fix(uv): allow environment setting for the update action

.agents/skills/buildkite-get-results/scripts/get_buildkite_results.py

@@ -94,24 +94,32 @@ def fetch_buildkite_data(build_url):
 
 
 def download_log(job_url, output_path):
-    # Construct raw log URL: job_url + "/raw" (Buildkite convention)
-    # job_url e.g. https://buildkite.com/org/pipeline/builds/14394#job-id
-    # Wait, the job['path'] gives /org/pipeline/builds/14394#job-id
-    # We want /org/pipeline/builds/14394/jobs/job-id/raw? No
-    # The clean URL for a job is https://buildkite.com/org/pipeline/builds/14394/jobs/job-id
-    # And raw log is https://buildkite.com/org/pipeline/builds/14394/jobs/job-id/raw
-
-    # We have full_url e.g. https://buildkite.com/bazel/rules-python-python/builds/14394#019c5cf9-e3cf-468f-a7b1-8f9f5ad4b08c
-    # We need to transform it.
+    # job_url looks like:
+    # https://buildkite.com/bazel/rules-python-python/builds/15594#019e879b-...
+    # We need to transform it to:
+    # https://buildkite.com/organizations/bazel/pipelines/rules-python-python/builds/15594/jobs/{job_id}/download.txt
 
     if "#" in job_url:
         base, job_id = job_url.split("#")
-        # Ensure base doesn't end with /
-        if base.endswith("/"):
-            base = base[:-1]
-
-        # Build raw URL
-        raw_url = f"{base}/jobs/{job_id}/raw"
+        base = base.rstrip("/")
+
+        # Parse the path segments: https://buildkite.com/org/pipeline/builds/N
+        # Rebuild with the /organizations/org/pipelines/pipeline/ format which
+        # supports the /jobs/{id}/download.txt log URL without auth.
+        parts = base.split("/")
+        # parts = ["https:", "", "buildkite.com", "org", "pipeline", "builds", "N"]
+        if len(parts) >= 7 and parts[2] == "buildkite.com":
+            org = parts[3]
+            pipeline = parts[4]
+            build_num = parts[6] if len(parts) >= 7 else ""
+            raw_url = (
+                f"https://buildkite.com/organizations/{org}"
+                f"/pipelines/{pipeline}"
+                f"/builds/{build_num}"
+                f"/jobs/{job_id}/download.txt"
+            )
+        else:
+            raw_url = f"{base}/jobs/{job_id}/download.txt"
     else:
         print(f"Could not parse job URL for download: {job_url}", file=sys.stderr)
         return False

.bazelci/presubmit.yml

@@ -140,7 +140,6 @@ tasks:
     test_targets:
       - "//..."
 
-  # Keep in sync with .bcr/gazelle/presubmit.yml
   gazelle_bcr_ubuntu:
     <<: *gazelle_common_bcr
     name: "Gazelle: BCR, Bazel {bazel}"
@@ -203,7 +202,6 @@ tasks:
     <<: *common_workspace_flags_min_bazel
     name: "Default: Ubuntu, workspace, minimum Bazel"
     platform: ubuntu2204
-
   ubuntu_min_bzlmod:
     <<: *minimum_supported_version
     <<: *reusable_config
@@ -220,16 +218,13 @@ tasks:
     name: "Default: Ubuntu, upcoming Bazel"
     platform: ubuntu2204
     bazel: last_rc
-    # This is an advisory job; doesn't block merges
-    # RCs may have regressions, so don't fail our CI on them
     soft_fail:
       - exit_status: 1
       - exit_status: 3
   ubuntu_rolling:
     name: "Default: Ubuntu, rolling Bazel"
     platform: ubuntu2204
     bazel: rolling
-    # This is an advisory job; doesn't block merges
     soft_fail:
       - exit_status: 1
       - exit_status: 3
@@ -299,25 +294,14 @@ tasks:
     platform: rbe_ubuntu2404
     build_flags:
       - "--experimental_repository_cache_hardlinks=false"
-      # BazelCI sets --action_env=BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1,
-      # which prevents cc toolchain autodetection from working correctly
-      # on Bazel 5.4 and earlier. To workaround this, manually specify the
-      # build kite cc toolchain.
       - "--extra_toolchains=@buildkite_config//config:cc-toolchain"
-      - "--build_tag_filters=-docs"
     test_flags:
       - "--test_tag_filters=-integration-test,-acceptance-test,-docs"
-      # BazelCI sets --action_env=BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1,
-      # which prevents cc toolchain autodetection from working correctly
-      # on Bazel 5.4 and earlier. To workaround this, manually specify the
-      # build kite cc toolchain.
       - "--extra_toolchains=@buildkite_config//config:cc-toolchain"
   rbe:
     <<: *reusable_config
     name: "RBE: Ubuntu"
     platform: rbe_ubuntu2404
-    # TODO @aignas 2024-12-11: get the RBE working in CI for bazel 8.0
-    # See https://github.com/bazelbuild/rules_python/issues/2499
     bazel: 8.x
     test_flags:
       - "--test_tag_filters=-integration-test,-acceptance-test"
@@ -465,9 +449,6 @@ tasks:
     <<: *common_bazelinbazel_config
     name: "tests/integration bazel-in-bazel: Debian"
     platform: debian11
-  # The bazelinbazel tests were disabled on Mac to save CI jobs slots, and
-  # have bitrotted a bit. For now, just run a subset of what we're most
-  # interested in.
   integration_test_bazelinbazel_macos:
     <<: *common_bazelinbazel_config
     name: "tests/integration bazel-in-bazel: macOS (subset)"
@@ -490,14 +471,10 @@ tasks:
     working_directory: tests/integration/compile_pip_requirements
     platform: ubuntu2204
     shell_commands:
-    # Make a change to the locked requirements and then assert that //:requirements.update does the
-    # right thing.
     - "echo '' > requirements_lock.txt"
     - "! git diff --exit-code"
     - "bazel run //:requirements.update"
     - "git diff --exit-code"
-    # Make a change to the locked requirements and then assert that //:os_specific_requirements.update does the
-    # right thing.
     - "echo '' > requirements_lock_linux.txt"
     - "! git diff --exit-code"
     - "bazel run //:os_specific_requirements.update"
@@ -508,14 +485,10 @@ tasks:
     working_directory: tests/integration/compile_pip_requirements
     platform: debian11
     shell_commands:
-    # Make a change to the locked requirements and then assert that //:requirements.update does the
-    # right thing.
     - "echo '' > requirements_lock.txt"
     - "! git diff --exit-code"
     - "bazel run //:requirements.update"
     - "git diff --exit-code"
-    # Make a change to the locked requirements and then assert that //:os_specific_requirements.update does the
-    # right thing.
     - "echo '' > requirements_lock_linux.txt"
     - "! git diff --exit-code"
     - "bazel run //:os_specific_requirements.update"
@@ -526,14 +499,10 @@ tasks:
     working_directory: tests/integration/compile_pip_requirements
     platform: macos_arm64
     shell_commands:
-    # Make a change to the locked requirements and then assert that //:requirements.update does the
-    # right thing.
     - "echo '' > requirements_lock.txt"
     - "! git diff --exit-code"
     - "bazel run //:requirements.update"
     - "git diff --exit-code"
-    # Make a change to the locked requirements and then assert that //:os_specific_requirements.update does the
-    # right thing.
     - "echo '' > requirements_lock_darwin.txt"
     - "! git diff --exit-code"
     - "bazel run //:os_specific_requirements.update"
@@ -564,7 +533,6 @@ tasks:
     working_directory: tests/integration/compile_pip_requirements_test_from_external_repo
     platform: ubuntu2204
     shell_commands:
-    # Assert that @compile_pip_requirements//:requirements_test does the right thing.
     - "bazel test @compile_pip_requirements//..."
   integration_compile_pip_requirements_test_from_external_repo_ubuntu_min_bzlmod:
     <<: *minimum_supported_version
@@ -573,28 +541,24 @@ tasks:
     platform: ubuntu2204
     bazel: 7.x
     shell_commands:
-    # Assert that @compile_pip_requirements//:requirements_test does the right thing.
     - "bazel test @compile_pip_requirements//..."
   integration_compile_pip_requirements_test_from_external_repo_ubuntu:
     name: "compile_pip_requirements_test_from_external_repo: Ubuntu"
     working_directory: tests/integration/compile_pip_requirements_test_from_external_repo
     platform: ubuntu2204
     shell_commands:
-    # Assert that @compile_pip_requirements//:requirements_test does the right thing.
     - "bazel test @compile_pip_requirements//..."
   integration_compile_pip_requirements_test_from_external_repo_debian:
     name: "compile_pip_requirements_test_from_external_repo: Debian"
     working_directory: tests/integration/compile_pip_requirements_test_from_external_repo
     platform: debian11
     shell_commands:
-    # Assert that @compile_pip_requirements//:requirements_test does the right thing.
     - "bazel test @compile_pip_requirements//..."
   integration_compile_pip_requirements_test_from_external_repo_macos:
     name: "compile_pip_requirements_test_from_external_repo: macOS"
     working_directory: tests/integration/compile_pip_requirements_test_from_external_repo
     platform: macos_arm64
     shell_commands:
-    # Assert that @compile_pip_requirements//:requirements_test does the right thing.
     - "bazel test @compile_pip_requirements//..."
   integration_compile_pip_requirements_test_from_external_repo_windows:
     name: "compile_pip_requirements_test_from_external_repo: Windows"

.bazelignore

@@ -35,3 +35,4 @@ tests/integration/compile_pip_requirements/bazel-compile_pip_requirements
 tests/integration/local_toolchains/bazel-local_toolchains
 tests/integration/py_cc_toolchain_registered/bazel-py_cc_toolchain_registered
 tests/integration/toolchain_target_settings/bazel-module_under_test
+tests/integration/uv_lock/bazel-uv_lock

.bazelrc.deleted_packages

@@ -39,6 +39,7 @@ common --deleted_packages=tests/integration/pip_parse/empty
 common --deleted_packages=tests/integration/pip_parse_isolated
 common --deleted_packages=tests/integration/py_cc_toolchain_registered
 common --deleted_packages=tests/integration/toolchain_target_settings
+common --deleted_packages=tests/integration/uv_lock
 common --deleted_packages=tests/modules/another_module
 common --deleted_packages=tests/modules/other
 common --deleted_packages=tests/modules/other/nspkg_delta

.gitattributes

@@ -1,2 +1,3 @@
 python/features.bzl export-subst
 tools/publish/*.txt linguist-generated=true
+tests/uv/lock/testdata/requirements.txt text eol=lf

.gitignore

@@ -54,3 +54,7 @@ user.bazelrc
 # MODULE.bazel.lock is ignored for now as per recommendation from upstream.
 # See https://github.com/bazelbuild/bazel/issues/20369
 MODULE.bazel.lock
+
+# Buildkite logs
+*Windows*.log
+

CHANGELOG.md

@@ -119,6 +119,9 @@ END_UNRELEASED_TEMPLATE
 * (pypi) `package_metadata` support, fixes 
   [#2054](https://github.com/bazel-contrib/rules_python/issues/2054).
 * (coverage) Add support for python 3.14 and bump `coverage.py` to 7.10.7.
+* (uv) allow user overwrite the build environment using `--action_env` to allow
+  setting authentication for the index URL.
+  ([#3045](https://github.com/bazel-contrib/rules_python/issues/3405))
 
 {#v2-0-2}
 ## [2.0.2] - 2026-05-14

python/uv/private/lock.bat

@@ -1,7 +1,7 @@
-if defined BUILD_WORKSPACE_DIRECTORY (
-    set "out=%BUILD_WORKSPACE_DIRECTORY%\{{src_out}}"
-) else (
-    exit /b 1
-)
-
-"{{args}}" --output-file "%out%" %*
+if defined BUILD_WORKSPACE_DIRECTORY (
+    set "out=%BUILD_WORKSPACE_DIRECTORY%\{{src_out}}"
+) else (
+    exit /b 1
+)
+
+"{{args}}" --output-file "%out%" %*

python/uv/private/lock.bzl

@@ -117,31 +117,96 @@ def _lock_impl(ctx):
     args.run_shell.add("--no-progress")
     args.run_shell.add("--quiet")
 
+    # Generate a wrapper script that copies the existing output (if any) and
+    # then runs uv. On POSIX, args are forwarded via exec "$@". On Windows,
+    # the full command line is embedded in the .bat file with backslash paths
+    # (CMD doesn't recognize forward slashes in executable paths).
+    if ctx.attr.is_windows:
+        ext = ".bat"
+        lines = ["@echo off"]
+    else:
+        ext = ".sh"
+        lines = ["#!/usr/bin/env bash", "set -euo pipefail"]
+
+    python_path = getattr(python, "path", python)
+
     if ctx.files.existing_output:
-        command = '{python} -c {python_cmd} && "$@"'.format(
-            python = getattr(python, "path", python),
-            python_cmd = shell.quote(
-                "from shutil import copy; copy(\"{src}\", \"{dst}\")".format(
+        python_cmd = "from shutil import copy; copy(\"{src}\", \"{dst}\")".format(
+            src = ctx.files.existing_output[0].path,
+            dst = output.path,
+        )
+        if ctx.attr.is_windows:
+            # In batch files, use "" to escape internal double quotes.
+            lines.append(
+                "\"{py}\" -c \"from shutil import copy; copy(\"\"{src}\"\", \"\"{dst}\"\")\"".format(
+                    py = python_path,
                     src = ctx.files.existing_output[0].path,
                     dst = output.path,
                 ),
+            )
+        else:
+            lines.append("{py} -c '{cmd}'".format(
+                py = python_path,
+                cmd = python_cmd,
+            ))
+
+    if ctx.attr.is_windows:
+        # Build the command line with backslash paths for CMD.
+        # args.run_info has most args; add the output/progress/quiet
+        # args that were only added directly to args.run_shell.
+        def _quote(arg):
+            if hasattr(arg, "path"):
+                arg = arg.path.replace("/", "\\")
+            else:
+                arg = str(arg)
+            return '"' + arg.replace('"', '""') + '"'
+
+        bat_args = args.run_info + [
+            "--output-file",
+            output,
+            "--no-progress",
+            "--quiet",
+        ]
+        lines.append(" ".join([_quote(a) for a in bat_args]))
+
+        # Normalize CRLF line endings in the output on Windows.
+        lines.append(
+            "\"{py}\" -c \"import pathlib;p=pathlib.Path(r\"\"{dst}\"\");p.write_bytes(p.read_bytes().replace(b'\\r\\n', b'\\n'))\"".format(
+                py = python_path,
+                dst = output.path,
             ),
         )
     else:
-        command = '"$@"'
+        lines.append('exec "$@"')
+
+    script = ctx.actions.declare_file(ctx.label.name + "_lock" + ext)
+    if ctx.attr.is_windows:
+        content = "\r\n".join(lines) + "\r\n"
+    else:
+        content = "\n".join(lines) + "\n"
+    ctx.actions.write(output = script, content = content, is_executable = True)
 
     srcs = srcs + ctx.files.build_constraints + ctx.files.constraints
 
-    ctx.actions.run_shell(
-        command = command,
+    ctx.actions.run(
+        executable = script,
         inputs = srcs + ctx.files.existing_output,
         mnemonic = "PyRequirementsLockUv",
         outputs = [output],
-        arguments = [args.run_shell],
+        # On Windows, the command line is embedded directly in the .bat
+        # script (with backslash paths). On POSIX, args are forwarded via
+        # exec "$@" in the .sh script.
+        arguments = [args.run_shell] if not ctx.attr.is_windows else [],
         tools = [
             uv,
             python_files,
+            script,
         ],
+        # User reported being unable to add `--action_env` and get it to work.
+        # Without this flag.
+        #
+        # Ref: https://app.slack.com/client/TA4K1KQ87/CA306CEV6
+        use_default_shell_env = True,
         progress_message = "Creating a requirements.txt with uv: %{label}",
         env = ctx.attr.env,
     )
@@ -205,6 +270,7 @@ modifications and the locking is not done from scratch.
             doc = "Public, see the docs in the macro.",
             default = True,
         ),
+        "is_windows": attr.bool(mandatory = True),
         "output": attr.string(
             doc = "Public, see the docs in the macro.",
             mandatory = True,
@@ -241,7 +307,7 @@ The string to input for the 'uv pip compile'.
 def _lock_run_impl(ctx):
     if ctx.attr.is_windows:
         path_sep = "\\"
-        ext = ".exe"
+        ext = ".bat"
     else:
         path_sep = "/"
         ext = ""
@@ -250,7 +316,12 @@ def _lock_run_impl(ctx):
         if hasattr(arg, "short_path"):
             arg = arg.short_path
 
-        return shell.quote(arg.replace("/", path_sep))
+        arg = arg.replace("/", path_sep)
+        if ctx.attr.is_windows:
+            # On Windows, CMD uses double quotes for quoting, and internal
+            # double quotes are escaped by doubling them.
+            return '"' + arg.replace('"', '""') + '"'
+        return shell.quote(arg)
 
     info = ctx.attr.lock[_RunLockInfo]
     executable = ctx.actions.declare_file(ctx.label.name + ext)
@@ -438,6 +509,10 @@ def lock(
         env = env,
         existing_output = maybe_out,
         generate_hashes = generate_hashes,
+        is_windows = select({
+            "@platforms//os:windows": True,
+            "//conditions:default": False,
+        }),
         python_version = python_version,
         srcs = srcs,
         strip_extras = strip_extras,