[bazel] Use hermetic Python

[kon72]

This change removes the dependency on system Python.

Also fixes an issue where the build fails on Windows with --incompatible_strict_action_env flag specified:

'py' is not recognized as an internal or external command,
operable program or batch file.

[sbc100]

Nice!

[walkingeyerobot]

Thanks very much!

[walkingeyerobot]

This change looks good, but it looks like the test failures are real. The Linux one is complaining because the user is root and the new python is insisting it shouldn't be run as root; this might just be a configuration issue? The Windows one is complaining about actual dependency failures. These need to be addressed before we can merge. I can take a closer look later this week if needed.

[kalmard0]

Would changing the CI user to non-root be an acceptable solution here?

[walkingeyerobot]

I'm not terribly familiar with the inner workings of the CI, but it sounds ok to me? I don't expect many folks are running bazel as root in the real world. @sbc100 @trybka do you have any concerns here?

[allsey87]

@kon72 @kalmard0 was there an attempt to just use the Python interpreter directly instead of defining EMSDK_PYTHON and using the existing scripts? I think this could be done via py_binary and then passed as the tool argument (instead of path) for clang_tool etc in toolchain.bzl.

This way we could remove all the sh and bat scripts and a bunch of logic for switching between the two depending on the OS.

[allsey87]

Would changing the CI user to non-root be an acceptable solution here?

I'm not terribly familiar with the inner workings of the CI, but it sounds ok to me? I don't expect many folks are running bazel as root in the real world. @sbc100 @trybka do you have any concerns here?

@kalmard0 @walkingeyerobot the reason why the non-arm version of CircleCI appears to be due to the ubuntu executor using a Docker image on the CircleCI instance. I would suggest changing this back to a standard Ubuntu image unless there is a well-known reason for using Docker here.

Moreover, the windows test is probably failing since it is pinned at quite an old version of Bazel which is probably not compatible with the python_rules version that we are using in this PR.

[walkingeyerobot]

If you wanted to send a PR that updates the bazel version, I'd be happy to accept it. The ubuntu image thing would be more of a question for @sbc100 I think.

[allsey87]

If you wanted to send a PR that updates the bazel version, I'd be happy to accept it. The ubuntu image thing would be more of a question for @sbc100 I think.

I'll put it together tomorrow. Bazel 5.4.0 (used by CircleCI on Windows) is not covered by rules_python's support policy.

@sbc100 @walkingeyerobot could you two decide on what the minimum supported version of Bazel should be for emsdk? This support matrix might help.

[walkingeyerobot]

Let's bump it to bazel 7 then. Seems to be the oldest version that's still under active support.

[logankaser]

Let's bump it to bazel 7 then. Seems to be the oldest version that's still under active support.

Both 6.5.0 and 7.5.0 are supported until Dec 2025: https://bazel.build/release#support-matrix

[phlax]

i was hitting hermetic issues with our emsdk build (envoy)

i patched in this PR and it almost worked - i had to also pass the toolchain binary to the ctx.action and mangle PATH

    py_toolchain = ctx.toolchains["@bazel_tools//tools/python:toolchain_type"]
    python_path = py_toolchain.py3_runtime.interpreter.path
    env = dict(ctx.configuration.default_shell_env)
    env["PATH"] = "%s:/usr/bin:/bin" % python_path.rpartition("/")[0]
    ctx.actions.run(
        inputs = inputs + [py_toolchain.py3_runtime.interpreter],
        outputs = outputs,
        executable = ctx.executable._wasm_binary_extractor,
        arguments = [args],
        env = env,
    )
    
    ...
    
_wasm_cc_binary_legacy = rule(
    implementation = _wasm_cc_binary_legacy_impl,
    attrs = _WASM_BINARY_COMMON_ATTRS,
    outputs = _wasm_binary_legacy_outputs,
    toolchains = ["@bazel_tools//tools/python:toolchain_type"],
)
    

with that it seems to work