fix: Use purl.bzl for a better api, add module package_metadata by darkrift · Pull Request #4276 · bazel-contrib/rules_python

darkrift · 2026-10-17T03:50:16Z

Following the bazelcon talk on supply chain to track every bytes, this declares the module package metadata and switch to the purl builder which also takes care of encoding the various fields of the purl.

Copilot

🟡 Changes recommended

WORKSPACE compatibility regressions and the outdated integration lockfile need to be fixed.

3 open issues

What changed in this PR

Adds module-wide package metadata to rules_python and uses the PURL builder to encode wheel package URLs correctly.

Changes:

Declares module identity and Apache-2.0 license metadata.
Replaces manual wheel PURL formatting with the builder API.
Upgrades package_metadata and adds the builder dependency.

File	Description
REPO.bazel	Applies package metadata module-wide.
python/private/pypi/patch_and_extract_whl.bzl	Builds wheel PURLs with encoded fields.
python/private/pypi/BUILD.bazel	Declares the PURL library dependency.
MODULE.bazel	Upgrades `package_metadata` to 0.0.13.
BUILD.bazel	Defines module and license metadata.

_{Review effort: Balanced}

+        ":license",
+    ],
+    purl = purl.bazel(
+        module_name(),


    name = normalize_name(metadata.name).replace("_", "-")

-    qualifiers = {}
+    builder = purl.builder().type("pypi").name(name).version(metadata.version)


Copilot

🟡 Changes recommended

Integration fixtures omit the new repository configuration and license file, leaving the metadata defaults untested.

4 open issues

_{Review effort: Balanced}

Copilot

🟢 Approval recommended

Static review found no blocking issues in these focused changes; Bazel tests were not run.

4 open issues

_{Review effort: Balanced}

…builder

aignas

I love the new additions here, but I am concerned that this may break builds for every workspace user. Whilst I don't want this to be always a blocking concern, I'd like to think twice before merging this.

aignas · 2026-10-29T12:45:26Z

 # Everything below this line is used only for developing rules_python. Users
 # should not copy it to their WORKSPACE.

+# REPO.bazel's default_package_metadata makes every package in this repo depend


This is somewhat alarming, that means that WORKSPACE users will face a breaking change.

We could split it in 2 PRs then, update package_metadata for the PURL builder, and another for the rules_python itself package_metadata tagging (which is the one breaking WORKSPACE)

That said, many ruleset has already decided to drop support for Bazel 7 and WORKSPACE altogether.

How long is rules_python expected to keep WORKSPACE support ?

@rickeylev, I think dropping WORKSPACE will happen when the protobuf ruleset drops it? I remember him saying that it is going to be another year?. I personally think that we could do the change separately as a breaking change to WORKSPACE users with migration instructions.

As I said in the main comment, a breaking change to WORKSPACE is not a reason to block this PR merge, but we should have instructions in the CHANGELOG for users to migrate.

If I understood correctly previous change would not have dropped WORKSPACE entirely, right?

Move the REPO.bazel default package metadata and the rules_python package_metadata/license targets out of this change. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

darkrift · 2026-10-29T17:49:47Z

@aignas I removed the change that would drop WORKSPACE support, I'll add it in another PR

Copilot

🟢 Approval recommended

No active review issues are reported for the package URL builder migration and related dependency updates.

2 open issues

2 resolved since last review

_{Review effort: Balanced}

aignas · 2026-10-30T01:01:04Z

+# Loaded by Starlark files (e.g. purl.bzl) that the loads below pull in, so it
+# must be defined before them.


do we still need this comment and change?

Yes, otherwise it still breaks WORKSPACE based tests because of the wrong order of loads

If that is the case it may still be a breaking change, let's bring back the other change that got reverted and just mark this as breaking for workspace users and add a snippet for WORKSPACE user that they would need to unbreak their setups.

WORKSPACE setup is best effort afterall.

darkrift requested review from aignas and rickeylev as code owners October 17, 2026 03:50

Copilot AI balanced review requested due to automatic review settings October 17, 2026 03:50

Copilot started reviewing on behalf of darkrift October 17, 2026 03:50

View session

Copilot AI reviewed Oct 17, 2026

View reviewed changes

darkrift force-pushed the use_purl_builder branch 2 times, most recently from 5c2446a to 687c853 Compare October 17, 2026 12:14

Use purl.bzl for a better api, add module package_metadata

b6111d1

darkrift force-pushed the use_purl_builder branch from 687c853 to b6111d1 Compare October 17, 2026 12:23

darkrift requested a balanced review from Copilot October 17, 2026 12:42

Copilot started reviewing on behalf of darkrift October 17, 2026 12:53

View session

Copilot AI reviewed Oct 17, 2026

View reviewed changes

Comment thread REPO.bazel Resolved

Address copilot review

da86260

darkrift force-pushed the use_purl_builder branch from 5f4cc5d to 9df18b1 Compare October 19, 2026 00:36

fix tests

656063a

darkrift force-pushed the use_purl_builder branch from 9df18b1 to 656063a Compare October 19, 2026 12:43

darkrift requested a balanced review from Copilot October 19, 2026 13:02

Copilot started reviewing on behalf of darkrift October 19, 2026 13:02

View session

Copilot AI reviewed Oct 19, 2026

View reviewed changes

darkrift added 3 commits October 19, 2026 18:12

Merge branch 'main' into use_purl_builder

8cac3e5

Merge upstream/main into use_purl_builder

305de36

Merge remote-tracking branch 'origin/use_purl_builder' into use_purl_…

6e685d3

…builder

aignas reviewed Oct 29, 2026

View reviewed changes

darkrift and others added 3 commits October 29, 2026 13:37

Limit PR to package_metadata bump and purl builder

2dc9eee

Move the REPO.bazel default package metadata and the rules_python package_metadata/license targets out of this change. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Merge upstream/main into use_purl_builder

e6b274c

fix(workspace): define package_metadata before loads that need purl.bzl

56995fe

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

darkrift requested a balanced review from Copilot October 29, 2026 17:46

Copilot started reviewing on behalf of darkrift October 29, 2026 17:46

View session

Copilot AI reviewed Oct 29, 2026

View reviewed changes

aignas reviewed Oct 30, 2026

View reviewed changes

		# Loaded by Starlark files (e.g. purl.bzl) that the loads below pull in, so it
		# must be defined before them.

Conversation

darkrift commented Oct 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

aignas left a comment

Choose a reason for hiding this comment

Uh oh!

aignas Oct 29, 2026

Choose a reason for hiding this comment

Uh oh!

darkrift Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

darkrift Oct 29, 2026

Choose a reason for hiding this comment

Uh oh!

aignas Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

darkrift commented Oct 29, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

aignas Oct 30, 2026

Choose a reason for hiding this comment

Uh oh!

darkrift Oct 30, 2026

Choose a reason for hiding this comment

Uh oh!

aignas Oct 30, 2026

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

darkrift commented Oct 17, 2026 •

edited

Loading

darkrift Oct 29, 2026 •

edited

Loading

aignas Oct 30, 2026 •

edited

Loading