[ScriptedAlchemy]

The GitHub release URL for rules_python-2.4.6.tar.gz returned HTTP 504 before Bazel could run targets on hosted Linux and Windows. The same URL with ?download=1 also returned 504. The official release API served 1,755,063 bytes matching the SHA-256 in the Bazel Central Registry. Linux repository gates · #4827 Windows · #4834 Windows

Hosted runners share public network quotas. The setup passes the job-scoped GitHub token only to the release API fetch step. With local TLS endpoints and a placeholder credential, ten transfers across Linux, macOS and Windows confirmed that the GitHub API received the optional header and the redirected storage host never did. The header is supplied on standard input, and both the original request and redirects require HTTPS.

The shared GitHub-hosted Bazel setup stages the original archive basename in its runner-private distdir on Linux, macOS and Windows. It formats the Windows temporary path for Git Bash and native Bazel. Only Linux x86-64 receives the two Linux launchers from #4837. Bazel retains the registry integrity policy and original download configuration. When the optional API is unavailable the setup leaves the missing file to the ordinary downloader. Registry metadata · Official release asset

With separate cold repository and contents caches on Bazel 9.3.2, the actual @rules_python fetch failed when the original archive URL was redirected to a closed local port. Under that same condition, the production-staged archive passed registry integrity and extracted successfully. Invalid bytes at the correct basename failed. A refused API connection also left the directory empty, emitted a fallback notice and allowed setup to continue.

On macOS, the production helper was exercised with hosted Linux x86-64, Linux ARM64, macOS ARM64 and Windows x86-64 environment values. Every case produced the expected files with the release/BCR digests. Bash ShellCheck, composite YAML parsing and actionlint passed. Git combined 2bc8cecb4e with the independent cache-key change without conflicts. The hosted workflow at that head includes the Linux fleet and both affected suites on native Windows and macOS. The native macOS runner then failed to resolve both api.github.com and releases.bazel.build before running Bazel. At f552c1ff15, this draft is stacked on the hosted macOS DNS repair. The release staging patch retains its exact stable patch ID. The new native macOS verification selects the same two suites. Keep this prerequisite draft for independent review and hosted qualification.

[changeset-bot]

⚠️ No Changeset found

Latest commit: f552c1f

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR