feat!: make windows use venvs (#3680)

This makes Windows use a lite venv to better align it with the unixy
implementations. A lite venv is one that has the interpreter and
pyvenv.cfg file, but site-packages isn't populated.

Unfortunately, it has to recreate the venv at runtime because Bazel
incorrectly canonicalizes relative symlinks on Windows. This isn't
ideal, however, Windows builds were already going through a zip-unzip
process, so creating a handful of symlinks seems like an improvement
overall.

A particularity of venvs on Windows is that various supporting `.dll`
files *must* be in the same directory as `python.exe`. A new
attribute (and associated provider plumbing) is added to `py_runtime`
to capture these extra files.

Note that this **requires** symlink support be enabled in Bazel and
Windows. If both aren't enabled, then weird errors will occur because
junctions (instead of symlinks) are created that point to files
(junctions can only point to directories).

Zipapp support for these venvs is also added. This required adding
`PyExecutableInfo.venv_interpreter_symlinks` to keep track of relative
symlinks that need to be created. Tracking them separately is needed
because Bazel has a bug where relative symlinks are made absolute
on Windows.

The internal plumbing for these symlinks is kept relatively generic
to support using such symlinks in site-packages in a future change.

Along the way...
* Hash-based extract support is added for zipapps passed to Python.
* Fixed manually passing a zipapp to Python to bootstrap it. This was
  previously broken because the launcher doesn't know how to look
  inside the zip file.
* Added `RULES_PYTHON_EXTRACT_ROOT` support when manually passing
  a zipapp to Python.
* Fix several issues with forward-slashes being used on Windows.
* Cleanup and improve bootstrap scripts in various ways.
* Cleanup some doc in local_runtime_repo.
* Have repo_utils.which print nicely formatted path entries on
  failure.
* Add --config=fast-tests to make it easier to run small/medium tests
* And --config=testone to make it easier to run a specific test

---------

Co-authored-by: Ignas Anikevicius <240938+aignas@users.noreply.github.com>

Author: rickeylev

.bazelrc

@@ -42,6 +42,7 @@ common --enable_bzlmod
 # Local disk cache greatly speeds up builds if the regular cache is lost
 common --disk_cache=~/.cache/bazel/bazel-disk-cache
 
+
 # Additional config to use for readthedocs builds.
 # See .readthedocs.yml for additional flags that can only be determined from
 # the runtime environment.
@@ -54,3 +55,6 @@ common --incompatible_no_implicit_file_export
 
 build --lockfile_mode=update
 
+import %workspace%/specialized_configs.bazelrc
+
+try-import user.bazelrc

CHANGELOG.md

@@ -64,7 +64,9 @@ END_UNRELEASED_TEMPLATE
   --windows_enable_symlinks` to your `.bazelrc` to enable Bazel using full
   symlink support on Windows.
 * venv-based binaries are created by default ({obj}`--bootstrap_impl=system_python`)
-  on supported platforms (Linux/Mac with Bazel 8+).
+  on supported platforms (Linux/Mac with Bazel 8+, or Windows).
+* `--build_python_zip` on Windows is ignored. Use {obj}`py_zipapp_binary` to create
+  zips of Python programs.
 
 Other changes:
 * (pypi) Update dependencies used for `compile_pip_requirements`, building
@@ -73,19 +75,21 @@ Other changes:
   we will from now on fetch the lists of available packages on each index. The
   used package mappings will be written as facts to the `MODULE.bazel.lock` file
   on supported bazel versions and it should be done at most once. As a result,
-  per-package {obj}`experimental_index_url_overrides` is no longer needed if the index URLs are
-  passed to the `pip.parse` via `experimental_index_url` and `experimental_extra_index_urls`.
-  What is more, we start implementing the flags for `--index_url` and `--extra_index_urls` more in
-  line to how it is used in `uv` and `pip`, i.e. we default to `--index_url` if the package is not
-  found in `--extra_index_urls`.
-  Fixes
-  ([#3260](https://github.com/bazel-contrib/rules_python/issues/3260) and 
+  per-package {obj}`experimental_index_url_overrides` is no longer needed if the
+  index URLs are passed to the `pip.parse` via `experimental_index_url` and
+  `experimental_extra_index_urls`.  What is more, we start implementing the flags
+  for `--index_url` and `--extra_index_urls` more in line to how it is used in
+  `uv` and `pip`, i.e. we default to `--index_url` if the package is not found in
+  `--extra_index_urls`.  Fixes
+  ([#3260](https://github.com/bazel-contrib/rules_python/issues/3260) and
   [#2632](https://github.com/bazel-contrib/rules_python/issues/2632)).
-* (uv) We will now use the download URL specified in the `uv`'s `dist_manifest.json`
-  file. If you have redirects or blocking rules as part of your downloader setup,
-  you may need to adjust them. What is more, the default uv version has been bumped
-  `0.11.2`.
-* (runfiles): We are stopping the type annotation testing with `mypy` for Python 3.9.
+* (uv) We will now use the download URL specified in the `uv`'s
+ `dist_manifest.json` file. If you have redirects or blocking rules as part of
+  your downloader setup, you may need to adjust them. What is more, the default
+  uv version has been bumped `0.11.2`.
+* (runfiles): Type annotations are no longer tested for Python 3.9.
+* Windows no longer defaults to creating a zip file and extracting it; a
+  symlink-based runfiles tree is created, as on unix-like platforms.
 
 {#v0-0-0-fixed}
 ### Fixed
@@ -122,11 +126,18 @@ Other changes:
 {#v0-0-0-added}
 ### Added
 * (pypi) Write SimpleAPI contents to the `MODULE.bazel.lock` file if using
-  {obj}`experimental_index_url` which should speed up consecutive initializations and should no
-  longer require the network access if the cache is hydrated.
-  Implements [#2731](https://github.com/bazel-contrib/rules_python/issues/2731).
+  {obj}`experimental_index_url` which should speed up consecutive
+  initializations and should no longer require the network access if the cache is
+  hydrated.  Implements
+  [#2731](https://github.com/bazel-contrib/rules_python/issues/2731).
 * (wheel) Specifying a path ending in `/` as a destination in `data_files`
   will now install file(s) to a folder, preserving their basename.
+* Various attributes and fields added to support venvs on Windows:
+  * {obj}`py_runtime.venv_bin_files` and {obj}`PyRuntime.venv_binfiles`
+    field added to specify additional Python runtime files Windows needs for
+    venvs.
+  * {obj}`PyExecutableInfo.venv_interpreter_runfiles`, and
+    {obj}`PyExecutableInfo.venv_interpreter_symlinks` adde
 
 {#v1-9-0}
 ## [1.9.0] - 2026-02-21

python/private/hermetic_runtime_repo_setup.bzl

@@ -240,6 +240,18 @@ def define_hermetic_runtime_toolchain_impl(
             _IS_FREETHREADED_YES: "cpython-{major}{minor}t".format(**version_dict),
             _IS_FREETHREADED_NO: "cpython-{major}{minor}".format(**version_dict),
         }),
+        # On Windows, a symlink-style venv requires supporting .dll files.
+        venv_bin_files = select({
+            "@platforms//os:windows": native.glob(
+                include = [
+                    "*.dll",
+                ],
+                # This must be true because glob empty-ness is checked
+                # during loading phase, before select() filters it out.
+                allow_empty = True,
+            ),
+            "//conditions:default": [],
+        }),
     )
 
     py_runtime_pair(

python/private/local_runtime_repo.bzl

@@ -74,19 +74,19 @@ def _norm_path(path):
 def _symlink_libraries(rctx, logger, libraries, shlib_suffix):
     """Symlinks the shared libraries into the lib/ directory.
 
+    Individual files are symlinked instead of the whole directory because
+    shared_lib_dirs contains multiple search paths for the shared libraries,
+    and the python files may be missing from any of those directories, and
+    any of those directories may include non-python runtime libraries,
+    as would be the case if LIBDIR were, for example, /usr/lib.
+
     Args:
         rctx: A repository_ctx object
         logger: A repo_utils.logger object
         libraries: paths to libraries to attempt to symlink.
         shlib_suffix: Optional. Ensure that the generated symlinks end with this suffix.
     Returns:
         A list of library paths (under lib/) linked by the action.
-
-    Individual files are symlinked instead of the whole directory because
-    shared_lib_dirs contains multiple search paths for the shared libraries,
-    and the python files may be missing from any of those directories, and
-    any of those directories may include non-python runtime libraries,
-    as would be the case if LIBDIR were, for example, /usr/lib.
     """
     result = []
     for source in libraries:

python/private/local_runtime_repo_setup.bzl

@@ -153,6 +153,19 @@ def define_local_runtime_toolchain_impl(
         implementation_name = implementation_name,
         abi_flags = abi_flags,
         pyc_tag = "{}-{}{}{}".format(implementation_name, major, minor, abi_flags),
+        venv_bin_files = select({
+            "@platforms//os:windows": native.glob(
+                include = [
+                    "lib/*.dll",
+                    # The pdb files just provide debugging information
+                    "lib/*.pdb",
+                ],
+                # This must be true because glob empty-ness is checked
+                # during loading phase, before select() filters it out.
+                allow_empty = True,
+            ),
+            "//conditions:default": [],
+        }),
     )
 
     py_runtime_pair(