[bazel] Use hermetic Python

bazel/deps.bzl

@@ -23,3 +23,10 @@ def deps():
         sha256 = "dcc55f810142b6cf46a44d0180a5a7fb923c04a5061e2e8d8eb05ccccc60864b",
         urls = ["https://github.com/bazelbuild/rules_nodejs/releases/download/5.8.0/rules_nodejs-5.8.0.tar.gz"],
     )
+    maybe(
+        http_archive,
+        name = "rules_python",
+        sha256 = "d70cd72a7a4880f0000a6346253414825c19cdd40a28289bdf67b8e6480edff8",
+        strip_prefix = "rules_python-0.28.0",
+        url = "https://github.com/bazelbuild/rules_python/releases/download/0.28.0/rules_python-0.28.0.tar.gz",
+    )

bazel/emscripten_deps.bzl

@@ -1,5 +1,6 @@
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 load("@build_bazel_rules_nodejs//:index.bzl", "node_repositories", "npm_install")
+load("@rules_python//python:repositories.bzl", "py_repositories", "python_register_toolchains")
 load(":revisions.bzl", "EMSCRIPTEN_TAGS")
 
 def _parse_version(v):
@@ -206,3 +207,11 @@ def emscripten_deps(emscripten_version = "latest"):
             package_json = "@emscripten_bin_win//:emscripten/package.json",
             package_lock_json = "@emscripten_bin_win//:emscripten/package-lock.json",
         )
+
+    if "python_toolchains" not in excludes:
+        py_repositories()
+        python_register_toolchains(
+            name = "python_3_11",
+            # Available versions are listed in @rules_python//python:versions.bzl.
+            python_version = "3.11",
+        )

bazel/emscripten_toolchain/BUILD.bazel

@@ -1,3 +1,4 @@
+load("@python_3_11//:defs.bzl", "py_binary")
 load(":toolchain.bzl", "emscripten_cc_toolchain_config_rule")
 
 package(default_visibility = ["//visibility:public"])
@@ -9,6 +10,7 @@ filegroup(
         "env.sh",
         "env.bat",
         "@nodejs//:node_files",
+        "@python_3_11//:python3",
     ],
 )
 
@@ -62,9 +64,9 @@ emscripten_cc_toolchain_config_rule(
     cpu = "wasm",
     em_config = "emscripten_config",
     emscripten_binaries = "@emsdk//:compiler_files",
-    script_extension = select({
-        "@bazel_tools//src/conditions:host_windows": "bat",
-        "//conditions:default": "sh",
+    is_windows = select({
+        "@bazel_tools//src/conditions:host_windows": True,
+        "//conditions:default": False,
     }),
 )
 

bazel/emscripten_toolchain/emar.bat

@@ -2,4 +2,4 @@
 
 call external\emsdk\emscripten_toolchain\env.bat
 
-py -3 %EMSCRIPTEN%\emar.py %*
+%EMSDK_PYTHON% %EMSCRIPTEN%\emar.py %*

bazel/emscripten_toolchain/emar.sh

@@ -2,4 +2,4 @@
 
 source $(dirname $0)/env.sh
 
-exec python3 $EMSCRIPTEN/emar.py "$@"
+exec $EMSDK_PYTHON $EMSCRIPTEN/emar.py "$@"

bazel/emscripten_toolchain/emcc.bat

@@ -2,4 +2,4 @@
 
 call external\emsdk\emscripten_toolchain\env.bat
 
-py -3 %EMSCRIPTEN%\emcc.py %*
+%EMSDK_PYTHON% %EMSCRIPTEN%\emcc.py %*

bazel/emscripten_toolchain/emcc.sh

@@ -2,4 +2,4 @@
 
 source $(dirname $0)/env.sh
 
-exec python3 $EMSCRIPTEN/emcc.py "$@"
+exec $EMSDK_PYTHON $EMSCRIPTEN/emcc.py "$@"

bazel/emscripten_toolchain/emcc_link.bat

@@ -2,4 +2,4 @@
 
 call external\emsdk\emscripten_toolchain\env.bat
 
-py -3 external\emsdk\emscripten_toolchain\link_wrapper.py %*
+%EMSDK_PYTHON% external\emsdk\emscripten_toolchain\link_wrapper.py %*

bazel/emscripten_toolchain/emcc_link.sh

@@ -2,4 +2,4 @@
 
 source $(dirname $0)/env.sh
 
-exec python3 $(dirname $0)/link_wrapper.py "$@"
+exec $EMSDK_PYTHON $(dirname $0)/link_wrapper.py "$@"

bazel/emscripten_toolchain/link_wrapper.py

@@ -1,4 +1,3 @@
-#!/usr/bin/env python
 """wrapper around emcc link step.
 
 This wrapper currently serves the following purposes.

bazel/emscripten_toolchain/toolchain.bzl

@@ -54,6 +54,11 @@ CROSSTOOL_DEFAULT_WARNINGS = [
     "-Wall",
 ]
 
+def _os_path(ctx, path):
+    if ctx.attr.is_windows:
+        path = path.replace("/", "\\")
+    return path
+
 def _impl(ctx):
     target_cpu = ctx.attr.cpu
     toolchain_identifier = "emscripten-" + target_cpu
@@ -74,9 +79,10 @@ def _impl(ctx):
 
     builtin_sysroot = emscripten_dir + "/emscripten/cache/sysroot"
 
-    emcc_script = "emcc.%s" % ctx.attr.script_extension
-    emcc_link_script = "emcc_link.%s" % ctx.attr.script_extension
-    emar_script = "emar.%s" % ctx.attr.script_extension
+    script_extension = "bat" if ctx.attr.is_windows else "sh"
+    emcc_script = "emcc.%s" % script_extension
+    emcc_link_script = "emcc_link.%s" % script_extension
+    emar_script = "emar.%s" % script_extension
 
     ################################################################
     # Tools
@@ -1040,6 +1046,10 @@ def _impl(ctx):
                     key = "EM_CONFIG_PATH",
                     value = ctx.file.em_config.path,
                 ),
+                env_entry(
+                    key = "EMSDK_PYTHON",
+                    value = _os_path(ctx, ctx.file._python_interpreter.path),
+                ),
             ],
         ),
         # Use llvm backend.  Off by default, enabled via --features=llvm_backend
@@ -1114,7 +1124,8 @@ emscripten_cc_toolchain_config_rule = rule(
         "cpu": attr.string(mandatory = True, values = ["asmjs", "wasm"]),
         "em_config": attr.label(mandatory = True, allow_single_file = True),
         "emscripten_binaries": attr.label(mandatory = True, cfg = "exec"),
-        "script_extension": attr.string(mandatory = True, values = ["sh", "bat"]),
+        "is_windows": attr.bool(mandatory = True),
+        "_python_interpreter": attr.label(allow_single_file = True, cfg = "exec", default = Label("@python_3_11//:python3")),
     },
     provides = [CcToolchainConfigInfo],
 )