Hotfix python3-modules build: pin mypy<2

pytokens pulls in mypy 2.0.0 (released 2026-05-06) as a build time
dependency, which requires rustc>=1.91. The build image ships rustc
1.90, so pytokens fails to build because mypy is pulled in unconstrained
by its mypyc self-compilation step.

Wire constraints.txt into the python3-modules genrule via PIP_CONSTRAINT
so that build envs honor it.

CMK-34707

Change-Id: Ibcb1b1cf8dc711aa679c879d852165e6ed5c0dbf

Author: LarsMichelsen

community-requirements.txt

@@ -2887,6 +2887,7 @@ mypy==1.19.1 \
     --hash=sha256:f859fb09d9583a985be9a493d5cfc5515b56b08f7447759a0c5deaf68d80506e \
     --hash=sha256:ffcebe56eb09ff0c0885e750036a095e23793ba6c2e894e7e63f6d89ad51f22e
     # via
+    #   -c constraints.txt
     #   -c requirements.txt
     #   -r tests/dev-requirements.in
     #   pylsp-mypy

constraints.txt

@@ -5,3 +5,4 @@ mypy-protobuf==3.7.0  # CMK-28939
 types-lxml==2025.11.25  # CMK-28940
 google-cloud-asset==4.1.0  # CMK-29107
 redis~=7.2.1 # CMK-31558
+mypy<2 # CMK-34707 pytokens pulls in mypy 2.0.0 and ast-serialize, which requires rustc>=1.91 (build image has 1.90); pulled in by pytokens via mypyc

omd/packages/python3-modules/BUILD

@@ -22,6 +22,7 @@ config_setting(
     srcs = [
         "%s_requirements.txt" % module,
         ":git_wrapper",
+        "//:constraints.txt",
         "@freetds",
         "@openssl",
         "@python",
@@ -42,6 +43,7 @@ build_python_module(
     name = "netapp-ontap",
     srcs = [
         ":git_wrapper",
+        "//:constraints.txt",
         "@freetds",
         "@openssl",
         "@python",

omd/packages/python3-modules/build-python3-modules.bzl

@@ -27,6 +27,7 @@ def build_python_module(name, srcs, outs, requirements = "", **kwargs):
     """This macro is creating an empty file.
     """
     requirements = requirements if requirements else "-r $$HOME/$(execpath %s_requirements.txt)" % name
+    constraints = "$$HOME/$(execpath //:constraints.txt)"
     openssl_dir = Label("@openssl").repo_name
     freetds_dir = Label("@freetds").repo_name
     python_dir = Label("@python").repo_name
@@ -43,6 +44,7 @@ def build_python_module(name, srcs, outs, requirements = "", **kwargs):
                 git_ssl_no_verify = "GIT_SSL_NO_VERIFY=true",
                 pyMajMin = PYTHON_MAJOR_DOT_MINOR,
                 requirements = requirements,
+                constraints = constraints,
                 openssl_dir = openssl_dir,
                 freetds_dir = freetds_dir,
                 python_dir = python_dir,
@@ -51,6 +53,7 @@ def build_python_module(name, srcs, outs, requirements = "", **kwargs):
                 git_ssl_no_verify = "",
                 pyMajMin = PYTHON_MAJOR_DOT_MINOR,
                 requirements = requirements,
+                constraints = constraints,
                 openssl_dir = openssl_dir,
                 freetds_dir = freetds_dir,
                 python_dir = python_dir,
@@ -136,6 +139,8 @@ build_cmd = """
       --no-warn-script-location \\
       --root-user-action=ignore \\
       --disable-pip-version-check \\
+      --use-feature=build-constraint \\
+      --build-constraint="{constraints}" \\
       --prefix="$$HOME/$$MODULE_NAME" \\
       {requirements} 2>&1 | tee "$$HOME/""$$MODULE_NAME""_pip_install.stdout"
 

requirements.txt

@@ -2803,6 +2803,7 @@ mypy==1.19.1 \
     --hash=sha256:f859fb09d9583a985be9a493d5cfc5515b56b08f7447759a0c5deaf68d80506e \
     --hash=sha256:ffcebe56eb09ff0c0885e750036a095e23793ba6c2e894e7e63f6d89ad51f22e
     # via
+    #   -c constraints.txt
     #   -r tests/dev-requirements.in
     #   pylsp-mypy
 mypy-boto3-logs==1.42.10 \