Provide `PYTHON_FOR_BUILD` to CPython's Windows build by rdesgroppes · Pull Request #48281 · DataDog/datadog-agent

rdesgroppes · 2026-03-24T10:37:05Z

What does this PR do?

add @python_3_12//:python3 (current rules_python's hermetic interpreter) to python_win's srcs and expose it as PYTHON_FOR_BUILD,
resolve it to an absolute path in build_python.bat before build.bat is called, so MSBuild can use it regardless of its working directory.

Motivation

CPython's PCbuild/find_python.bat looks for a Python interpreter to perform pre-compilation code generation (opcodes, grammar, token tables) and to orchestrate PGO training runs.

When PYTHON_FOR_BUILD is not set, find_python.bat falls back through the following chain, each of which fails in a Bazel action running under --incompatible_strict_action_env (Bazel 9's default BTW):

VIRTUAL_ENV,
externals directory,
HOST_PYTHON,
py.exe launcher,
NuGet download: failed for me... which surfaced the hermeticity issue.

PYTHON_FOR_BUILD is CPython's dedicated variable for the (3.6+) interpreter used to build CPython itself, as opposed to the one being built (i.e. 3.13.12 as of today).

Describe how you validated your changes

Confirmed on a local Windows VM that find_python.bat reports "found as PYTHON_FOR_BUILD" and proceeds past code generation.

Additional Notes

Found while making progress towards #48206; split out so it can be reviewed/merged/reverted independently.

### What does this PR do? - add `@python_3_12//:python3` (current `rules_python`'s hermetic interpreter) to `python_win`'s srcs and expose it as [PYTHON_FOR_BUILD](https://github.com/python/cpython/blob/3.12/PCbuild/readme.txt#L230), - resolve it to an absolute path in `build_python.bat` before `build.bat` is called, so MSBuild can use it regardless of its working directory ### Motivation CPython's `PCbuild/find_python.bat` looks for a Python interpreter to perform pre-compilation code generation (opcodes, grammar, token tables) and to orchestrate PGO training runs. When `PYTHON_FOR_BUILD` is not set, [find_python.bat](https://github.com/python/cpython/blob/3.12/PCbuild/find_python.bat) falls back through the following chain, each of which fails in a Bazel action running under `--incompatible_strict_action_env` (Bazel 9's default BTW): 1. `VIRTUAL_ENV`, 2. `externals` directory, 3. `HOST_PYTHON`, 4. `py.exe` launcher, 5. `NuGet` download: **failed for me**, which surfaced the hermeticity issue. `PYTHON_FOR_BUILD` is CPython's dedicated variable for the interpreter used to **build** CPython itself, as opposed to the one **being built**. ### Describe how you validated your changes Confirmed on a local Windows VM that `find_python.bat` reports "found as PYTHON_FOR_BUILD" and proceeds past code generation. ### Additional Notes Found while making progress towards #48206; split out so it can be reviewed/merged/reverted independently.

agent-platform-auto-pr · 2026-03-24T11:11:18Z

Files inventory check summary

File checks results against ancestor 70d7d910:

Results for datadog-agent_7.79.0~devel.git.98.894c67d.pipeline.104148767-1_amd64.deb:

No change detected

chouquette · 2026-03-24T11:23:28Z

deps/cpython.BUILD.bazel

            "libffi_win_dir",
            "openssl-bin_win_dir",
            "tcltk_win_dir",
+            "@python_3_12//:python3",


does that work while building python 3.13? I thought python required the local interpreter to match the version being built

guess who didn't read the PR description before reviewing the change...

https://github.com/python/cpython/blob/3.13/PCbuild/readme.txt#L6-L8:

1a. Optionally install Python 3.6 or later. If not installed, get_externals.bat (via build.bat) will download and use Python via NuGet.

I suppose the requirement for matching version only applies to cross compilation then, my bad!

According to the readme, as linked in the PR description, yes: https://github.com/python/cpython/blob/3.13/PCbuild/readme.txt#L6

As far as I remember this python is used to run specific scripts during the build and doesn't need to match the python being built. https://github.com/search?q=repo%3Apython%2Fcpython%20PythonForBuild&type=code

The only concern with this reference now is that iiuc it needs to stay in sync with

datadog-agent/MODULE.bazel

Line 235 in 281dbad

PYTHON_VERSION = "3.12"

. But we could address that later for sure.

EDIT: And of course my comment came in late :D

That being said, Python 3.10+ will be required for Python 3.14, https://github.com/python/cpython/blob/3.14/PCbuild/readme.txt#L6-L8:

1a. Optionally install Python 3.10 or later. If not installed, get_externals.bat (via build.bat) will download and use Python via NuGet.

TBH, I didn't find a quick alias to the configured toolchain's Python interpreter. It's possible by mean of a repo rule... overkill, I guess.

cit-pr-commenter-54b7da · 2026-03-24T11:31:34Z

Regression Detector

Regression Detector Results

Metrics dashboard
Target profiles
Run ID: 30aceadc-b77c-4d0e-b0c0-730996728c39

Baseline: 89faa04
Comparison: 9701535
Diff

Optimization Goals: ✅ No significant changes detected

Experiments ignored for regressions

Regressions in experiments with settings containing erratic: true are ignored.

perf	experiment	goal	Δ mean %	Δ mean % CI	trials	links
➖	docker_containers_cpu	% cpu utilization	-0.57	[-3.66, +2.52]	1	Logs

Fine details of change detection per experiment

perf	experiment	goal	Δ mean %	Δ mean % CI	trials	links
➖	quality_gate_logs	% cpu utilization	+2.02	[+0.37, +3.68]	1	Logs bounds checks dashboard
➖	quality_gate_idle	memory utilization	+0.31	[+0.26, +0.37]	1	Logs bounds checks dashboard
➖	docker_containers_memory	memory utilization	+0.28	[+0.20, +0.36]	1	Logs
➖	quality_gate_metrics_logs	memory utilization	+0.22	[-0.01, +0.45]	1	Logs bounds checks dashboard
➖	ddot_logs	memory utilization	+0.13	[+0.06, +0.19]	1	Logs
➖	file_tree	memory utilization	+0.09	[+0.04, +0.14]	1	Logs
➖	file_to_blackhole_100ms_latency	egress throughput	+0.06	[-0.03, +0.15]	1	Logs
➖	file_to_blackhole_1000ms_latency	egress throughput	+0.03	[-0.41, +0.46]	1	Logs
➖	file_to_blackhole_0ms_latency	egress throughput	+0.01	[-0.50, +0.53]	1	Logs
➖	ddot_metrics_sum_cumulative	memory utilization	+0.01	[-0.13, +0.16]	1	Logs
➖	uds_dogstatsd_to_api	ingress throughput	+0.01	[-0.19, +0.20]	1	Logs
➖	file_to_blackhole_500ms_latency	egress throughput	+0.00	[-0.39, +0.40]	1	Logs
➖	uds_dogstatsd_to_api_v3	ingress throughput	+0.00	[-0.19, +0.20]	1	Logs
➖	tcp_dd_logs_filter_exclude	ingress throughput	-0.00	[-0.11, +0.11]	1	Logs
➖	otlp_ingest_metrics	memory utilization	-0.03	[-0.20, +0.13]	1	Logs
➖	uds_dogstatsd_20mb_12k_contexts_20_senders	memory utilization	-0.07	[-0.13, -0.01]	1	Logs
➖	ddot_metrics	memory utilization	-0.08	[-0.25, +0.10]	1	Logs
➖	ddot_metrics_sum_cumulativetodelta_exporter	memory utilization	-0.09	[-0.32, +0.13]	1	Logs
➖	quality_gate_idle_all_features	memory utilization	-0.10	[-0.13, -0.06]	1	Logs bounds checks dashboard
➖	ddot_metrics_sum_delta	memory utilization	-0.15	[-0.32, +0.01]	1	Logs
➖	docker_containers_cpu	% cpu utilization	-0.57	[-3.66, +2.52]	1	Logs
➖	otlp_ingest_logs	memory utilization	-0.62	[-0.71, -0.52]	1	Logs
➖	tcp_syslog_to_blackhole	ingress throughput	-0.75	[-0.89, -0.61]	1	Logs

Bounds Checks: ❌ Failed

perf	experiment	bounds_check_name	replicates_passed	observed_value	links
✅	docker_containers_cpu	simple_check_run	10/10	741 ≥ 26
✅	docker_containers_memory	memory_usage	10/10	276.16MiB ≤ 370MiB
✅	docker_containers_memory	simple_check_run	10/10	685 ≥ 26
✅	file_to_blackhole_0ms_latency	memory_usage	10/10	0.19GiB ≤ 1.20GiB
✅	file_to_blackhole_0ms_latency	missed_bytes	10/10	0B = 0B
✅	file_to_blackhole_1000ms_latency	memory_usage	10/10	0.23GiB ≤ 1.20GiB
✅	file_to_blackhole_1000ms_latency	missed_bytes	10/10	0B = 0B
✅	file_to_blackhole_100ms_latency	memory_usage	10/10	0.20GiB ≤ 1.20GiB
✅	file_to_blackhole_100ms_latency	missed_bytes	10/10	0B = 0B
✅	file_to_blackhole_500ms_latency	memory_usage	10/10	0.22GiB ≤ 1.20GiB
✅	file_to_blackhole_500ms_latency	missed_bytes	10/10	0B = 0B
✅	quality_gate_idle	intake_connections	10/10	3 = 3	bounds checks dashboard
❌	quality_gate_idle	memory_usage	9/10	176.79MiB > 175MiB	bounds checks dashboard
✅	quality_gate_idle_all_features	intake_connections	10/10	2 ≤ 3	bounds checks dashboard
✅	quality_gate_idle_all_features	memory_usage	10/10	494.29MiB ≤ 550MiB	bounds checks dashboard
✅	quality_gate_logs	intake_connections	10/10	3 ≤ 6	bounds checks dashboard
✅	quality_gate_logs	memory_usage	10/10	208.73MiB ≤ 220MiB	bounds checks dashboard
✅	quality_gate_logs	missed_bytes	10/10	0B = 0B	bounds checks dashboard
✅	quality_gate_metrics_logs	cpu_usage	10/10	350.77 ≤ 2000	bounds checks dashboard
✅	quality_gate_metrics_logs	intake_connections	10/10	4 ≤ 6	bounds checks dashboard
✅	quality_gate_metrics_logs	memory_usage	10/10	403.78MiB ≤ 475MiB	bounds checks dashboard
✅	quality_gate_metrics_logs	missed_bytes	10/10	0B = 0B	bounds checks dashboard

Explanation

Confidence level: 90.00%
Effect size tolerance: |Δ mean %| ≥ 5.00%

Performance changes are noted in the perf column of each table:

✅ = significantly better comparison variant performance
❌ = significantly worse comparison variant performance
➖ = no significant change in performance

A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".

For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:

Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.
Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.
Its configuration does not mark it "erratic".

CI Pass/Fail Decision

❌ Failed. Some Quality Gates were violated.

quality_gate_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
quality_gate_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
quality_gate_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
quality_gate_idle, bounds check intake_connections: 10/10 replicas passed. Gate passed.
quality_gate_idle, bounds check memory_usage: 9/10 replicas passed. Failed 1 which is > 0. Gate FAILED.
quality_gate_metrics_logs, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
quality_gate_metrics_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
quality_gate_metrics_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
quality_gate_metrics_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
quality_gate_idle_all_features, bounds check intake_connections: 10/10 replicas passed. Gate passed.
quality_gate_idle_all_features, bounds check memory_usage: 10/10 replicas passed. Gate passed.

agent-platform-auto-pr · 2026-03-24T11:34:52Z

Static quality checks

✅ Please find below the results from static quality gates
Comparison made with ancestor 70d7d91
📊 Static Quality Gates Dashboard
🔗 SQG Job

31 successful checks with minimal change (< 2 KiB)

	Quality gate	Current Size
✅	agent_deb_amd64	752.799 MiB
✅	agent_deb_amd64_fips	709.755 MiB
✅	agent_heroku_amd64	313.157 MiB
✅	agent_msi	604.646 MiB
✅	agent_rpm_amd64	752.783 MiB
✅	agent_rpm_amd64_fips	709.738 MiB
✅	agent_rpm_arm64	731.146 MiB
✅	agent_rpm_arm64_fips	691.134 MiB
✅	agent_suse_amd64	752.783 MiB
✅	agent_suse_amd64_fips	709.738 MiB
✅	agent_suse_arm64	731.146 MiB
✅	agent_suse_arm64_fips	691.134 MiB
✅	docker_agent_amd64	813.110 MiB
✅	docker_agent_arm64	816.235 MiB
✅	docker_agent_jmx_amd64	1004.025 MiB
✅	docker_agent_jmx_arm64	995.929 MiB
✅	docker_cluster_agent_amd64	205.320 MiB
✅	docker_cluster_agent_arm64	219.677 MiB
✅	docker_cws_instrumentation_amd64	7.142 MiB
✅	docker_cws_instrumentation_arm64	6.689 MiB
✅	docker_dogstatsd_amd64	39.230 MiB
✅	docker_dogstatsd_arm64	37.445 MiB
✅	dogstatsd_deb_amd64	29.874 MiB
✅	dogstatsd_deb_arm64	28.026 MiB
✅	dogstatsd_rpm_amd64	29.874 MiB
✅	dogstatsd_suse_amd64	29.874 MiB
✅	iot_agent_deb_amd64	43.262 MiB
✅	iot_agent_deb_arm64	40.309 MiB
✅	iot_agent_deb_armhf	41.052 MiB
✅	iot_agent_rpm_amd64	43.262 MiB
✅	iot_agent_suse_amd64	43.262 MiB

On-wire sizes (compressed)

	Quality gate	Change	Size (prev → curr → max)
✅	agent_deb_amd64	+49.13 KiB (0.03% increase)	174.789 → 174.837 → 178.360
✅	agent_deb_amd64_fips	+8.95 KiB (0.01% increase)	165.394 → 165.403 → 172.790
✅	agent_heroku_amd64	neutral	74.987 MiB → 79.970
✅	agent_msi	+16.0 KiB (0.01% increase)	138.344 → 138.359 → 146.220
✅	agent_rpm_amd64	+11.72 KiB (0.01% increase)	177.657 → 177.669 → 181.830
✅	agent_rpm_amd64_fips	+8.35 KiB (0.00% increase)	167.681 → 167.689 → 173.370
✅	agent_rpm_arm64	-39.98 KiB (0.02% reduction)	159.646 → 159.606 → 163.060
✅	agent_rpm_arm64_fips	+31.47 KiB (0.02% increase)	151.510 → 151.540 → 156.170
✅	agent_suse_amd64	+11.72 KiB (0.01% increase)	177.657 → 177.669 → 181.830
✅	agent_suse_amd64_fips	+8.35 KiB (0.00% increase)	167.681 → 167.689 → 173.370
✅	agent_suse_arm64	-39.98 KiB (0.02% reduction)	159.646 → 159.606 → 163.060
✅	agent_suse_arm64_fips	+31.47 KiB (0.02% increase)	151.510 → 151.540 → 156.170
✅	docker_agent_amd64	+17.36 KiB (0.01% increase)	268.254 → 268.271 → 272.480
✅	docker_agent_arm64	+18.12 KiB (0.01% increase)	255.462 → 255.480 → 261.060
✅	docker_agent_jmx_amd64	+13.29 KiB (0.00% increase)	336.909 → 336.922 → 341.100
✅	docker_agent_jmx_arm64	+16.06 KiB (0.00% increase)	320.096 → 320.112 → 325.620
✅	docker_cluster_agent_amd64	neutral	71.926 MiB → 72.920
✅	docker_cluster_agent_arm64	neutral	67.499 MiB → 68.220
✅	docker_cws_instrumentation_amd64	neutral	2.999 MiB → 3.330
✅	docker_cws_instrumentation_arm64	neutral	2.729 MiB → 3.090
✅	docker_dogstatsd_amd64	neutral	15.169 MiB → 15.820
✅	docker_dogstatsd_arm64	neutral	14.490 MiB → 14.830
✅	dogstatsd_deb_amd64	neutral	7.890 MiB → 8.790
✅	dogstatsd_deb_arm64	neutral	6.775 MiB → 7.710
✅	dogstatsd_rpm_amd64	neutral	7.900 MiB → 8.800
✅	dogstatsd_suse_amd64	neutral	7.900 MiB → 8.800
✅	iot_agent_deb_amd64	+3.27 KiB (0.03% increase)	11.393 → 11.396 → 12.040
✅	iot_agent_deb_arm64	neutral	9.698 MiB → 10.450
✅	iot_agent_deb_armhf	neutral	9.934 MiB → 10.620
✅	iot_agent_rpm_amd64	+2.39 KiB (0.02% increase)	11.410 → 11.412 → 12.060
✅	iot_agent_suse_amd64	+2.39 KiB (0.02% increase)	11.410 → 11.412 → 12.060

### What does this PR do? - add `common:windows --enable_runfiles` to `.bazelrc` - widen `bazel:test:windows-amd64` from `//bazel/tests/... //rtloader/...` to `//...` with exclusions for Linux-, eBPF-, and gopatch-only targets ### Motivation rules_python 1.9.0 (#48082) transitions every `py_binary` and `py_test` on Windows from `enable_runfiles=auto` to `enable_runfiles=true`. With Bazel's default (`enable_runfiles=false` on Windows), this creates a second Bazel configuration, causing `python_win` to be built twice concurrently. `build_python.bat` writes MSBuild intermediates to the shared execroot source tree rather than the action's output directory, so both builds race on those files, causing intermittent `pyconfig.h` failures. This is a redo of #48188, which was preemptively reverted (#48207). Pre-setting `--enable_runfiles` makes the transition a no-op, so Bazel sees a single configuration and builds `python_win` once. Two prerequisites are now in place: #48281 provides `PYTHON_FOR_BUILD` to MSBuild, preventing `find_python.bat` from falling back to NuGet and other external sources under `--incompatible_strict_action_env`; #48087 and #48209 trigger Windows CI on `MODULE.bazel*` and `.bazel*` changes respectively, so the widened test surface below will catch regressions before they reach `main`. ### Describe how you validated your changes Local VM and, of course, CI. ### Additional Notes `//pkg/template/...` is excluded on Windows: gopatch v0.4.0 errors on `@@\r` in hunk markers when patch files have CRLF line endings, an unreported upstream bug with no workaround in gopatch itself.

Prior art: 1. #48082 2. #48087 3. #48188 (1st attempt) 4. #48207 5. #48281 6. #48209 ### What does this PR do? This is a redo of #48188 (preemptively reverted by #48207) and therefore merely consists in re-adding `common:windows --enable_runfiles` to `.bazelrc`. ... with lessons learned, thanks to earlier: - #48209 covers the present change to `.bazelrc`, - #48281 prevents `find_python.bat` from falling back to `NuGet` or other non hermetic sources. .... and now a widened `bazel:test:windows-amd64`, evolving from just `//bazel/tests/... //rtloader/...` to `//...` **- except currently failing targets** (for the time being, of course). ### Motivation Summary of #48188: - `rules_python` 1.9.0 (#48082) transitions every `py_binary` and `py_test` on Windows from `enable_runfiles=auto` to `enable_runfiles=true`, - with Bazel's default (`enable_runfiles=false` on Windows), this creates a second Bazel configuration, causing `python_win` to be built twice concurrently, - `build_python.bat` writes `MSBuild` intermediates to the shared execroot source tree rather than the action's output directory, so both builds race on those files, causing [intermittent failures](https://gitlab.ddbuild.io/DataDog/datadog-agent/-/jobs/1533753039) (`pyconfig.h` not found, etc.). **Pre-setting `--enable_runfiles` makes the transition a no-op, so Bazel sees a single configuration and builds `python_win` once.** ### Describe how you validated your changes Local VM and, of course, CI. ### Additional Notes For instance, `//pkg/template/...` is excluded on Windows because `gopatch` errors on `@@\r` in hunk markers when patch files have CRLF line endings, which deserves a distinct PR (likely adjusting `.gitattributes`). Co-authored-by: regis.desgroppes <regis.desgroppes@datadoghq.com>

### What does this PR do? - add `@python_3_12//:python3` (current `rules_python`'s hermetic interpreter) to `python_win`'s srcs and expose it as [PYTHON_FOR_BUILD](https://github.com/python/cpython/blob/3.13/PCbuild/readme.txt#L236), - resolve it to an absolute path in `build_python.bat` before `build.bat` is called, so `MSBuild` can use it regardless of its working directory. ### Motivation CPython's `PCbuild/find_python.bat` looks for a Python interpreter to perform pre-compilation code generation (opcodes, grammar, token tables) and to orchestrate PGO training runs. When `PYTHON_FOR_BUILD` is not set, [find_python.bat](https://github.com/python/cpython/blob/3.13/PCbuild/find_python.bat) falls back through the following chain, each of which fails in a Bazel action running under `--incompatible_strict_action_env` (Bazel 9's default BTW): 1. `VIRTUAL_ENV`, 2. `externals` directory, 3. `HOST_PYTHON`, 4. `py.exe` launcher, 5. `NuGet` download: **failed for me**... which surfaced the hermeticity issue. `PYTHON_FOR_BUILD` is CPython's dedicated variable for the ([`3.6+`](https://github.com/python/cpython/blob/3.13/PCbuild/readme.txt#L6)) interpreter **used to build** CPython itself, as opposed to the one **being built** (i.e. `3.13.12` as of today). ### Describe how you validated your changes Confirmed on a local Windows VM that `find_python.bat` reports "found as PYTHON_FOR_BUILD" and proceeds past code generation. ### Additional Notes Found while making progress towards #48206; split out so it can be reviewed/merged/reverted independently. Co-authored-by: regis.desgroppes <regis.desgroppes@datadoghq.com>

Prior art: 1. #48082 2. #48087 3. #48188 (1st attempt) 4. #48207 5. #48281 6. #48209 ### What does this PR do? This is a redo of #48188 (preemptively reverted by #48207) and therefore merely consists in re-adding `common:windows --enable_runfiles` to `.bazelrc`. ... with lessons learned, thanks to earlier: - #48209 covers the present change to `.bazelrc`, - #48281 prevents `find_python.bat` from falling back to `NuGet` or other non hermetic sources. .... and now a widened `bazel:test:windows-amd64`, evolving from just `//bazel/tests/... //rtloader/...` to `//...` **- except currently failing targets** (for the time being, of course). ### Motivation Summary of #48188: - `rules_python` 1.9.0 (#48082) transitions every `py_binary` and `py_test` on Windows from `enable_runfiles=auto` to `enable_runfiles=true`, - with Bazel's default (`enable_runfiles=false` on Windows), this creates a second Bazel configuration, causing `python_win` to be built twice concurrently, - `build_python.bat` writes `MSBuild` intermediates to the shared execroot source tree rather than the action's output directory, so both builds race on those files, causing [intermittent failures](https://gitlab.ddbuild.io/DataDog/datadog-agent/-/jobs/1533753039) (`pyconfig.h` not found, etc.). **Pre-setting `--enable_runfiles` makes the transition a no-op, so Bazel sees a single configuration and builds `python_win` once.** ### Describe how you validated your changes Local VM and, of course, CI. ### Additional Notes For instance, `//pkg/template/...` is excluded on Windows because `gopatch` errors on `@@\r` in hunk markers when patch files have CRLF line endings, which deserves a distinct PR (likely adjusting `.gitattributes`). Co-authored-by: regis.desgroppes <regis.desgroppes@datadoghq.com>

### What does this PR do? - add `@python_3_12//:python3` (current `rules_python`'s hermetic interpreter) to `python_win`'s srcs and expose it as [PYTHON_FOR_BUILD](https://github.com/python/cpython/blob/3.13/PCbuild/readme.txt#L236), - resolve it to an absolute path in `build_python.bat` before `build.bat` is called, so `MSBuild` can use it regardless of its working directory. ### Motivation CPython's `PCbuild/find_python.bat` looks for a Python interpreter to perform pre-compilation code generation (opcodes, grammar, token tables) and to orchestrate PGO training runs. When `PYTHON_FOR_BUILD` is not set, [find_python.bat](https://github.com/python/cpython/blob/3.13/PCbuild/find_python.bat) falls back through the following chain, each of which fails in a Bazel action running under `--incompatible_strict_action_env` (Bazel 9's default BTW): 1. `VIRTUAL_ENV`, 2. `externals` directory, 3. `HOST_PYTHON`, 4. `py.exe` launcher, 5. `NuGet` download: **failed for me**... which surfaced the hermeticity issue. `PYTHON_FOR_BUILD` is CPython's dedicated variable for the ([`3.6+`](https://github.com/python/cpython/blob/3.13/PCbuild/readme.txt#L6)) interpreter **used to build** CPython itself, as opposed to the one **being built** (i.e. `3.13.12` as of today). ### Describe how you validated your changes Confirmed on a local Windows VM that `find_python.bat` reports "found as PYTHON_FOR_BUILD" and proceeds past code generation. ### Additional Notes Found while making progress towards #48206; split out so it can be reviewed/merged/reverted independently. Co-authored-by: regis.desgroppes <regis.desgroppes@datadoghq.com>

Prior art: 1. #48082 2. #48087 3. #48188 (1st attempt) 4. #48207 5. #48281 6. #48209 ### What does this PR do? This is a redo of #48188 (preemptively reverted by #48207) and therefore merely consists in re-adding `common:windows --enable_runfiles` to `.bazelrc`. ... with lessons learned, thanks to earlier: - #48209 covers the present change to `.bazelrc`, - #48281 prevents `find_python.bat` from falling back to `NuGet` or other non hermetic sources. .... and now a widened `bazel:test:windows-amd64`, evolving from just `//bazel/tests/... //rtloader/...` to `//...` **- except currently failing targets** (for the time being, of course). ### Motivation Summary of #48188: - `rules_python` 1.9.0 (#48082) transitions every `py_binary` and `py_test` on Windows from `enable_runfiles=auto` to `enable_runfiles=true`, - with Bazel's default (`enable_runfiles=false` on Windows), this creates a second Bazel configuration, causing `python_win` to be built twice concurrently, - `build_python.bat` writes `MSBuild` intermediates to the shared execroot source tree rather than the action's output directory, so both builds race on those files, causing [intermittent failures](https://gitlab.ddbuild.io/DataDog/datadog-agent/-/jobs/1533753039) (`pyconfig.h` not found, etc.). **Pre-setting `--enable_runfiles` makes the transition a no-op, so Bazel sees a single configuration and builds `python_win` once.** ### Describe how you validated your changes Local VM and, of course, CI. ### Additional Notes For instance, `//pkg/template/...` is excluded on Windows because `gopatch` errors on `@@\r` in hunk markers when patch files have CRLF line endings, which deserves a distinct PR (likely adjusting `.gitattributes`). Co-authored-by: regis.desgroppes <regis.desgroppes@datadoghq.com>

rdesgroppes added changelog/no-changelog No changelog entry needed qa/no-code-change No code change in Agent code requiring validation labels Mar 24, 2026

dd-octo-sts bot added internal Identify a non-fork PR team/agent-build labels Mar 24, 2026

github-actions bot added the short review PR is simple enough to be reviewed quickly label Mar 24, 2026

rdesgroppes force-pushed the regis.desgroppes/cpython-python-for-build branch from 05e8a82 to 894c67d Compare March 24, 2026 10:41

rdesgroppes marked this pull request as ready for review March 24, 2026 11:18

rdesgroppes requested a review from a team as a code owner March 24, 2026 11:18

chouquette reviewed Mar 24, 2026

View reviewed changes

github-actions bot added medium review PR review might take time and removed short review PR is simple enough to be reviewed quickly labels Mar 24, 2026

chouquette approved these changes Mar 24, 2026

View reviewed changes

gh-worker-dd-mergequeue-cf854d bot merged commit 9701535 into main Mar 24, 2026
280 checks passed

gh-worker-dd-mergequeue-cf854d bot deleted the regis.desgroppes/cpython-python-for-build branch March 24, 2026 12:23

github-actions bot added this to the 7.79.0 milestone Mar 24, 2026

rdesgroppes mentioned this pull request Mar 24, 2026

Enable Bazel runfiles on Windows with widened test surface #48206

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Provide `PYTHON_FOR_BUILD` to CPython's Windows build#48281

Provide `PYTHON_FOR_BUILD` to CPython's Windows build#48281
gh-worker-dd-mergequeue-cf854d[bot] merged 1 commit intomainfrom
regis.desgroppes/cpython-python-for-build

rdesgroppes commented Mar 24, 2026 •

edited

Loading

Uh oh!

agent-platform-auto-pr bot commented Mar 24, 2026

Uh oh!

chouquette Mar 24, 2026

Uh oh!

chouquette Mar 24, 2026

Uh oh!

rdesgroppes Mar 24, 2026 •

edited

Loading

Uh oh!

chouquette Mar 24, 2026

Uh oh!

alopezz Mar 24, 2026 •

edited

Loading

Uh oh!

rdesgroppes Mar 24, 2026 •

edited

Loading

Uh oh!

rdesgroppes Mar 24, 2026

Uh oh!

cit-pr-commenter-54b7da bot commented Mar 24, 2026 •

edited

Loading

Experiments ignored for regressions

Fine details of change detection per experiment

Explanation

Uh oh!

agent-platform-auto-pr bot commented Mar 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

rdesgroppes commented Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Motivation

Describe how you validated your changes

Additional Notes

Uh oh!

agent-platform-auto-pr bot commented Mar 24, 2026

Files inventory check summary

Results for datadog-agent_7.79.0~devel.git.98.894c67d.pipeline.104148767-1_amd64.deb:

Uh oh!

chouquette Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

chouquette Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

rdesgroppes Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

chouquette Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

alopezz Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rdesgroppes Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rdesgroppes Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

cit-pr-commenter-54b7da bot commented Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Regression Detector

Regression Detector Results

Optimization Goals: ✅ No significant changes detected

Experiments ignored for regressions

Fine details of change detection per experiment

Bounds Checks: ❌ Failed

Explanation

CI Pass/Fail Decision

Uh oh!

agent-platform-auto-pr bot commented Mar 24, 2026

Static quality checks

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

rdesgroppes commented Mar 24, 2026 •

edited

Loading

rdesgroppes Mar 24, 2026 •

edited

Loading

alopezz Mar 24, 2026 •

edited

Loading

rdesgroppes Mar 24, 2026 •

edited

Loading

cit-pr-commenter-54b7da bot commented Mar 24, 2026 •

edited

Loading