python: stand up uv workspace and rules_python pip.parse chain

.devcontainer/Dockerfile

@@ -6,6 +6,14 @@ ARG BAZELISK_VERSION=v1.29.0
 # renovate: datasource=github-releases depName=bazelbuild/buildtools
 ARG BUILDIFIER_VERSION=v8.5.1
 
+# uv: the workspace's Python package manager. Single source of truth for the
+# uv.lock + requirements_lock.txt chain consumed by rules_python's pip.parse
+# and enforced by the `uv-lock-fresh` pre-commit hook. Installed first so
+# later PRs can layer `uv tool install ruff ty pre-commit` on top of it.
+# Pinned tag bumped by Renovate's docker manager (matches the pattern used in
+# ~/.dotfiles/.devcontainer/Dockerfile).
+COPY --from=ghcr.io/astral-sh/uv:0.9.30 /uv /uvx /usr/local/bin/
+
 RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
         build-essential \
         ca-certificates \

.github/workflows/ci.yml

@@ -105,7 +105,7 @@ jobs:
           - platform: linux_x86_64
             runner: ubuntu-latest
           - platform: linux_arm64
-            runner: ubuntu-latest
+            runner: ubuntu-24.04-arm
           - platform: darwin_arm64
             runner: macos-latest
     steps:
@@ -114,9 +114,11 @@ jobs:
         with:
           buildbuddy-api-key: ${{ secrets.BUILDBUDDY_API_KEY }}
       # `--config=ci` brings in remote cache + BES; `--config=<platform>` pins the target
-      # platform explicitly. Linux actions execute on BuildBuddy executors of the matching
-      # arch (so the runner OS doesn't need to match the target); darwin actions execute on
-      # the runner since BB has no macOS executors.
+      # platform explicitly. Each row's runner matches its target arch — required for
+      # Python (`@pypi` wheel resolution is host-bound; see CLAUDE.md "Python Purity Is
+      # Not Enforced"). The matching runner also keeps test execution native: BB
+      # executors of the same arch are registered as candidates via `--config=<platform>`,
+      # darwin executes on the runner itself since BB has no macOS executors.
       - run: bazel test --config=ci --config=${{ matrix.platform }} //...
 
   build-and-test-all:

.pre-commit-config.yaml

@@ -8,6 +8,16 @@ repos:
         pass_filenames: false
         files: go\.(mod|work|sum)$
 
+      - id: uv-lock-fresh
+        name: uv lock + export
+        language: system
+        # Re-runs the lock and the requirements_lock.txt export so a pyproject
+        # edit can't land without the derived files. uv.lock is the source of
+        # truth; requirements_lock.txt is what rules_python's pip.parse reads.
+        entry: bash -c 'set -euo pipefail; uv lock; uv export --format requirements-txt --no-hashes --no-emit-project --output-file requirements_lock.txt'
+        pass_filenames: false
+        files: ^(pyproject\.toml|uv\.lock|requirements_lock\.txt)$
+
       - id: gazelle
         name: gazelle
         language: system

MODULE.bazel

@@ -39,9 +39,21 @@ go_sdk = use_extension("@rules_go//go:extensions.bzl", "go_sdk")
 #
 # Renovate's regex matcher in renovate.json picks up each occurrence; bumps will
 # arrive as one grouped PR ("Language toolchain SDKs") keeping all three in sync.
-go_sdk.download(version = "1.26.4", goos = "linux", goarch = "amd64")
-go_sdk.download(version = "1.26.4", goos = "linux", goarch = "arm64")
-go_sdk.download(version = "1.26.4", goos = "darwin", goarch = "arm64")
+go_sdk.download(
+    goarch = "amd64",
+    goos = "linux",
+    version = "1.26.4",
+)
+go_sdk.download(
+    goarch = "arm64",
+    goos = "linux",
+    version = "1.26.4",
+)
+go_sdk.download(
+    goarch = "arm64",
+    goos = "darwin",
+    version = "1.26.4",
+)
 
 # Discover external Go deps from the workspace's go.work + per-module go.mod files.
 go_deps = use_extension("@gazelle//:extensions.bzl", "go_deps")
@@ -62,14 +74,36 @@ bazel_dep(name = "rules_python", version = "2.0.1")
 # that release as a version-bump PR; that PR is the prompt to drop this override.
 git_override(
     module_name = "rules_python",
-    remote = "https://github.com/bazel-contrib/rules_python.git",
     commit = "8b38325e7c1b8b3240088b14d5ba2e5316aceabc",
+    remote = "https://github.com/bazel-contrib/rules_python.git",
 )
 
 python = use_extension("@rules_python//python/extensions:python.bzl", "python")
 python.toolchain(
-    python_version = "3.14",
     # Wires the bundled `coverage` library into py_test runfiles when
     # `bazel coverage` runs, so Python tests emit lcov data alongside Go.
     configure_coverage_tool = True,
+    python_version = "3.14",
 )
+
+# Materialise the third-party Python deps locked by uv. The chain is:
+#   pyproject.toml  →  uv.lock  →  requirements_lock.txt  →  pip.parse  →  @pypi//...
+# uv.lock is the source of truth; requirements_lock.txt is its `uv export`
+# projection (rules_python does not read uv.lock natively). A pre-commit hook
+# keeps the two in sync; see `uv-lock-fresh` in .pre-commit-config.yaml.
+pip = use_extension("@rules_python//python/extensions:pip.bzl", "pip")
+pip.parse(
+    hub_name = "pypi",
+    python_version = "3.14",
+    requirements_lock = "//:requirements_lock.txt",
+)
+use_repo(pip, "pypi")
+
+# DEFERRED: rules_python_gazelle_plugin (a.k.a. gazelle_python) is not wired
+# here. The plugin's gazelle binary pulls in smacker/go-tree-sitter via CGO,
+# which does not compile under our Go 1.26.4 SDK (upstream issue
+# bazel-contrib/rules_python#3416; the migration to a pure-Go binding is in
+# the unmerged bazel-contrib/rules_python#3786). Until #3786 ships in a
+# release, Python BUILD files are hand-authored. See
+# `docs/future-considerations.md` (Python BUILD generation) for the trigger
+# that brings this back in.