🐞 bug report

Affected Rule

The issue is caused by the rule: py_binary / py_test

Is this a regression?

Yes.

Description

The stage-1 bootstrap script runs python with PYTHONSAFEPATH=1, which means that no unsafe paths are preprended to the runtime environment of stage-2.

However, the stage-2 script unconditionally deletes sys.path[0]. This is harmless most of the time, since the search path that is deleted is /usr/lib/python311.zip (or similar).

But if the target caller attempts to propagate PYTHONPATH to the application, the first entry in PYTHONPATH is incorrectly removed.

🔬 Minimal Reproduction

script.py:

import sys
print("\n".join(sys.path))

BUILD.bazel:

py_binary(
    name = "script",
    srcs = [":script.py"],
)

Build and run the target with PYTHONPATH=foo:bar, observe that foo is missing from sys.path.

🌍 Your Environment

Operating System:

Linux AMD64 - CentOS 7, and Debian 11

Output of bazel version:

Bazel 7.2.1

Rules_python version:

0.36.0 (but present in 0.37.0 too)