[bazel] Use hermetic Python

bazel/deps.bzl

@@ -23,3 +23,10 @@ def deps():
         sha256 = "dcc55f810142b6cf46a44d0180a5a7fb923c04a5061e2e8d8eb05ccccc60864b",
         urls = ["https://github.com/bazelbuild/rules_nodejs/releases/download/5.8.0/rules_nodejs-5.8.0.tar.gz"],
     )
+    maybe(
+        http_archive,
+        name = "rules_python",
+        sha256 = "d70cd72a7a4880f0000a6346253414825c19cdd40a28289bdf67b8e6480edff8",
+        strip_prefix = "rules_python-0.28.0",
+        url = "https://github.com/bazelbuild/rules_python/releases/download/0.28.0/rules_python-0.28.0.tar.gz",
+    )

bazel/emscripten_deps.bzl

@@ -1,5 +1,6 @@
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 load("@build_bazel_rules_nodejs//:index.bzl", "node_repositories", "npm_install")
+load("@rules_python//python:repositories.bzl", "py_repositories", "python_register_toolchains")
 load(":revisions.bzl", "EMSCRIPTEN_TAGS")
 
 def _parse_version(v):
@@ -206,3 +207,11 @@ def emscripten_deps(emscripten_version = "latest"):
             package_json = "@emscripten_bin_win//:emscripten/package.json",
             package_lock_json = "@emscripten_bin_win//:emscripten/package-lock.json",
         )
+
+    if "python_toolchains" not in excludes:
+        py_repositories()
+        python_register_toolchains(
+            name = "python_3_11",
+            # Available versions are listed in @rules_python//python:versions.bzl.
+            python_version = "3.11",
+        )

bazel/emscripten_toolchain/BUILD.bazel

@@ -1,3 +1,4 @@
+load("@python_3_11//:defs.bzl", "py_binary")
 load(":toolchain.bzl", "emscripten_cc_toolchain_config_rule")
 
 package(default_visibility = ["//visibility:public"])
@@ -9,6 +10,7 @@ filegroup(
         "env.sh",
         "env.bat",
         "@nodejs//:node_files",
+        "@python_3_11//:python3",
     ],
 )
 

bazel/emscripten_toolchain/emar.bat

@@ -2,4 +2,4 @@
 
 call external\emsdk\emscripten_toolchain\env.bat
 
-py -3 %EMSCRIPTEN%\emar.py %*
+%EMSDK_PYTHON% %EMSCRIPTEN%\emar.py %*

bazel/emscripten_toolchain/emar.sh

@@ -2,4 +2,4 @@
 
 source $(dirname $0)/env.sh
 
-exec python3 $EMSCRIPTEN/emar.py "$@"
+exec $EMSDK_PYTHON $EMSCRIPTEN/emar.py "$@"

bazel/emscripten_toolchain/emcc.bat

@@ -2,4 +2,4 @@
 
 call external\emsdk\emscripten_toolchain\env.bat
 
-py -3 %EMSCRIPTEN%\emcc.py %*
+%EMSDK_PYTHON% %EMSCRIPTEN%\emcc.py %*

bazel/emscripten_toolchain/emcc.sh

@@ -2,4 +2,4 @@
 
 source $(dirname $0)/env.sh
 
-exec python3 $EMSCRIPTEN/emcc.py "$@"
+exec $EMSDK_PYTHON $EMSCRIPTEN/emcc.py "$@"

bazel/emscripten_toolchain/emcc_link.bat

@@ -2,4 +2,4 @@
 
 call external\emsdk\emscripten_toolchain\env.bat
 
-py -3 external\emsdk\emscripten_toolchain\link_wrapper.py %*
+%EMSDK_PYTHON% external\emsdk\emscripten_toolchain\link_wrapper.py %*

bazel/emscripten_toolchain/emcc_link.sh

@@ -2,4 +2,4 @@
 
 source $(dirname $0)/env.sh
 
-exec python3 $(dirname $0)/link_wrapper.py "$@"
+exec $EMSDK_PYTHON $(dirname $0)/link_wrapper.py "$@"

bazel/emscripten_toolchain/env.bat

@@ -3,3 +3,4 @@
 set ROOT_DIR=%CD%
 set EMSCRIPTEN=%ROOT_DIR%\%EM_BIN_PATH%\emscripten
 set EM_CONFIG=%ROOT_DIR%\%EM_CONFIG_PATH%
+set EMSDK_PYTHON=%ROOT_DIR%\%EM_PYTHON_PATH%

bazel/emscripten_toolchain/env.sh

@@ -3,3 +3,4 @@
 export ROOT_DIR=${EXT_BUILD_ROOT:-$(pwd -P)}
 export EMSCRIPTEN=$ROOT_DIR/$EM_BIN_PATH/emscripten
 export EM_CONFIG=$ROOT_DIR/$EM_CONFIG_PATH
+export EMSDK_PYTHON=$ROOT_DIR/$EM_PYTHON_PATH

bazel/emscripten_toolchain/link_wrapper.py

@@ -1,4 +1,3 @@
-#!/usr/bin/env python
 """wrapper around emcc link step.
 
 This wrapper currently serves the following purposes.

bazel/emscripten_toolchain/toolchain.bzl

@@ -1040,6 +1040,10 @@ def _impl(ctx):
                     key = "EM_CONFIG_PATH",
                     value = ctx.file.em_config.path,
                 ),
+                env_entry(
+                    key = "EM_PYTHON_PATH",
+                    value = ctx.file._python_interpreter.path,
+                ),
             ],
         ),
         # Use llvm backend.  Off by default, enabled via --features=llvm_backend
@@ -1115,6 +1119,7 @@ emscripten_cc_toolchain_config_rule = rule(
         "em_config": attr.label(mandatory = True, allow_single_file = True),
         "emscripten_binaries": attr.label(mandatory = True, cfg = "exec"),
         "script_extension": attr.string(mandatory = True, values = ["sh", "bat"]),
+        "_python_interpreter": attr.label(allow_single_file = True, cfg = "exec", default = Label("@python_3_11//:python3")),
     },
     provides = [CcToolchainConfigInfo],
 )