[WIP] Bazel builds should be hermetic, but they're not

[kris524]

No description provided.

[gemini-code-assist]

Code Review

This pull request integrates rules_python into the WORKSPACE file to configure a hermetic Python 3.11 toolchain and manage pip dependencies. However, a critical Bazel loading error was identified because @python_3_11 is a toolchain repository and does not contain defs.bzl or expose an interpreter target. The reviewer provided a fix to reference @python_3_11_host//:python directly as the interpreter target.

[gemini-code-assist]

The repository @python_3_11 is a toolchain repository and does not contain a defs.bzl file or expose an interpreter target. Attempting to load from @python_3_11//:defs.bzl will cause a critical Bazel loading phase error, preventing any Bazel commands from running.

Instead, you should reference the hermetic interpreter target directly using @python_3_11_host//:python as the python_interpreter_target in pip_parse.

# Parse locked requirements.
# pip_parse needs a lockfile, not a bare requirements.txt.
# We'll generate the lockfile in step 2.
load("@rules_python//python:pip.bzl", "pip_parse")

pip_parse(
    name = "pip",
    python_interpreter_target = "@python_3_11_host//:python",
    requirements_lock = "//:requirements_lock.txt",
)