feat: add project-qualified hub labels @hub//project/<stamp>:<pkg>

.aspect/version.axl

@@ -1 +1 @@
-version("2026.26.18")
+version("2026.28.2")

.bazelrc

@@ -9,7 +9,6 @@ common --define=SOME_VAR=SOME_VALUE
 # Set the default virtualenv to 'default'
 common --@pypi//dep_group=aspect_rules_py
 
-common --incompatible_enable_cc_toolchain_resolution
 common --@llvm//config:experimental_stub_libgcc_s
 common --@rules_cc//cc/toolchains/args/archiver_flags:use_libtool_on_macos=false
 
@@ -40,7 +39,3 @@ common:release --compilation_mode=opt
 # Build without the bytes
 common:ci --remote_download_outputs=minimal
 common:ci --nobuild_runfile_links
-
-# Override the preset's `--lockfile_mode=error` on CI since we don't
-# yet commit MODULE.bazel.lock — see .gitignore.
-common:ci --lockfile_mode=off

.gitattributes

@@ -10,3 +10,6 @@ py/private/release/version.bzl export-subst
 # is data-only (the write_source_files rule lives in the parent BUILD.bazel),
 # so the whole tree can be marked generated.
 **/snapshots/** linguist-generated
+
+# MODULE lock files are generated
+MODULE.bazel.lock linguist-generated

.github/workflows/ci-workflows.yaml

@@ -45,7 +45,7 @@ jobs:
                 - { path: "e2e/interpreter-runtime-metadata", slug: "e2e-interpreter-runtime-metadata", runner: "ubuntu-latest" }
                 - { path: "e2e/interpreter-toolchain-settings", slug: "e2e-interpreter-toolchain-settings", runner: "ubuntu-latest" }
                 - { path: "e2e/interpreter-input-validation", slug: "e2e-interpreter-input-validation", runner: "ubuntu-latest" }
-                - { path: "e2e/rules-proto-grpc-python", slug: "e2e-rules-proto-grpc-python", runner: "ubuntu-latest" }
+                - { path: "e2e/rules-proto-grpc-python", slug: "e2e-rules-proto-grpc-python", runner: "ubuntu-22.04-32core" }
                 - { path: "examples/debugger", slug: "examples-debugger", runner: "ubuntu-latest" }
                 - { path: "examples/dev_deps", slug: "examples-dev_deps", runner: "ubuntu-latest" }
                 - { path: "examples/django", slug: "examples-django", runner: "ubuntu-latest" }
@@ -58,8 +58,10 @@ jobs:
                 - { path: "examples/virtual_deps", slug: "examples-virtual_deps", runner: "ubuntu-latest" }
                 - { path: "examples/protobuf", slug: "examples-protobuf", runner: "ubuntu-22.04-32core" }
                 bazel:
-                - { id: "bazel-8", version: "8.x", flags: "--bazel-flag=--test_tag_filters=-skip-on-bazel8" }
-                - { id: "bazel-9", version: "9.x", flags: "--bazel-flag=--test_tag_filters=-skip-on-bazel9" }
+                # An empty version falls back to the workspace's .bazelversion, which validates
+                # the committed MODULE.bazel.lock; alternate versions may regenerate it instead.
+                - { id: "bazel-8", version: "", flags: "--bazel-flag=--test_tag_filters=-skip-on-bazel8 --bazel-flag=--lockfile_mode=error" }
+                - { id: "bazel-9", version: "9.x", flags: "--bazel-flag=--test_tag_filters=-skip-on-bazel9 --bazel-flag=--lockfile_mode=update" }
         env:
             USE_BAZEL_VERSION: ${{ matrix.bazel.version }}
         steps:

.github/workflows/ci.bazelrc

@@ -1,19 +1,7 @@
-# This file contains Bazel settings to apply on CI only.
-# It is referenced with a --bazelrc option in the call to bazel in ci.yaml
+# Bazel settings applied on CI only, via an explicit --bazelrc option.
 
 # Debug where options came from
 build --announce_rc
 
-# This directory is configured in GitHub actions to be persisted between runs.
-build --disk_cache=~/.cache/bazel
+# Share one repository cache across the many --output_base invocations.
 build --repository_cache=~/.cache/bazel-repo
-
-# Don't rely on test logs being easily accessible from the test runner,
-# though it makes the log noisier.
-test --test_output=errors
-
-# Allows tests to run bazelisk-in-bazel, since this is the cache folder used
-test --test_env=XDG_CACHE_HOME
-
-# Ensure the binaries are build in opt during release.
-build:release --compilation_mode opt

.github/workflows/performance-benchmark.yml

@@ -0,0 +1,315 @@
+name: Performance Benchmark
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+env:
+  BCR_VERSION: "1.11.7"
+  ANALYSIS_BCR_VERSION: "2.0.0-alpha.4"
+
+jobs:
+  startup:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout PR
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          path: rules_py_pr
+
+      - name: Checkout HEAD main
+        uses: actions/checkout@v6
+        with:
+          ref: main
+          path: rules_py_main
+
+      - name: Install hyperfine
+        run: |
+          set -euo pipefail
+          HYPERFINE_VERSION="1.18.0"
+          DEB="hyperfine_${HYPERFINE_VERSION}_amd64.deb"
+          URL="https://github.com/sharkdp/hyperfine/releases/download/v${HYPERFINE_VERSION}/${DEB}"
+          wget -qO "$DEB" "$URL"
+          sudo dpkg -i "$DEB"
+          rm -f "$DEB"
+          hyperfine --version
+
+      # ── BCR baseline ────────────────────────────────────────────────────────
+      - name: Benchmark BCR ${{ env.BCR_VERSION }}
+        run: |
+          set -euo pipefail
+          cd rules_py_pr/benchmark/startup
+          python3 generate_module.py bcr --version "${BCR_VERSION}"
+
+          OUT_BASE="/tmp/bazel-bcr"
+          rm -rf "$OUT_BASE"
+
+          START=$(date +%s%N)
+          bazel --output_base="$OUT_BASE" --bazelrc=../../.github/workflows/ci.bazelrc build --disk_cache= //:bench //:bench_syspath
+          END=$(date +%s%N)
+          BUILD_MS=$(( (END - START) / 1000000 ))
+          echo "{\"build_ms\": $BUILD_MS}" > "${GITHUB_WORKSPACE}/bcr-build.json"
+
+          BIN=$(bazel --output_base="$OUT_BASE" cquery //:bench --disk_cache= --output=starlark --starlark:expr='target.files_to_run.executable.path' | tail -n1)
+          test -x "$BIN" || { echo "ERROR: benchmark binary not executable: $BIN"; exit 1; }
+          RUNFILES_DIR="$PWD/$BIN.runfiles" hyperfine --warmup 5 --runs 50 --export-json "${GITHUB_WORKSPACE}/bcr.json" "$BIN"
+
+          BIN_SP=$(bazel --output_base="$OUT_BASE" cquery //:bench_syspath --disk_cache= --output=starlark --starlark:expr='target.files_to_run.executable.path' | tail -n1)
+          test -x "$BIN_SP" || { echo "ERROR: bench_syspath binary not executable: $BIN_SP"; exit 1; }
+          RUNFILES_DIR="$PWD/$BIN_SP.runfiles" "$BIN_SP" "$GITHUB_WORKSPACE/bcr-syspath.json"
+
+      # ── HEAD main ───────────────────────────────────────────────────────────
+      - name: Benchmark HEAD main
+        run: |
+          set -euo pipefail
+          cd rules_py_pr/benchmark/startup
+          python3 generate_module.py local --path "$GITHUB_WORKSPACE/rules_py_main"
+
+          OUT_BASE="/tmp/bazel-main"
+          rm -rf "$OUT_BASE"
+
+          START=$(date +%s%N)
+          bazel --output_base="$OUT_BASE" --bazelrc=../../.github/workflows/ci.bazelrc build --disk_cache= //:bench //:bench_syspath
+          END=$(date +%s%N)
+          BUILD_MS=$(( (END - START) / 1000000 ))
+          echo "{\"build_ms\": $BUILD_MS}" > "${GITHUB_WORKSPACE}/main-build.json"
+
+          BIN=$(bazel --output_base="$OUT_BASE" cquery //:bench --disk_cache= --output=starlark --starlark:expr='target.files_to_run.executable.path' | tail -n1)
+          test -x "$BIN" || { echo "ERROR: benchmark binary not executable: $BIN"; exit 1; }
+          RUNFILES_DIR="$PWD/$BIN.runfiles" hyperfine --warmup 5 --runs 50 --export-json "${GITHUB_WORKSPACE}/main.json" "$BIN"
+
+          BIN_SP=$(bazel --output_base="$OUT_BASE" cquery //:bench_syspath --disk_cache= --output=starlark --starlark:expr='target.files_to_run.executable.path' | tail -n1)
+          test -x "$BIN_SP" || { echo "ERROR: bench_syspath binary not executable: $BIN_SP"; exit 1; }
+          RUNFILES_DIR="$PWD/$BIN_SP.runfiles" "$BIN_SP" "$GITHUB_WORKSPACE/main-syspath.json"
+
+      # ── Current commit (PR) ─────────────────────────────────────────────────
+      - name: Benchmark current PR
+        run: |
+          set -euo pipefail
+          cd rules_py_pr/benchmark/startup
+          python3 generate_module.py local --path "$GITHUB_WORKSPACE/rules_py_pr"
+
+          OUT_BASE="/tmp/bazel-pr"
+          rm -rf "$OUT_BASE"
+
+          START=$(date +%s%N)
+          bazel --output_base="$OUT_BASE" --bazelrc=../../.github/workflows/ci.bazelrc build --disk_cache= //:bench //:bench_syspath
+          END=$(date +%s%N)
+          BUILD_MS=$(( (END - START) / 1000000 ))
+          echo "{\"build_ms\": $BUILD_MS}" > "${GITHUB_WORKSPACE}/pr-build.json"
+
+          BIN=$(bazel --output_base="$OUT_BASE" cquery //:bench --disk_cache= --output=starlark --starlark:expr='target.files_to_run.executable.path' | tail -n1)
+          test -x "$BIN" || { echo "ERROR: benchmark binary not executable: $BIN"; exit 1; }
+          RUNFILES_DIR="$PWD/$BIN.runfiles" hyperfine --warmup 5 --runs 50 --export-json "${GITHUB_WORKSPACE}/pr.json" "$BIN"
+
+          BIN_SP=$(bazel --output_base="$OUT_BASE" cquery //:bench_syspath --disk_cache= --output=starlark --starlark:expr='target.files_to_run.executable.path' | tail -n1)
+          test -x "$BIN_SP" || { echo "ERROR: bench_syspath binary not executable: $BIN_SP"; exit 1; }
+          RUNFILES_DIR="$PWD/$BIN_SP.runfiles" "$BIN_SP" "$GITHUB_WORKSPACE/pr-syspath.json"
+
+      # ── Compare ─────────────────────────────────────────────────────────────
+      - name: Compare startup results
+        id: compare
+        continue-on-error: true
+        run: |
+          set -euo pipefail
+          python3 rules_py_pr/benchmark/startup/compare.py \
+            --output-table startup-table.txt \
+            bcr.json main.json pr.json
+
+      - name: Save PR number
+        if: github.event_name == 'pull_request'
+        run: echo "${{ github.event.pull_request.number }}" > pr-number.txt
+
+      - name: Upload startup artifacts
+        if: github.event_name == 'pull_request'
+        uses: actions/upload-artifact@v4
+        with:
+          name: startup-benchmark-results
+          path: |
+            startup-table.txt
+            pr-number.txt
+          if-no-files-found: warn
+
+      - name: Fail on regression
+        if: steps.compare.outcome == 'failure'
+        run: exit 1
+
+  analysis:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout PR
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          path: rules_py_pr
+
+      - name: Checkout HEAD main
+        uses: actions/checkout@v6
+        with:
+          ref: main
+          path: rules_py_main
+
+      - name: Install hyperfine
+        run: |
+          set -euo pipefail
+          HYPERFINE_VERSION="1.18.0"
+          DEB="hyperfine_${HYPERFINE_VERSION}_amd64.deb"
+          URL="https://github.com/sharkdp/hyperfine/releases/download/v${HYPERFINE_VERSION}/${DEB}"
+          wget -qO "$DEB" "$URL"
+          sudo dpkg -i "$DEB"
+          rm -f "$DEB"
+          hyperfine --version
+
+      - name: Generate workspace
+        run: |
+          set -euo pipefail
+          cd rules_py_pr/benchmark/analysis
+          python3 workspace/generate_workspace.py --root workspace --packages 50
+
+      # ── BCR baseline ────────────────────────────────────────────────────────
+      - name: Benchmark BCR ${{ env.ANALYSIS_BCR_VERSION }}
+        run: |
+          set -euo pipefail
+          cd rules_py_pr/benchmark/analysis
+          python3 generate_module.py bcr --version "${ANALYSIS_BCR_VERSION}"
+
+          OUT_BASE="/tmp/bazel-bcr"
+          rm -rf "$OUT_BASE"
+
+          bazel --output_base="$OUT_BASE" --bazelrc=../../.github/workflows/ci.bazelrc fetch //workspace/...
+
+          hyperfine --warmup 1 --runs 10 \
+            --prepare 'rm -rf /tmp/bazel-bcr-analysis' \
+            --export-json "${GITHUB_WORKSPACE}/bcr.json" \
+            'bazel --output_base=/tmp/bazel-bcr-analysis --bazelrc=../../.github/workflows/ci.bazelrc build --disk_cache= --nobuild //workspace/...'
+
+          bazel --output_base="$OUT_BASE" --bazelrc=../../.github/workflows/ci.bazelrc query //workspace/... --output=package > /tmp/bcr-packages.txt
+          bazel --output_base="$OUT_BASE" --bazelrc=../../.github/workflows/ci.bazelrc query //workspace/... > /tmp/bcr-targets.txt
+          echo "{\"packages\": $(wc -l < /tmp/bcr-packages.txt | tr -d ' '), \"targets\": $(wc -l < /tmp/bcr-targets.txt | tr -d ' ')}" > "${GITHUB_WORKSPACE}/bcr-aux.json"
+
+      # ── HEAD main ───────────────────────────────────────────────────────────
+      - name: Benchmark HEAD main
+        run: |
+          set -euo pipefail
+          cd rules_py_pr/benchmark/analysis
+          python3 generate_module.py local --path "$GITHUB_WORKSPACE/rules_py_main"
+
+          OUT_BASE="/tmp/bazel-main"
+          rm -rf "$OUT_BASE"
+
+          bazel --output_base="$OUT_BASE" --bazelrc=../../.github/workflows/ci.bazelrc fetch //workspace/...
+
+          hyperfine --warmup 1 --runs 10 \
+            --prepare 'rm -rf /tmp/bazel-main-analysis' \
+            --export-json "${GITHUB_WORKSPACE}/main.json" \
+            'bazel --output_base=/tmp/bazel-main-analysis --bazelrc=../../.github/workflows/ci.bazelrc build --disk_cache= --nobuild //workspace/...'
+
+          bazel --output_base="$OUT_BASE" --bazelrc=../../.github/workflows/ci.bazelrc query //workspace/... --output=package > /tmp/main-packages.txt
+          bazel --output_base="$OUT_BASE" --bazelrc=../../.github/workflows/ci.bazelrc query //workspace/... > /tmp/main-targets.txt
+          echo "{\"packages\": $(wc -l < /tmp/main-packages.txt | tr -d ' '), \"targets\": $(wc -l < /tmp/main-targets.txt | tr -d ' ')}" > "${GITHUB_WORKSPACE}/main-aux.json"
+
+      # ── Current commit (PR) ─────────────────────────────────────────────────
+      - name: Benchmark current PR
+        run: |
+          set -euo pipefail
+          cd rules_py_pr/benchmark/analysis
+          python3 generate_module.py local --path "$GITHUB_WORKSPACE/rules_py_pr"
+
+          OUT_BASE="/tmp/bazel-pr"
+          rm -rf "$OUT_BASE"
+
+          bazel --output_base="$OUT_BASE" --bazelrc=../../.github/workflows/ci.bazelrc fetch //workspace/...
+
+          hyperfine --warmup 1 --runs 10 \
+            --prepare 'rm -rf /tmp/bazel-pr-analysis' \
+            --export-json "${GITHUB_WORKSPACE}/pr.json" \
+            'bazel --output_base=/tmp/bazel-pr-analysis --bazelrc=../../.github/workflows/ci.bazelrc build --disk_cache= --nobuild //workspace/...'
+
+          bazel --output_base="$OUT_BASE" --bazelrc=../../.github/workflows/ci.bazelrc query //workspace/... --output=package > /tmp/pr-packages.txt
+          bazel --output_base="$OUT_BASE" --bazelrc=../../.github/workflows/ci.bazelrc query //workspace/... > /tmp/pr-targets.txt
+          echo "{\"packages\": $(wc -l < /tmp/pr-packages.txt | tr -d ' '), \"targets\": $(wc -l < /tmp/pr-targets.txt | tr -d ' ')}" > "${GITHUB_WORKSPACE}/pr-aux.json"
+
+      # ── Compare ─────────────────────────────────────────────────────────────
+      - name: Compare analysis results
+        id: compare
+        continue-on-error: true
+        run: |
+          set -euo pipefail
+          python3 rules_py_pr/benchmark/analysis/compare.py \
+            --output-table analysis-table.txt \
+            bcr.json main.json pr.json
+
+      - name: Upload analysis artifacts
+        if: github.event_name == 'pull_request'
+        uses: actions/upload-artifact@v4
+        with:
+          name: analysis-benchmark-results
+          path: |
+            analysis-table.txt
+          if-no-files-found: warn
+
+      - name: Fail on regression
+        if: steps.compare.outcome == 'failure'
+        run: exit 1
+
+  comment:
+    runs-on: ubuntu-latest
+    needs: [startup, analysis]
+    if: always() && github.event_name == 'pull_request' && (needs.startup.result == 'success' || needs.startup.result == 'failure') && (needs.analysis.result == 'success' || needs.analysis.result == 'failure')
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Download startup artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: startup-benchmark-results
+
+      - name: Download analysis artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: analysis-benchmark-results
+
+      - name: Post combined benchmark comment
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            const startup = fs.readFileSync('startup-table.txt', 'utf8').trim();
+            const analysis = fs.readFileSync('analysis-table.txt', 'utf8').trim();
+            const prNumber = parseInt(fs.readFileSync('pr-number.txt', 'utf8').trim());
+            const header = '<!-- performance-benchmark -->';
+            const body = `${header}\n\n${startup}\n\n${analysis}`;
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: prNumber,
+            });
+            const existing = comments.find(c => c.body && c.body.includes(header));
+            if (existing) {
+              await github.rest.issues.updateComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: existing.id,
+                body: body,
+              });
+              console.log(`Updated comment ${existing.id}`);
+            } else {
+              const { data: created } = await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: prNumber,
+                body: body,
+              });
+              console.log(`Created comment ${created.id}`);
+            }
+
+      - name: Fail if any benchmark regressed
+        if: needs.startup.result == 'failure' || needs.analysis.result == 'failure'
+        run: exit 1