feat: Rule for C extensions

.agents/rules/bzl.md

@@ -0,0 +1,10 @@
+---
+trigger: glob
+description: Starlark / Bazel .bzl file coding style rules
+globs: *.bzl
+---
+
+# Starlark Rules
+
+* Use triple-quoted strings for multi-line rule doc args.
+* Don't use backslash line continuation in rule doc args.

.agents/rules/github_actions_workflows.md

@@ -0,0 +1,10 @@
+---
+name: github-actions-workflows
+trigger: glob
+globs: [".github/workflows/*.yml", ".github/workflows/*.yaml", ".github/*.yaml"]
+---
+
+# GitHub Actions Workflows Rule
+
+* When creating files in `.github/workflows/` (such as `.yml` or `.yaml`
+  files), always use the latest version of the referenced GitHub Actions.

.agents/rules/when-to-use-copyright.md

@@ -0,0 +1,8 @@
+---
+trigger: always_on
+---
+
+# When to Use Copyright
+
+Unless directed by the user otherwise, do not add Bazel copyright to new or
+existing files.

.agents/rules/workspace.md

@@ -0,0 +1,18 @@
+---
+trigger: always_on
+---
+
+# Workspace Rules
+
+To avoid confusion from using outdated code states, when starting a new
+conversation/session or when first starting a new branch or worktree, unless
+explicitly instructed otherwise, ensure the latest upstream code is used as the
+basis:
+* Fetch `upstream/main` (`git fetch upstream main`).
+* Base any new branch or worktree upon `upstream/main` (e.g.,
+  `git checkout -b <branch> upstream/main`).
+* Run the workspace helper script to configure upstream tracking and safe
+  pushing:
+  ```bash
+  .agents/scripts/setup_triangle_branch.sh <branch>
+  ```

.agents/scripts/setup_triangle_branch.sh

@@ -0,0 +1,25 @@
+#!/bin/bash
+# Helper script to set up upstream tracking for fork-and-PR workflow.
+set -e
+
+# Detect current branch if not provided as argument
+BRANCH_NAME="${1:-$(git symbolic-ref --short HEAD)}"
+
+if [ -z "$BRANCH_NAME" ]; then
+  echo "Error: Could not detect current branch name." >&2
+  exit 1
+fi
+
+echo "Setting up upstream tracking for branch: $BRANCH_NAME"
+
+# 1. Set the pull/fetch behavior to track the canonical repo's main branch
+git config --local "branch.${BRANCH_NAME}.remote" upstream
+git config --local "branch.${BRANCH_NAME}.merge" refs/heads/main
+
+# 2. Override the destination remote for pushing
+git config --local "branch.${BRANCH_NAME}.pushRemote" origin
+
+# 3. Defend against global push.default settings (ensure it pushes to current branch name)
+git config --local push.default current
+
+echo "Successfully configured upstream/main tracking and origin pushRemote for $BRANCH_NAME!"

.agents/skills/rule-creator/SKILL.md

@@ -0,0 +1,56 @@
+---
+name: rule-creator
+description: Create and format agent rules with proper front matter in the workspace
+---
+
+Use this skill when you need to create a new rule for the agent in the
+workspace.
+
+### Rule File Location
+
+All workspace-specific rules must be created as individual Markdown files under
+the `.agents/rules/` directory:
+```
+.agents/rules/<rule-name>.md
+```
+
+### Rule Format
+
+Every rule file must start with a YAML front matter block defining the trigger
+condition, followed by the rule content in Markdown.
+
+```yaml
+---
+trigger: <trigger-condition>
+---
+
+# <Rule Title>
+
+<Rule description and directives...>
+```
+
+#### Trigger Conditions
+*   `always_on`: The rule is always active and must be followed for all tasks.
+*   Custom triggers: You can specify other trigger conditions if the rule only
+    applies in certain contexts.
+
+### Formatting Guidelines
+*   **Line Wrapping:** Always wrap all text in the rule file (including the
+    title and description) to **80 columns** to ensure readability and
+    compatibility.
+*   **Clarity:** Write clear, actionable directives.
+
+### Example
+
+To create a rule that prevents adding copyrights:
+
+```markdown
+---
+trigger: always_on
+---
+
+# No Copyrights Rule
+
+Unless directed by the user otherwise, do not add Bazel copyright to new or
+existing files.
+```

.bazelci/presubmit.yml

@@ -25,6 +25,10 @@ buildifier:
   bazel: 7.x
   skip_in_bazel_downstream_pipeline: "Bazel 7 required"
 .reusable_config: &reusable_config
+  # USE_BAZEL_DIFF is disabled because target_compatible_with is used heavily,
+  # but BazelCI's bazel-diff integration errors when handling them.
+  # environment:
+  #   USE_BAZEL_DIFF: "1"
   build_targets:
     - "--"
     - "..."
@@ -80,6 +84,9 @@ buildifier:
   coverage_targets: ["..."]
 .coverage_targets_example_bzlmod_build_file_generation: &coverage_targets_example_bzlmod_build_file_generation
   coverage_targets: ["//:bzlmod_build_file_generation_test"]
+.coverage_targets_bootstrap: &coverage_targets_bootstrap
+  coverage_targets:
+    - //tests/bootstrap_impls:stdlib_shadowing_system_python_test
 .coverage_targets_example_multi_python: &coverage_targets_example_multi_python
   coverage_targets:
     - //tests:my_lib_3_10_test
@@ -212,6 +219,7 @@ tasks:
     bazel: 7.x
   ubuntu:
     <<: *reusable_config
+    <<: *coverage_targets_bootstrap
     name: "Default: Ubuntu, Bazel {bazel}"
     platform: ubuntu2204
     bazel: ${{ bazel }}

.bazelignore

@@ -35,4 +35,6 @@ tests/integration/compile_pip_requirements/bazel-compile_pip_requirements
 tests/integration/local_toolchains/bazel-local_toolchains
 tests/integration/py_cc_toolchain_registered/bazel-py_cc_toolchain_registered
 tests/integration/toolchain_target_settings/bazel-module_under_test
+tests/integration/unified_pypi/bazel-unified_pypi
 tests/integration/uv_lock/bazel-uv_lock
+tests/integration/validate_test_main/bazel-module_under_test

.bazelrc.deleted_packages

@@ -7,6 +7,7 @@ common --deleted_packages=examples/bzlmod/entry_points/tests
 common --deleted_packages=examples/bzlmod/libs/my_lib
 common --deleted_packages=examples/bzlmod/other_module
 common --deleted_packages=examples/bzlmod/other_module/other_module/pkg
+common --deleted_packages=examples/bzlmod/other_module/other_module/rule_builder
 common --deleted_packages=examples/bzlmod/patches
 common --deleted_packages=examples/bzlmod/runfiles
 common --deleted_packages=examples/bzlmod/tests
@@ -40,7 +41,9 @@ common --deleted_packages=tests/integration/pip_parse_isolated
 common --deleted_packages=tests/integration/py_cc_toolchain_registered
 common --deleted_packages=tests/integration/runtime_manifests
 common --deleted_packages=tests/integration/toolchain_target_settings
+common --deleted_packages=tests/integration/unified_pypi
 common --deleted_packages=tests/integration/uv_lock
+common --deleted_packages=tests/integration/validate_test_main
 common --deleted_packages=tests/modules/another_module
 common --deleted_packages=tests/modules/other
 common --deleted_packages=tests/modules/other/nspkg_delta

.gitattributes

@@ -3,3 +3,5 @@ tools/publish/*.txt linguist-generated=true
 tests/uv/lock/testdata/requirements.txt text eol=lf
 python/private/runtimes_manifest_workspace.bzl text eol=lf
 python/private/runtimes_manifest.txt text eol=lf
+
+*.bat text eol=crlf

.github/ISSUE_TEMPLATE/release_tracking_template.md

@@ -0,0 +1,32 @@
+---
+name: Release Tracking Issue
+about: Checklist for tracking a new release of rules_python.
+title: 'Release <version>'
+labels: ['type: release']
+---
+# Release tasks
+- [ ] Prepare Release | status=awaiting-preparation
+- [ ] Create Release branch
+- [ ] Tag RC0
+- [ ] Tag Final
+
+## Backports
+
+To request a backport, add it to the checklist below and process it. See [RELEASING.md: How to add backports](https://github.com/bazel-contrib/rules_python/blob/main/RELEASING.md#how-to-add-backports) for details.
+
+---
+
+To manually control the release flow, see the [RELEASING.md: Manual Editing](https://github.com/bazel-contrib/rules_python/blob/main/RELEASING.md#manual-editing-of-tracking-issue) section.
+
+<details>
+<summary><b>Available Commands</b></summary>
+
+Comment commands:
+- `/prepare`: Determines version, creates tracking issue and preparation PR.
+- `/create-rc`: Tags and publishes a new release candidate (RC).
+- `/process-backports`: Cherry-picks pending backports.
+- `/add-backports <PRs>`: Adds PRs to the backports and processes backports.
+- `/promote`: Promotes the latest RC to final release.
+
+See [RELEASING.md](https://github.com/bazel-contrib/rules_python/blob/main/RELEASING.md) for details on how to use them.
+</details>

.github/workflows/automated_pr_review.yaml

@@ -0,0 +1,79 @@
+name: Automated Code Review
+
+# TODO: Eventually, use pull_request_target instead of pull_request.
+# pull_request_target runs in the base branch context and has access
+# to secrets (like GEMINI_API_KEY) even for fork PRs.
+# Using pull_request for now during setup/testing.
+on:
+  issue_comment:
+    types: [created]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  # Always runs so the workflow run exits cleanly without a "No jobs ran" error
+  # when the review job's if-condition evaluates to false.
+  noop:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Workflow trigger check
+        run: echo "Workflow triggered successfully."
+
+  review:
+    runs-on: ubuntu-latest
+    # Trigger only if it is a regular comment on a pull request, the comment body has a line
+    # starting with "/review", and the commenter is a maintainer (OWNER, MEMBER, or COLLABORATOR).
+    if: >
+      github.event_name == 'issue_comment' && github.event.issue.pull_request != null &&
+      (startsWith(github.event.comment.body, '/review') ||
+       contains(github.event.comment.body, '\n/review') ||
+       contains(github.event.comment.body, '\r\n/review')) &&
+      contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association)
+    steps:
+      - name: Checkout PR Branch
+        uses: actions/checkout@v7
+        with:
+          # Note: In GHA, during an issue_comment event on a PR, github.event.pull_request is null
+          # and the PR number is placed inside github.event.issue.number (because every PR is an issue).
+          # Therefore, github.event.issue.number is the PR number when checking out refs/pull/<number>/head.
+          ref: refs/pull/${{ github.event.pull_request.number || github.event.issue.number }}/head
+          persist-credentials: false
+
+      - name: Fetch Base Branch and Negotiate Minimal Diff History
+        env:
+          PR_COMMITS: ${{ github.event.pull_request.commits }}
+        run: |
+          # 1. Fetch the tip of main
+          git fetch origin main:refs/remotes/origin/main --depth=1
+
+          # 2. Check if we already have the merge base (common ancestor)
+          if ! git merge-base origin/main HEAD >/dev/null 2>&1; then
+            # If we know the exact number of commits in the PR, deepen by (PR_COMMITS + 10)
+            if [ -n "$PR_COMMITS" ] && [ "$PR_COMMITS" != "null" ]; then
+              git fetch --deepen="$((PR_COMMITS + 10))"
+            fi
+            # 3. If it's an issue_comment event (where PR_COMMITS is null) or still shallow, unshallow/deepen
+            if ! git merge-base origin/main HEAD >/dev/null 2>&1; then
+              git fetch --unshallow || git fetch --deepen=50
+            fi
+          fi
+
+      - name: Checkout Reviewbot (Base Branch)
+        uses: actions/checkout@v7
+        with:
+          sparse-checkout: |
+            tools/private/reviewbot
+          path: reviewbot
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v8.3.0
+
+      - name: Run Antigravity Review
+        env:
+          GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          uv run reviewbot/tools/private/reviewbot/antigravity_review.py \
+            --prompt reviewbot/tools/private/reviewbot/prompt.txt

.github/workflows/check_version_markers.sh

@@ -20,9 +20,8 @@ grep_exit_code=0
 # Exclude CONTRIBUTING.md, RELEASING.md because they document how to use these strings.
 grep --exclude=CONTRIBUTING.md \
   --exclude=RELEASING.md \
-  --exclude=release.py \
-  --exclude=release_test.py \
   --exclude-dir=.* \
+  --exclude-dir=release \
   VERSION_NEXT_ -r || grep_exit_code=$?
 
 if [[ $grep_exit_code -eq 0 ]]; then

.github/workflows/ci.yaml

@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       # Checkout the code
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: jpetrucciani/mypy-check@master
         with:
           path: 'python/runfiles'
@@ -31,13 +31,13 @@ jobs:
   ruff:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: astral-sh/ruff-action@v4.0.0
+      - uses: actions/checkout@v7
+      - uses: astral-sh/ruff-action@v4.1.0
         with:
           # Keep in sync with .pre-commit-config.yaml
           version: 0.15.14
           args: check --extend-exclude testdata
-      - uses: astral-sh/ruff-action@v4.0.0
+      - uses: astral-sh/ruff-action@v4.1.0
         with:
           version: 0.15.14
           args: format --check --exclude testdata