=80.10.2",
-  "time-machine>=3.2; implementation_name!='pypy'",
+  "setuptools>=82",
+  "time-machine>=3.2; implementation_name != 'pypy'",
   "wheel>=0.46.3",
 ]
 type = [

src/tox/tox_env/python/virtual_env/api.py

@@ -176,6 +176,7 @@ def runs_on_platform(self) -> str:
     def environment_variables(self) -> dict[str, str]:
         environment_variables = super().environment_variables
         environment_variables["VIRTUAL_ENV"] = str(self.conf["env_dir"])
+        environment_variables["PIP_USER"] = "0"
         return environment_variables
 
     @classmethod

tests/tox_env/python/virtual_env/test_virtualenv_api.py

@@ -172,3 +172,14 @@ def test_list_dependencies_command(tox_project: ToxProjectCreator) -> None:
     result.assert_success()
     request: ExecuteRequest = execute_calls.call_args[0][3]
     assert request.cmd == ["python", "-m", "pip", "freeze"]
+
+
+def test_pip_user_disabled(tox_project: ToxProjectCreator) -> None:
+    ini = (
+        '[testenv]\npackage=skip\ncommands=python -c "import os; print(os.environ.get(\\"PIP_USER\\", \\"NOT_SET\\"))"'
+    )
+    proj = tox_project({"tox.ini": ini})
+    result = proj.run("r", "-e", "py")
+    result.assert_success()
+    assert "0" in result.out
+    assert "NOT_SET" not in result.out