From 544498c17845df4678ed1d6e33601621c6ca3987 Mon Sep 17 00:00:00 2001 From: Richard Levasseur Date: Sat, 11 Jul 2026 17:34:48 +0000 Subject: [PATCH 1/4] refactor: use centralized NOT_ACTUALLY_PUBLIC across internal targets Currently, several internal macros, toolchain definitions, and config settings either hardcode ["//visibility:public"] or define private copies like _NOT_ACTUALLY_PUBLIC. This scatters visibility workarounds and makes intention unclear. To clean this up, transition internal rules and helper targets in python/private to use the centralized NOT_ACTUALLY_PUBLIC constant from python/private/visibility.bzl and ensure bzl_library dependencies accurately reflect the load graph. --- python/private/BUILD.bazel | 17 +++++++---- python/private/config_settings.bzl | 33 ++++++++++----------- python/private/local_runtime_repo_setup.bzl | 11 +++---- python/private/pypi/BUILD.bazel | 1 + python/private/pypi/whl_library_targets.bzl | 7 +++-- python/private/runtime_env_toolchain.bzl | 9 +++--- python/private/stamp_impl.bzl | 4 ++- python/private/toolchains_repo.bzl | 3 +- 8 files changed, 47 insertions(+), 38 deletions(-) diff --git a/python/private/BUILD.bazel b/python/private/BUILD.bazel index e4d06d4a89..73dd5d191c 100644 --- a/python/private/BUILD.bazel +++ b/python/private/BUILD.bazel @@ -22,6 +22,7 @@ load(":py_interpreter_program.bzl", "py_interpreter_program") load(":sentinel_impl.bzl", "sentinel") load(":stamp_impl.bzl", "stamp_build_setting") load(":uncachable_version_file.bzl", "define_uncachable_version_file") +load(":visibility.bzl", "NOT_ACTUALLY_PUBLIC") package( default_visibility = [ @@ -95,7 +96,7 @@ exports_files( ["python_bootstrap_template.txt"], # Not actually public. Only public because it's an implicit dependency of # py_runtime. - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, ) filegroup( @@ -330,6 +331,7 @@ bzl_library( deps = [ ":text_util", ":version", + ":visibility", "@bazel_skylib//lib:selects", "@bazel_skylib//rules:common_settings", ], @@ -434,6 +436,7 @@ bzl_library( "@rules_python//python:py_runtime_pair", "@rules_python//python/cc:py_cc_toolchain", "@rules_python//python/private:py_exec_tools_toolchain", + "@rules_python//python/private:visibility", ], ) @@ -841,6 +844,7 @@ bzl_library( ":config_settings", ":py_exec_tools_toolchain", ":toolchain_types", + ":visibility", "//python:py_runtime", "//python:py_runtime_pair", "//python/cc:py_cc_toolchain", @@ -906,6 +910,12 @@ bzl_library( ], ) +bzl_library( + name = "stamp_impl", + srcs = ["stamp_impl.bzl"], + deps = [":visibility"], +) + bzl_library( name = "bzlmod_enabled", srcs = ["bzlmod_enabled.bzl"], @@ -986,11 +996,6 @@ bzl_library( srcs = ["sentinel_impl.bzl"], ) -bzl_library( - name = "stamp_impl", - srcs = ["stamp_impl.bzl"], -) - bzl_library( name = "text_util", srcs = ["text_util.bzl"], diff --git a/python/private/config_settings.bzl b/python/private/config_settings.bzl index 91fbbba8cb..06e0c59928 100644 --- a/python/private/config_settings.bzl +++ b/python/private/config_settings.bzl @@ -17,8 +17,9 @@ load("@bazel_skylib//lib:selects.bzl", "selects") load("@bazel_skylib//rules:common_settings.bzl", "BuildSettingInfo") -load("//python/private:text_util.bzl", "render") +load(":text_util.bzl", "render") load(":version.bzl", "version") +load(":visibility.bzl", "NOT_ACTUALLY_PUBLIC") _PYTHON_VERSION_FLAG = Label("//python/config_settings:python_version") _PYTHON_VERSION_MAJOR_MINOR_FLAG = Label("//python/config_settings:python_version_major_minor") @@ -31,10 +32,6 @@ If the value is missing, then the default value is being used, see documentation {docs_url}/python/config_settings """ -# Indicates something needs public visibility so that other generated code can -# access it, but it's not intended for general public usage. -_NOT_ACTUALLY_PUBLIC = ["//visibility:public"] - def construct_config_settings( *, name, @@ -62,19 +59,19 @@ def construct_config_settings( _python_version_flag( name = _PYTHON_VERSION_FLAG.name, build_setting_default = default_version, - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, ) _python_version_major_minor_flag( name = _PYTHON_VERSION_MAJOR_MINOR_FLAG.name, build_setting_default = "", - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, ) native.config_setting( name = "is_python_version_unset", flag_values = {_PYTHON_VERSION_FLAG: ""}, - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, ) _reverse_minor_mapping = {full: minor for minor, full in minor_mapping.items()} @@ -84,7 +81,7 @@ def construct_config_settings( native.config_setting( name = "is_python_{}".format(ver), flag_values = {":python_version": ver}, - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, ) continue @@ -93,7 +90,7 @@ def construct_config_settings( native.config_setting( name = "_" + name, flag_values = {":python_version": ver}, - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, ) # An alias pointing to an underscore-prefixed config_setting_group @@ -111,7 +108,7 @@ def construct_config_settings( native.alias( name = name, actual = "_{}_group".format(name), - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, ) # This matches the raw flag value, e.g. --//python/config_settings:python_version=3.8 @@ -127,7 +124,7 @@ def construct_config_settings( native.config_setting( name = "is_python_{}".format(minor), flag_values = {_PYTHON_VERSION_MAJOR_MINOR_FLAG: minor}, - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, ) # This is a compatibility layer to ensure that `select` statements don't break out right @@ -137,7 +134,7 @@ def construct_config_settings( native.alias( name = "is_python_3.{}".format(minor), actual = "@platforms//:incompatible", - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, ) _current_config( @@ -156,30 +153,30 @@ def construct_config_settings( # `whl_library` in the hub repo created by `pip.parse`. flag_values = {"current_config": "will-never-match"}, # Only public so that PyPI hub repo can access it - visibility = _NOT_ACTUALLY_PUBLIC, + visibility = NOT_ACTUALLY_PUBLIC, ) libc = Label("//python/config_settings:py_linux_libc") native.config_setting( name = "_is_py_linux_libc_glibc", flag_values = {libc: "glibc"}, - visibility = _NOT_ACTUALLY_PUBLIC, + visibility = NOT_ACTUALLY_PUBLIC, ) native.config_setting( name = "_is_py_linux_libc_musl", flag_values = {libc: "musl"}, - visibility = _NOT_ACTUALLY_PUBLIC, + visibility = NOT_ACTUALLY_PUBLIC, ) freethreaded = Label("//python/config_settings:py_freethreaded") native.config_setting( name = "_is_py_freethreaded_yes", flag_values = {freethreaded: "yes"}, - visibility = _NOT_ACTUALLY_PUBLIC, + visibility = NOT_ACTUALLY_PUBLIC, ) native.config_setting( name = "_is_py_freethreaded_no", flag_values = {freethreaded: "no"}, - visibility = _NOT_ACTUALLY_PUBLIC, + visibility = NOT_ACTUALLY_PUBLIC, ) def _python_version_flag_impl(ctx): diff --git a/python/private/local_runtime_repo_setup.bzl b/python/private/local_runtime_repo_setup.bzl index 5cb7bda200..0d262cadf3 100644 --- a/python/private/local_runtime_repo_setup.bzl +++ b/python/private/local_runtime_repo_setup.bzl @@ -20,6 +20,7 @@ load("@rules_python//python:py_runtime.bzl", "py_runtime") load("@rules_python//python:py_runtime_pair.bzl", "py_runtime_pair") load("@rules_python//python/cc:py_cc_toolchain.bzl", "py_cc_toolchain") load("@rules_python//python/private:py_exec_tools_toolchain.bzl", "py_exec_tools_toolchain") +load("@rules_python//python/private:visibility.bzl", "NOT_ACTUALLY_PUBLIC") _PYTHON_VERSION_FLAG = Label("@rules_python//python/config_settings:python_version") @@ -172,12 +173,12 @@ def define_local_runtime_toolchain_impl( name = "python_runtimes", py2_runtime = None, py3_runtime = ":py3_runtime", - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, ) py_exec_tools_toolchain( name = "py_exec_tools_toolchain", - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, precompiler = "@rules_python//tools/precompiler:precompiler", ) @@ -187,7 +188,7 @@ def define_local_runtime_toolchain_impl( headers_abi3 = ":python_headers_abi3", libs = ":libpython", python_version = major_minor_micro, - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, ) native.alias( @@ -197,7 +198,7 @@ def define_local_runtime_toolchain_impl( # the value is an `@platforms//foo` string, which @rules_python has # visibility to, but the calling repo may not. actual = Label(os), - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, ) native.config_setting( @@ -218,5 +219,5 @@ def define_local_runtime_toolchain_impl( ":_is_major_minor", ":_is_major_minor_micro", ], - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, ) diff --git a/python/private/pypi/BUILD.bazel b/python/private/pypi/BUILD.bazel index 8dd32afb9c..ba3238d00f 100644 --- a/python/private/pypi/BUILD.bazel +++ b/python/private/pypi/BUILD.bazel @@ -497,6 +497,7 @@ bzl_library( "//python:py_binary", "//python:py_library", "//python/private:normalize_name", + "//python/private:visibility", "@bazel_skylib//rules:copy_file", ], ) diff --git a/python/private/pypi/whl_library_targets.bzl b/python/private/pypi/whl_library_targets.bzl index 933b529053..b7d0e59782 100644 --- a/python/private/pypi/whl_library_targets.bzl +++ b/python/private/pypi/whl_library_targets.bzl @@ -18,6 +18,7 @@ load("@bazel_skylib//rules:copy_file.bzl", "copy_file") load("//python:py_binary.bzl", "py_binary") load("//python:py_library.bzl", "py_library") load("//python/private:normalize_name.bzl", "normalize_name") +load("//python/private:visibility.bzl", "NOT_ACTUALLY_PUBLIC") load(":env_marker_setting.bzl", "env_marker_setting") load( ":labels.bzl", @@ -233,7 +234,7 @@ def whl_library_targets( native.filegroup( name = filegroup_name, srcs = srcs, - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, ) for src, dest in copy_files.items(): @@ -241,7 +242,7 @@ def whl_library_targets( name = dest + ".copy", src = src, out = dest, - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, ) data.append(dest) for src, dest in copy_executables.items(): @@ -250,7 +251,7 @@ def whl_library_targets( src = src, out = dest, is_executable = True, - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, ) data.append(dest) diff --git a/python/private/runtime_env_toolchain.bzl b/python/private/runtime_env_toolchain.bzl index de74900750..b8c05a4bd7 100644 --- a/python/private/runtime_env_toolchain.bzl +++ b/python/private/runtime_env_toolchain.bzl @@ -20,6 +20,7 @@ load("//python/cc:py_cc_toolchain.bzl", "py_cc_toolchain") load("//python/private:config_settings.bzl", "is_python_version_at_least") load(":py_exec_tools_toolchain.bzl", "py_exec_tools_toolchain") load(":toolchain_types.bzl", "EXEC_TOOLS_TOOLCHAIN_TYPE", "PY_CC_TOOLCHAIN_TYPE", "TARGET_TOOLCHAIN_TYPE") +load(":visibility.bzl", "NOT_ACTUALLY_PUBLIC") _IS_EXEC_TOOLCHAIN_ENABLED = Label("//python/config_settings:is_exec_tools_toolchain_enabled") @@ -76,7 +77,7 @@ def define_runtime_env_toolchain(name): "@platforms//os:windows": ":_magic_sentinel_runtime", "//conditions:default": ":_runtime_env_py3_runtime", }), - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, tags = ["manual"], ) @@ -84,7 +85,7 @@ def define_runtime_env_toolchain(name): name = name, toolchain = ":_runtime_env_py_runtime_pair", toolchain_type = TARGET_TOOLCHAIN_TYPE, - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, ) py_exec_tools_toolchain( @@ -98,7 +99,7 @@ def define_runtime_env_toolchain(name): toolchain = "_runtime_env_py_exec_tools_toolchain_impl", toolchain_type = EXEC_TOOLS_TOOLCHAIN_TYPE, target_settings = [_IS_EXEC_TOOLCHAIN_ENABLED], - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, ) cc_library( name = "_empty_cc_lib", @@ -117,7 +118,7 @@ def define_runtime_env_toolchain(name): name = base_name + "_py_cc_toolchain", toolchain = ":_runtime_env_py_cc_toolchain_impl", toolchain_type = PY_CC_TOOLCHAIN_TYPE, - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, ) is_python_version_at_least( name = "_is_at_least_py3.11", diff --git a/python/private/stamp_impl.bzl b/python/private/stamp_impl.bzl index 6bc0cd9d23..77e3da1f72 100644 --- a/python/private/stamp_impl.bzl +++ b/python/private/stamp_impl.bzl @@ -18,6 +18,8 @@ This module can be removed likely after the following PRs ar addressed: - https://github.com/bazelbuild/bazel/issues/11164 """ +load(":visibility.bzl", "NOT_ACTUALLY_PUBLIC") + StampSettingInfo = provider( doc = "Information about the `--stamp` command line flag", fields = { @@ -50,7 +52,7 @@ Stamped binaries are not rebuilt unless their dependencies change. }, ) -def stamp_build_setting(name, visibility = ["//visibility:public"]): +def stamp_build_setting(name, visibility = NOT_ACTUALLY_PUBLIC): native.config_setting( name = "stamp_detect", values = {"stamp": "1"}, diff --git a/python/private/toolchains_repo.bzl b/python/private/toolchains_repo.bzl index 1338e9c569..49a552b40a 100644 --- a/python/private/toolchains_repo.bzl +++ b/python/private/toolchains_repo.bzl @@ -112,8 +112,9 @@ def compile_pip_requirements(**kwargs): _HOST_TOOLCHAIN_BUILD_CONTENT = """ # Generated by python/private/toolchains_repo.bzl +load("@rules_python//python/private:visibility.bzl", "NOT_ACTUALLY_PUBLIC") # buildifier: disable=bzl-visibility -exports_files(["python"], visibility = ["//visibility:public"]) +exports_files(["python"], visibility = NOT_ACTUALLY_PUBLIC) """.lstrip() _HOST_PYTHON_TESTER_TEMPLATE = """ From c1f9336ce89b6e29143c6609573f511034e1ea19 Mon Sep 17 00:00:00 2001 From: Richard Levasseur Date: Sat, 11 Jul 2026 17:59:53 +0000 Subject: [PATCH 2/4] refactor: address review comments on PR #3920 Revert _HOST_TOOLCHAIN_BUILD_CONTENT visibility in toolchains_repo.bzl to avoid cross-repo load violations and update adjacent bootstrap template targets in python/private/BUILD.bazel to NOT_ACTUALLY_PUBLIC for consistency. --- python/private/BUILD.bazel | 8 ++++---- python/private/toolchains_repo.bzl | 3 +-- 2 files changed, 5 insertions(+), 6 deletions(-) diff --git a/python/private/BUILD.bazel b/python/private/BUILD.bazel index 73dd5d191c..bddc5a955f 100644 --- a/python/private/BUILD.bazel +++ b/python/private/BUILD.bazel @@ -104,7 +104,7 @@ filegroup( srcs = ["stage1_bootstrap_template.sh"], # Not actually public. Only public because it's an implicit dependency of # py_runtime. - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, ) filegroup( @@ -112,7 +112,7 @@ filegroup( srcs = ["stage2_bootstrap_template.py"], # Not actually public. Only public because it's an implicit dependency of # py_runtime. - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, ) filegroup( @@ -120,7 +120,7 @@ filegroup( srcs = ["site_init_template.py"], # Not actually public. Only public because it's an implicit dependency of # py_runtime. - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, ) # NOTE: Windows builds don't use this bootstrap. Instead, a native Windows @@ -134,7 +134,7 @@ alias( }), # Not actually public. Only public because it's an implicit dependency of # py_runtime. - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, ) # Used to determine the use of `--stamp` in Starlark rules diff --git a/python/private/toolchains_repo.bzl b/python/private/toolchains_repo.bzl index 49a552b40a..1338e9c569 100644 --- a/python/private/toolchains_repo.bzl +++ b/python/private/toolchains_repo.bzl @@ -112,9 +112,8 @@ def compile_pip_requirements(**kwargs): _HOST_TOOLCHAIN_BUILD_CONTENT = """ # Generated by python/private/toolchains_repo.bzl -load("@rules_python//python/private:visibility.bzl", "NOT_ACTUALLY_PUBLIC") # buildifier: disable=bzl-visibility -exports_files(["python"], visibility = NOT_ACTUALLY_PUBLIC) +exports_files(["python"], visibility = ["//visibility:public"]) """.lstrip() _HOST_PYTHON_TESTER_TEMPLATE = """ From 26dd0ca41fe5b68612033cef12decea11fa5ecd9 Mon Sep 17 00:00:00 2001 From: Richard Levasseur Date: Sat, 11 Jul 2026 18:05:48 +0000 Subject: [PATCH 3/4] refactor: keep specified config settings and toolchains regular public Some targets in config_settings, local_runtime_repo_setup, and runtime_env_toolchain require standard public visibility rather than NOT_ACTUALLY_PUBLIC. To fix, revert local_runtime_repo_setup.bzl and runtime_env_toolchain.bzl to regular public visibility, restore regular public on specified targets in config_settings.bzl, and update corresponding bzl_library dependencies. --- python/private/BUILD.bazel | 2 -- python/private/config_settings.bzl | 12 ++++++------ python/private/local_runtime_repo_setup.bzl | 11 +++++------ python/private/pypi/BUILD.bazel | 1 - python/private/pypi/whl_library_targets.bzl | 7 +++---- python/private/runtime_env_toolchain.bzl | 9 ++++----- 6 files changed, 18 insertions(+), 24 deletions(-) diff --git a/python/private/BUILD.bazel b/python/private/BUILD.bazel index bddc5a955f..19d320c6a6 100644 --- a/python/private/BUILD.bazel +++ b/python/private/BUILD.bazel @@ -436,7 +436,6 @@ bzl_library( "@rules_python//python:py_runtime_pair", "@rules_python//python/cc:py_cc_toolchain", "@rules_python//python/private:py_exec_tools_toolchain", - "@rules_python//python/private:visibility", ], ) @@ -844,7 +843,6 @@ bzl_library( ":config_settings", ":py_exec_tools_toolchain", ":toolchain_types", - ":visibility", "//python:py_runtime", "//python:py_runtime_pair", "//python/cc:py_cc_toolchain", diff --git a/python/private/config_settings.bzl b/python/private/config_settings.bzl index 06e0c59928..9cd729aff2 100644 --- a/python/private/config_settings.bzl +++ b/python/private/config_settings.bzl @@ -59,19 +59,19 @@ def construct_config_settings( _python_version_flag( name = _PYTHON_VERSION_FLAG.name, build_setting_default = default_version, - visibility = NOT_ACTUALLY_PUBLIC, + visibility = ["//visibility:public"], ) _python_version_major_minor_flag( name = _PYTHON_VERSION_MAJOR_MINOR_FLAG.name, build_setting_default = "", - visibility = NOT_ACTUALLY_PUBLIC, + visibility = ["//visibility:public"], ) native.config_setting( name = "is_python_version_unset", flag_values = {_PYTHON_VERSION_FLAG: ""}, - visibility = NOT_ACTUALLY_PUBLIC, + visibility = ["//visibility:public"], ) _reverse_minor_mapping = {full: minor for minor, full in minor_mapping.items()} @@ -81,7 +81,7 @@ def construct_config_settings( native.config_setting( name = "is_python_{}".format(ver), flag_values = {":python_version": ver}, - visibility = NOT_ACTUALLY_PUBLIC, + visibility = ["//visibility:public"], ) continue @@ -124,7 +124,7 @@ def construct_config_settings( native.config_setting( name = "is_python_{}".format(minor), flag_values = {_PYTHON_VERSION_MAJOR_MINOR_FLAG: minor}, - visibility = NOT_ACTUALLY_PUBLIC, + visibility = ["//visibility:public"], ) # This is a compatibility layer to ensure that `select` statements don't break out right @@ -134,7 +134,7 @@ def construct_config_settings( native.alias( name = "is_python_3.{}".format(minor), actual = "@platforms//:incompatible", - visibility = NOT_ACTUALLY_PUBLIC, + visibility = ["//visibility:public"], ) _current_config( diff --git a/python/private/local_runtime_repo_setup.bzl b/python/private/local_runtime_repo_setup.bzl index 0d262cadf3..5cb7bda200 100644 --- a/python/private/local_runtime_repo_setup.bzl +++ b/python/private/local_runtime_repo_setup.bzl @@ -20,7 +20,6 @@ load("@rules_python//python:py_runtime.bzl", "py_runtime") load("@rules_python//python:py_runtime_pair.bzl", "py_runtime_pair") load("@rules_python//python/cc:py_cc_toolchain.bzl", "py_cc_toolchain") load("@rules_python//python/private:py_exec_tools_toolchain.bzl", "py_exec_tools_toolchain") -load("@rules_python//python/private:visibility.bzl", "NOT_ACTUALLY_PUBLIC") _PYTHON_VERSION_FLAG = Label("@rules_python//python/config_settings:python_version") @@ -173,12 +172,12 @@ def define_local_runtime_toolchain_impl( name = "python_runtimes", py2_runtime = None, py3_runtime = ":py3_runtime", - visibility = NOT_ACTUALLY_PUBLIC, + visibility = ["//visibility:public"], ) py_exec_tools_toolchain( name = "py_exec_tools_toolchain", - visibility = NOT_ACTUALLY_PUBLIC, + visibility = ["//visibility:public"], precompiler = "@rules_python//tools/precompiler:precompiler", ) @@ -188,7 +187,7 @@ def define_local_runtime_toolchain_impl( headers_abi3 = ":python_headers_abi3", libs = ":libpython", python_version = major_minor_micro, - visibility = NOT_ACTUALLY_PUBLIC, + visibility = ["//visibility:public"], ) native.alias( @@ -198,7 +197,7 @@ def define_local_runtime_toolchain_impl( # the value is an `@platforms//foo` string, which @rules_python has # visibility to, but the calling repo may not. actual = Label(os), - visibility = NOT_ACTUALLY_PUBLIC, + visibility = ["//visibility:public"], ) native.config_setting( @@ -219,5 +218,5 @@ def define_local_runtime_toolchain_impl( ":_is_major_minor", ":_is_major_minor_micro", ], - visibility = NOT_ACTUALLY_PUBLIC, + visibility = ["//visibility:public"], ) diff --git a/python/private/pypi/BUILD.bazel b/python/private/pypi/BUILD.bazel index ba3238d00f..8dd32afb9c 100644 --- a/python/private/pypi/BUILD.bazel +++ b/python/private/pypi/BUILD.bazel @@ -497,7 +497,6 @@ bzl_library( "//python:py_binary", "//python:py_library", "//python/private:normalize_name", - "//python/private:visibility", "@bazel_skylib//rules:copy_file", ], ) diff --git a/python/private/pypi/whl_library_targets.bzl b/python/private/pypi/whl_library_targets.bzl index b7d0e59782..933b529053 100644 --- a/python/private/pypi/whl_library_targets.bzl +++ b/python/private/pypi/whl_library_targets.bzl @@ -18,7 +18,6 @@ load("@bazel_skylib//rules:copy_file.bzl", "copy_file") load("//python:py_binary.bzl", "py_binary") load("//python:py_library.bzl", "py_library") load("//python/private:normalize_name.bzl", "normalize_name") -load("//python/private:visibility.bzl", "NOT_ACTUALLY_PUBLIC") load(":env_marker_setting.bzl", "env_marker_setting") load( ":labels.bzl", @@ -234,7 +233,7 @@ def whl_library_targets( native.filegroup( name = filegroup_name, srcs = srcs, - visibility = NOT_ACTUALLY_PUBLIC, + visibility = ["//visibility:public"], ) for src, dest in copy_files.items(): @@ -242,7 +241,7 @@ def whl_library_targets( name = dest + ".copy", src = src, out = dest, - visibility = NOT_ACTUALLY_PUBLIC, + visibility = ["//visibility:public"], ) data.append(dest) for src, dest in copy_executables.items(): @@ -251,7 +250,7 @@ def whl_library_targets( src = src, out = dest, is_executable = True, - visibility = NOT_ACTUALLY_PUBLIC, + visibility = ["//visibility:public"], ) data.append(dest) diff --git a/python/private/runtime_env_toolchain.bzl b/python/private/runtime_env_toolchain.bzl index b8c05a4bd7..de74900750 100644 --- a/python/private/runtime_env_toolchain.bzl +++ b/python/private/runtime_env_toolchain.bzl @@ -20,7 +20,6 @@ load("//python/cc:py_cc_toolchain.bzl", "py_cc_toolchain") load("//python/private:config_settings.bzl", "is_python_version_at_least") load(":py_exec_tools_toolchain.bzl", "py_exec_tools_toolchain") load(":toolchain_types.bzl", "EXEC_TOOLS_TOOLCHAIN_TYPE", "PY_CC_TOOLCHAIN_TYPE", "TARGET_TOOLCHAIN_TYPE") -load(":visibility.bzl", "NOT_ACTUALLY_PUBLIC") _IS_EXEC_TOOLCHAIN_ENABLED = Label("//python/config_settings:is_exec_tools_toolchain_enabled") @@ -77,7 +76,7 @@ def define_runtime_env_toolchain(name): "@platforms//os:windows": ":_magic_sentinel_runtime", "//conditions:default": ":_runtime_env_py3_runtime", }), - visibility = NOT_ACTUALLY_PUBLIC, + visibility = ["//visibility:public"], tags = ["manual"], ) @@ -85,7 +84,7 @@ def define_runtime_env_toolchain(name): name = name, toolchain = ":_runtime_env_py_runtime_pair", toolchain_type = TARGET_TOOLCHAIN_TYPE, - visibility = NOT_ACTUALLY_PUBLIC, + visibility = ["//visibility:public"], ) py_exec_tools_toolchain( @@ -99,7 +98,7 @@ def define_runtime_env_toolchain(name): toolchain = "_runtime_env_py_exec_tools_toolchain_impl", toolchain_type = EXEC_TOOLS_TOOLCHAIN_TYPE, target_settings = [_IS_EXEC_TOOLCHAIN_ENABLED], - visibility = NOT_ACTUALLY_PUBLIC, + visibility = ["//visibility:public"], ) cc_library( name = "_empty_cc_lib", @@ -118,7 +117,7 @@ def define_runtime_env_toolchain(name): name = base_name + "_py_cc_toolchain", toolchain = ":_runtime_env_py_cc_toolchain_impl", toolchain_type = PY_CC_TOOLCHAIN_TYPE, - visibility = NOT_ACTUALLY_PUBLIC, + visibility = ["//visibility:public"], ) is_python_version_at_least( name = "_is_at_least_py3.11", From 7eb339c53bab2abd817060ee6a3a6c39cad7055d Mon Sep 17 00:00:00 2001 From: Richard Levasseur Date: Sat, 11 Jul 2026 18:38:41 +0000 Subject: [PATCH 4/4] refactor: use NOT_ACTUALLY_PUBLIC across remaining internal targets Multiple internal targets across config_settings, python/private, and internal tools set public visibility accompanied by comments noting they are only public for implicit dependencies or cross-repo references. To clean this up, transition those targets to use NOT_ACTUALLY_PUBLIC from python/private/visibility.bzl, and introduce a self-contained visibility constant inside sphinxdocs to maintain strict project boundaries. --- python/config_settings/BUILD.bazel | 25 ++++++++++---------- python/private/BUILD.bazel | 6 ++--- python/private/api/BUILD.bazel | 3 ++- sphinxdocs/sphinxdocs/private/BUILD.bazel | 12 +++++++--- sphinxdocs/sphinxdocs/private/visibility.bzl | 7 ++++++ tools/precompiler/BUILD.bazel | 9 ++++--- tools/private/zipapp/BUILD.bazel | 25 ++++++++------------ 7 files changed, 48 insertions(+), 39 deletions(-) create mode 100644 sphinxdocs/sphinxdocs/private/visibility.bzl diff --git a/python/config_settings/BUILD.bazel b/python/config_settings/BUILD.bazel index c7de1d00da..d92aa4261c 100644 --- a/python/config_settings/BUILD.bazel +++ b/python/config_settings/BUILD.bazel @@ -15,6 +15,7 @@ load( "VenvsUseDeclareSymlinkFlag", rp_string_flag = "string_flag", ) +load("//python/private:visibility.bzl", "NOT_ACTUALLY_PUBLIC") # buildifier: disable=bzl-visibility load("//python/private/pypi:flags.bzl", "define_pypi_internal_flags") load(":config_settings.bzl", "construct_config_settings") @@ -48,7 +49,7 @@ string_flag( build_setting_default = AddSrcsToRunfilesFlag.AUTO, values = AddSrcsToRunfilesFlag.flag_values(), # NOTE: Only public because it is dependency of public rules. - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, ) string_flag( @@ -67,7 +68,7 @@ config_setting( }, # NOTE: Only public because it is used in py_toolchain_suite from toolchain # repositories - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, ) string_flag( @@ -75,7 +76,7 @@ string_flag( build_setting_default = PrecompileFlag.AUTO, values = sorted(PrecompileFlag.__members__.values()), # NOTE: Only public because it's an implicit dependency - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, ) string_flag( @@ -83,7 +84,7 @@ string_flag( build_setting_default = ValidateTestMainFlag.AUTO, values = ValidateTestMainFlag.flag_values(), # NOTE: Only public because it's an implicit dependency of py_test. - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, ) string_flag( @@ -91,7 +92,7 @@ string_flag( build_setting_default = PrecompileSourceRetentionFlag.AUTO, values = sorted(PrecompileSourceRetentionFlag.__members__.values()), # NOTE: Only public because it's an implicit dependency - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, ) rp_string_flag( @@ -104,7 +105,7 @@ rp_string_flag( }), values = sorted(BootstrapImplFlag.__members__.values()), # NOTE: Only public because it's an implicit dependency - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, ) label_flag( @@ -127,7 +128,7 @@ string_flag( build_setting_default = LibcFlag.GLIBC, values = LibcFlag.flag_values(), # NOTE: Only public because it is used in pip hub and toolchain repos. - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, ) string_flag( @@ -166,21 +167,21 @@ string_flag( name = "venv", build_setting_default = "auto", # NOTE: Only public because it is used in pip hub repos and executable transitions. - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, ) string_flag( name = "pip_whl_osx_version", build_setting_default = "", # NOTE: Only public because it is used in pip hub repos. - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, ) string_flag( name = "venvs_site_packages", build_setting_default = VenvsSitePackages.NO, # NOTE: Only public because it is used in pip hub repos. - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, ) config_setting( @@ -189,7 +190,7 @@ config_setting( ":venvs_site_packages": VenvsSitePackages.YES, }, # NOTE: Only public because it is used in whl_library repos. - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, ) define_pypi_internal_flags( @@ -200,7 +201,7 @@ label_flag( name = "pip_env_marker_config", build_setting_default = ":_pip_env_marker_default_config", # NOTE: Only public because it is used in pip hub repos. - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, ) bool_flag( diff --git a/python/private/BUILD.bazel b/python/private/BUILD.bazel index 19d320c6a6..5f51b7650c 100644 --- a/python/private/BUILD.bazel +++ b/python/private/BUILD.bazel @@ -170,7 +170,7 @@ bool_flag( name = "visible_for_testing", build_setting_default = False, # This is only because it is an implicit dependency by the toolchains. - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, ) # Used for py_console_script_gen rule @@ -204,7 +204,7 @@ current_interpreter_executable( name = "current_interpreter_executable", # Not actually public. Only public because it's an implicit dependency of # py_exec_tools_toolchain. - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, ) py_library( @@ -228,7 +228,7 @@ py_interpreter_program( main = "py_test_main_validator.py", # Not actually public. Only public because it's an implicit dependency of # the py_test rule. - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, ) py_library( diff --git a/python/private/api/BUILD.bazel b/python/private/api/BUILD.bazel index b3cc7360a7..cd7eda1bd2 100644 --- a/python/private/api/BUILD.bazel +++ b/python/private/api/BUILD.bazel @@ -13,6 +13,7 @@ # limitations under the License. load("@bazel_skylib//:bzl_library.bzl", "bzl_library") +load("//python/private:visibility.bzl", "NOT_ACTUALLY_PUBLIC") load(":py_common_api.bzl", "py_common_api") package( @@ -27,7 +28,7 @@ filegroup( py_common_api( name = "py_common_api_impl", # NOTE: Not actually public. Implicit dependency of public rules. - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, ) bzl_library( diff --git a/sphinxdocs/sphinxdocs/private/BUILD.bazel b/sphinxdocs/sphinxdocs/private/BUILD.bazel index b054ed2611..5c87e77ce2 100644 --- a/sphinxdocs/sphinxdocs/private/BUILD.bazel +++ b/sphinxdocs/sphinxdocs/private/BUILD.bazel @@ -16,6 +16,7 @@ load("@bazel_skylib//:bzl_library.bzl", "bzl_library") load("@com_google_protobuf//bazel:py_proto_library.bzl", "py_proto_library") load("@rules_python//python:py_binary.bzl", "py_binary") load("@rules_python//python:py_library.bzl", "py_library") +load(":visibility.bzl", "NOT_ACTUALLY_PUBLIC") package( default_visibility = ["//:__subpackages__"], @@ -102,18 +103,23 @@ bzl_library( ], ) +bzl_library( + name = "visibility", + srcs = ["visibility.bzl"], +) + py_binary( name = "inventory_builder", srcs = ["inventory_builder.py"], # Only public because it's an implicit attribute - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, ) py_binary( name = "proto_to_markdown", srcs = ["proto_to_markdown.py"], # Only public because it's an implicit attribute - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, deps = [":proto_to_markdown_lib"], ) @@ -121,7 +127,7 @@ py_library( name = "proto_to_markdown_lib", srcs = ["proto_to_markdown.py"], # Only public because it's an implicit attribute - visibility = ["//visibility:public"], + visibility = NOT_ACTUALLY_PUBLIC, deps = [ ":stardoc_output_proto_py_pb2", ], diff --git a/sphinxdocs/sphinxdocs/private/visibility.bzl b/sphinxdocs/sphinxdocs/private/visibility.bzl new file mode 100644 index 0000000000..706be45a3b --- /dev/null +++ b/sphinxdocs/sphinxdocs/private/visibility.bzl @@ -0,0 +1,7 @@ +"""Shared code for use with visibility specs.""" + +# Use when a target isn't actually public, but needs public +# visibility to keep Bazel happy. +# Such cases are typically for defaults of rule attributes or macro args that +# get used outside of sphinxdocs itself. +NOT_ACTUALLY_PUBLIC = ["//visibility:public"] diff --git a/tools/precompiler/BUILD.bazel b/tools/precompiler/BUILD.bazel index 268f41b032..e055980c72 100644 --- a/tools/precompiler/BUILD.bazel +++ b/tools/precompiler/BUILD.bazel @@ -14,6 +14,7 @@ load("@bazel_skylib//rules:common_settings.bzl", "string_list_flag") load("//python/private:py_interpreter_program.bzl", "py_interpreter_program") # buildifier: disable=bzl-visibility +load("//python/private:visibility.bzl", "NOT_ACTUALLY_PUBLIC") # buildifier: disable=bzl-visibility filegroup( name = "distribution", @@ -25,11 +26,9 @@ py_interpreter_program( name = "precompiler", execution_requirements = ":execution_requirements", main = "precompiler.py", - visibility = [ - # Not actually public. Only public so rules_python-generated toolchains - # are able to reference it. - "//visibility:public", - ], + # Not actually public. Only public so rules_python-generated toolchains + # are able to reference it. + visibility = NOT_ACTUALLY_PUBLIC, ) string_list_flag( diff --git a/tools/private/zipapp/BUILD.bazel b/tools/private/zipapp/BUILD.bazel index 7420776ef3..45bd126c6e 100644 --- a/tools/private/zipapp/BUILD.bazel +++ b/tools/private/zipapp/BUILD.bazel @@ -1,5 +1,6 @@ load("//python:py_library.bzl", "py_library") load("//python/private:py_interpreter_program.bzl", "py_interpreter_program") # buildifier: disable=bzl-visibility +load("//python/private:visibility.bzl", "NOT_ACTUALLY_PUBLIC") # buildifier: disable=bzl-visibility package( default_visibility = ["//:__subpackages__"], @@ -8,11 +9,9 @@ package( py_interpreter_program( name = "zipper", main = "zipper.py", - visibility = [ - # Not actually public. Only public so rules_python-generated toolchains - # are able to reference it. - "//visibility:public", - ], + # Not actually public. Only public so rules_python-generated toolchains + # are able to reference it. + visibility = NOT_ACTUALLY_PUBLIC, ) py_library( @@ -23,11 +22,9 @@ py_library( py_interpreter_program( name = "exe_zip_maker", main = "exe_zip_maker.py", - visibility = [ - # Not actually public. Only public so rules_python-generated toolchains - # are able to reference it. - "//visibility:public", - ], + # Not actually public. Only public so rules_python-generated toolchains + # are able to reference it. + visibility = NOT_ACTUALLY_PUBLIC, ) py_library( @@ -38,11 +35,9 @@ py_library( py_interpreter_program( name = "zip_main_maker", main = "zip_main_maker.py", - visibility = [ - # Not actually public. Only public so rules_python-generated toolchains - # are able to reference it. - "//visibility:public", - ], + # Not actually public. Only public so rules_python-generated toolchains + # are able to reference it. + visibility = NOT_ACTUALLY_PUBLIC, ) py_library(