feat: Python standalone images from python-build-standalone

.github/workflows/check-ldconfig.yaml

@@ -23,4 +23,4 @@ jobs:
         uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
 
       - name: Check ldconfig caches
-        run: bazel test //python3:check_ldconfig_tests
+        run: bazel test //python3:check_ldconfig_tests //python:check_ldconfig_tests

.github/workflows/update-deb-package-snapshots.yml

@@ -33,7 +33,7 @@ jobs:
 
       - name: Update ldconfig
         if: env.DISTROLESS_DIFF
-        run: bazel run //python3:update_ldconfig
+        run: bazel run //python3:update_ldconfig //python:update_ldconfig
 
       - name: Run update sboms script
         if: env.DISTROLESS_DIFF

.gitignore

@@ -17,4 +17,10 @@
 /output/
 # ignore user bazelrc
 .bazelrc.user
-*.log
+*.log
+# local bazel caches
+.gocache/
+/.gotmp
+
+# rendered image reconstruction (regenerable via bazel)
+/python/Dockerfile

BUILD

@@ -4,11 +4,15 @@ load("//java:config.bzl", "JAVA_ARCHITECTURES", "JAVA_DISTROS", "JAVA_MAJOR_VERS
 load("//nodejs:config.bzl", "NODEJS_ARCHITECTURES", "NODEJS_DISTROS", "NODEJS_MAJOR_VERSIONS")
 load("//private/oci:defs.bzl", "sign_and_push_all")
 load("//private/tools/lifecycle:defs.bzl", "attach_lifecycle_tags")
+load("//python:config.bzl", PBS_PYTHON_ARCHITECTURES = "PYTHON_ARCHITECTURES", PBS_PYTHON_DISTROS = "PYTHON_DISTROS", PBS_PYTHON_MAJOR_VERSIONS = "PYTHON_MAJOR_VERSIONS")
 load("//python3:config.bzl", "PYTHON_ARCHITECTURES", "PYTHON_DISTROS")
 load("//static:config.bzl", "STATIC_ARCHITECTURES", "STATIC_DISTROS")
 
 package(default_visibility = ["//visibility:public"])
 
+# allow updater tests to read MODULE.bazel
+exports_files(["MODULE.bazel"])
+
 DEFAULT_DISTRO = "debian13"
 
 VARIANTS = [
@@ -196,6 +200,39 @@ NODEJS |= {
     for (tag_base, debug_mode, user) in VARIANTS
 }
 
+###############
+# PYTHON (PBS) #
+###############
+PYTHON = {
+    "{REGISTRY}/{PROJECT_ID}/python" + version + "-" + distro + ":" + tag_base + "-" + arch: "//python:python" + version.replace(".", "") + debug_mode + "_" + user + "_" + arch + "_" + distro
+    for version in PBS_PYTHON_MAJOR_VERSIONS
+    for distro in PBS_PYTHON_DISTROS
+    for arch in PBS_PYTHON_ARCHITECTURES[distro][version]
+    for (tag_base, debug_mode, user) in VARIANTS
+}
+
+# oci_image_index
+PYTHON |= {
+    "{REGISTRY}/{PROJECT_ID}/python" + version + "-" + distro + ":" + tag_base: "//python:python" + version.replace(".", "") + debug_mode + "_" + user + "_" + distro
+    for version in PBS_PYTHON_MAJOR_VERSIONS
+    for distro in PBS_PYTHON_DISTROS
+    for (tag_base, debug_mode, user) in VARIANTS
+}
+
+PYTHON |= {
+    "{REGISTRY}/{PROJECT_ID}/python" + version + ":" + tag_base + "-" + arch: "//python:python" + version.replace(".", "") + debug_mode + "_" + user + "_" + arch + "_" + DEFAULT_DISTRO
+    for version in PBS_PYTHON_MAJOR_VERSIONS
+    for arch in PBS_PYTHON_ARCHITECTURES[DEFAULT_DISTRO][version]
+    for (tag_base, debug_mode, user) in VARIANTS
+}
+
+# oci_image_index
+PYTHON |= {
+    "{REGISTRY}/{PROJECT_ID}/python" + version + ":" + tag_base: "//python:python" + version.replace(".", "") + debug_mode + "_" + user + "_" + DEFAULT_DISTRO
+    for version in PBS_PYTHON_MAJOR_VERSIONS
+    for (tag_base, debug_mode, user) in VARIANTS
+}
+
 ###############
 # JAVA_BASE   #
 ###############
@@ -270,6 +307,8 @@ ALL |= PYTHON3
 
 ALL |= NODEJS
 
+ALL |= PYTHON
+
 ALL |= JAVA_BASE
 
 ALL |= JAVA

MODULE.bazel

@@ -50,5 +50,10 @@ node = use_extension("//private/extensions:node.bzl", "node")
 node.archive()
 use_repo(node, "node_versions", "nodejs22_amd64", "nodejs22_arm", "nodejs22_arm64", "nodejs22_ppc64le", "nodejs22_s390x", "nodejs24_amd64", "nodejs24_arm64", "nodejs24_ppc64le", "nodejs24_s390x", "nodejs26_amd64", "nodejs26_arm64", "nodejs26_ppc64le", "nodejs26_s390x")
 
+### PYTHON ###
+py = use_extension("//private/extensions:python.bzl", "python")
+py.archive()
+use_repo(py, "python313_amd64", "python313_arm64", "python313_riscv64", "python313_s390x", "python314_amd64", "python314_arm64", "python314_riscv64", "python314_s390x", "python_versions")
+
 ### DEBIAN ###
 include("//private/repos/deb:deb.MODULE.bazel")

knife

@@ -155,6 +155,66 @@ function cmd_lint () {
     buildifier -mode=$mode $(find . -type f \( -name 'BUILD*' -o -name 'WORKSPACE*' -o -name '*.bzl' \))
 }
 
+function cmd_update_python_archives () {
+	if ! which jq > /dev/null; then
+		echo "🧱 No jq executable was found"
+		exit 1
+	fi
+	if ! which curl > /dev/null; then
+		echo "🧱 No curl executable was found"
+		exit 1
+	fi
+
+	VERBOSE=0
+	DRY_RUN=0
+	for arg in "$@"; do
+		case "$arg" in
+		--verbose)
+			VERBOSE=1
+			;;
+		--dry-run)
+			DRY_RUN=1
+			;;
+		*)
+			echo "unknown option: $arg"
+			exit 1
+			;;
+		esac
+	done
+	export VERBOSE DRY_RUN
+
+	source knife.d/update_python_archives.sh
+	old_versions=$(get_python_versions)
+	if ! out=$(generate_python_archives); then
+		case "$out" in
+		*MUTATED_PARTIAL*)
+			echo "update failed mid-mutation; files may be partially updated." >&2
+			echo "  git checkout -- private/extensions/python.bzl python/config.bzl python/testdata python/update_python_archives_test.sh python/pbs-sbom.spdx.json MODULE.bazel.lock" >&2
+			;;
+		*)
+			echo "update failed; no files were mutated (pre-flight validation)." >&2
+			;;
+		esac
+		return 1
+	fi
+	if [ "$out" = "NO_CHANGE" ]; then
+		echo "python archives are up to date"
+		return 0
+	fi
+	if [ "$DRY_RUN" = 1 ]; then
+		echo "dry-run: no files written"
+		return 0
+	fi
+	echo "updated python archives to release $out"
+	if ! update_test_versions_python "$old_versions"; then
+		echo "testdata update failed; extension/config.bzl were already updated." >&2
+		echo "  git checkout -- private/extensions/python.bzl python/config.bzl python/testdata python/update_python_archives_test.sh python/pbs-sbom.spdx.json MODULE.bazel.lock" >&2
+		return 1
+	fi
+	# the extension changed: the lockfile digest is stale until bazel re-syncs it
+	echo "sync the lockfile: bazel mod deps --lockfile_mode=update" >&2
+}
+
 function cmd_update_node_archives () {
 	if ! which jq > /dev/null; then
 		echo "🧱 No jq executable was found"
@@ -278,8 +338,11 @@ deb-versions)
 update-node-archives)
 	cmd_update_node_archives
 	;;
+update-python-archives)
+	cmd_update_python_archives "${@:2}"
+	;;
 ~~nocmd) # no command provided
-    echo "provide a command: lock, update-snapshots, github-update-snapshots, update-non-snapshots, test, deb-versions, update-node-archives"
+    echo "provide a command: lock, update-snapshots, github-update-snapshots, update-non-snapshots, test, deb-versions, update-node-archives, update-python-archives"
     exit 1
     ;;
 *) # unknown command

knife.d/BUILD.bazel

@@ -0,0 +1 @@
+exports_files(["update_python_archives.sh"])