feat: Support tool.uv.extra-build-dependencies in annotation loading

annotations.toml

@@ -1,12 +1,13 @@
 ## Annotations.toml
 #
 # This is an aspect_rules_py//uv specific configuration file which allows
-# packages to be annotated with their build time dependencies. This fills a gap in
-# both the pylock and uv lockfile formats, neither of which allow for build
-# requirements to be specified.
+# packages to be annotated extra information such as entrypoint.
 #
-# For instance if a package requires cython be available, this is how you can
-# configure it to be delivered.
+# This file allows specifying additional build time dependencies, however
+# <https://docs.astral.sh/uv/reference/settings/#extra-build-dependencies>
+# should be preferred, which is loaded by `uv.project`. For instance if a
+# package requires setuptools be available, this is how you can configure#
+# it to be delivered.
 #
 # Takes the place of giant MODULE.bazel annotation tables.
 #
@@ -17,15 +18,15 @@
 # We version lockfiles and support semver semantics here
 version = "0.0.0"
 
-# Bravado doesn't have bdists, need to build it. Mark explicitly that we need
-# wheel setuptools and build in order to do so; build being the standard build
-# tool driver.
-[[package]]
-name = "bravado-core"
-build-dependencies = [
-   { name = "build" },
-   { name = "setuptools" },
-]
+# This format is supported, but
+# <https://docs.astral.sh/uv/reference/settings/#extra-build-dependencies>
+# is now recommended.
+#[[package]]
+#name = "bravado-core"
+#build-dependencies = [
+#   { name = "build" },
+#   { name = "setuptools" },
+#]
 
 # We can also annotate packages as providing console scripts we care about.
 # Declared console scripts will have Bazel targets generated for them.

e2e/cases/BUILD.bazel

@@ -116,16 +116,36 @@ write_source_files(
         # rule expands env keys correctly given an explicit fixture.
         "snapshots/sdist_build.uv_sdist_jdk_build.jpype1.BUILD.bazel": "@sdist_build__uv_sdist_jdk_build__jpype1__1_7_1//:BUILD.bazel",
 
-        # @sdist_build for cowsay with native annotation and monitor_memory
-        # ------------------------------------------------------------------
+        # @sdist_build for cowsay with composed annotations and monitor_memory
+        # ---------------------------------------------------------------------
         # cowsay is pure Python, so only `native = true` can select
         # pep517_native_whl. Its build and native annotations are split so the
         # snapshot also pins that a native-only annotation preserves explicit
-        # and configure-discovered build deps. This retains the monitor-only
-        # source-build coverage. The runtime //uv-sdist-fallback:test
+        # and configure-discovered build deps, while legacy build deps compose
+        # with distinctly marker-qualified uv-native deps. This retains the
+        # monitor-only source-build coverage. The runtime //uv-sdist-fallback:test
         # proves that the forced-native build produces a working wheel.
         "snapshots/sdist_build.uv_sdist_fallback.cowsay.BUILD.bazel": "@sdist_build__uv_sdist_fallback__cowsay__6_0//:BUILD.bazel",
 
+        # @sdist_build for tqdm with tool.uv.extra-build-dependencies
+        # -----------------------------------------------------------
+        # Pins the uv-native annotation and match-runtime paths independently
+        # of cowsay's composed legacy and uv-native annotations.
+        "snapshots/sdist_build.uv_sdist_fallback.tqdm.BUILD.bazel": "@sdist_build__uv_sdist_fallback__tqdm__4_52_0//:BUILD.bazel",
+
+        # @sdist_build for both conflicting versions of packaging
+        # ---------------------------------------------------------
+        # Pins that a package-name keyed uv-native annotation applies to every
+        # locked version, not only packages with a single default version.
+        "snapshots/sdist_build.uv_conflict_817.packaging_21_3.BUILD.bazel": (
+            "@sdist_build__ambig__packaging__21_3" +
+            "//:BUILD.bazel"
+        ),
+        "snapshots/sdist_build.uv_conflict_817.packaging_24_0.BUILD.bazel": (
+            "@sdist_build__ambig__packaging__24_0" +
+            "//:BUILD.bazel"
+        ),
+
         # @sdist_build for python-geohash with uv.override_package(resource_set)
         # ----------------------------------------------------------------------
         # Covers the override_package -> repo-rule -> BUILD-template plumbing

e2e/cases/uv-conflict-817/pyproject.toml

@@ -20,3 +20,6 @@ conflicts = [
       { group = "ambig-b" },
     ],
 ]
+
+[tool.uv.extra-build-dependencies]
+packaging = ["pyparsing"]

e2e/cases/uv-conflict-817/setup.MODULE.bazel

@@ -5,4 +5,9 @@ uv.project(
     lock = "//uv-conflict-817:uv.lock",
     pyproject = "//uv-conflict-817:pyproject.toml",
 )
-use_repo(uv, "pypi_uv_conflict_817")
+use_repo(
+    uv,
+    "pypi_uv_conflict_817",
+    "sdist_build__ambig__packaging__21_3",
+    "sdist_build__ambig__packaging__24_0",
+)

e2e/cases/uv-git-source/BUILD.bazel

@@ -4,14 +4,16 @@ load("@aspect_rules_py//py:defs.bzl", "py_test")
 # `source = { git = "https://github.com/benjaminp/six?tag=1.17.0#<commit>" }`,
 # exercising parse_git_url on a real uv-generated URL, the GitHub
 # git-to-http_archive conversion in collect_sdists, and the source build of
-# the resulting archive.
+# the resulting archive. cowsay is forced to build from source using that
+# locked git dependency as an extra build requirement.
 py_test(
     name = "test",
     srcs = ["__test__.py"],
     dep_group = "uv_git_source",
     main = "__test__.py",
     python_version = "3.11",
     deps = [
+        "@pypi_git_source//cowsay",
         "@pypi_git_source//six",
     ],
 )

e2e/cases/uv-git-source/__test__.py

@@ -1,6 +1,8 @@
+import cowsay
 import six
 
+assert "git build dependency" in cowsay.get_output_string("cow", "git build dependency")
 assert six.__version__ == "1.17.0", six.__version__
 assert six.ensure_str(b"git-source") == "git-source"
 
-print("six", six.__version__, "imported from git source")
+print("six", six.__version__, "and cowsay imported from source builds")

e2e/cases/uv-git-source/pyproject.toml

@@ -8,6 +8,7 @@ dependencies = [
     "build",
     "setuptools",
     "six",
+    "cowsay==6.0",
 ]
 
 # six is resolved from git rather than a registry, exercising the
@@ -16,3 +17,9 @@ dependencies = [
 # git-to-http_archive conversion for GitHub remotes.
 [tool.uv.sources]
 six = { git = "https://github.com/benjaminp/six", tag = "1.17.0" }
+
+[tool.uv]
+no-binary-package = ["cowsay"]
+
+[tool.uv.extra-build-dependencies]
+cowsay = ["six @ git+https://github.com/benjaminp/six@1.17.0"]

e2e/cases/uv-invalid-build-overrides/missing-extra-build-dep/BUILD.bazel

@@ -0,0 +1 @@
+# Fixture data is consumed by this module's extension.

e2e/cases/uv-invalid-build-overrides/missing-extra-build-dep/MODULE.bazel

@@ -0,0 +1,17 @@
+module(name = "missing_extra_build_dep_fixture")
+
+bazel_dep(name = "aspect_rules_py")
+local_path_override(
+    module_name = "aspect_rules_py",
+    path = "../../../..",
+)
+
+uv = use_extension("@aspect_rules_py//uv:extensions.bzl", "uv")
+uv.declare_hub(hub_name = "missing_extra_build_dep")
+uv.project(
+    default_build_dependencies = [],
+    hub_name = "missing_extra_build_dep",
+    lock = "//:uv.lock",
+    pyproject = "//:pyproject.toml",
+)
+use_repo(uv, "missing_extra_build_dep")

e2e/cases/uv-invalid-build-overrides/missing-extra-build-dep/pyproject.toml

@@ -0,0 +1,8 @@
+[project]
+name = "missing-extra-build-dep"
+version = "0.0.0"
+requires-python = ">=3.11"
+dependencies = ["cchardet==2.1.7"]
+
+[tool.uv.extra-build-dependencies]
+cchardet = ["cython"]

e2e/cases/uv-invalid-build-overrides/test.sh

@@ -16,24 +16,28 @@ fail() {
 expect_failure() {
     local fixture="$1"
     local target="$2"
-    local expected="$3"
+    local expected
+    shift 2
 
     if (
         cd "$case_dir/$fixture" &&
             "$BAZEL" query --lockfile_mode=off -- "$target"
     ) >"$output_log" 2>&1; then
         fail "$fixture $target unexpectedly succeeded"
     fi
-    if ! grep -Fq "$expected" "$output_log"; then
-        cat "$output_log" >&2
-        fail "$fixture $target did not report: $expected"
-    fi
+    for expected in "$@"; do
+        if ! grep -Fq "$expected" "$output_log"; then
+            cat "$output_log" >&2
+            fail "$fixture $target did not report: $expected"
+        fi
+    done
 }
 
 expect_failure \
     wheel-only \
     '@invalid_overrides//:*' \
-    'build-only attributes require a source distribution, but the lock record has only wheels: console_scripts, resource_set, env, monitor_memory, pre_build_patches, pre_build_patch_strip, toolchains'
+    'build-only attributes require a source distribution, but the lock record has only wheels:' \
+    'console_scripts, resource_set, env, monitor_memory, pre_build_patches, pre_build_patch_strip, toolchains'
 expect_failure \
     editable-self \
     '@invalid_editable_overrides//:*' \
@@ -46,11 +50,18 @@ expect_failure \
     unmatched-lock \
     '@unmatched_lock_override//:*' \
     'has no uv.project() for that lock'
+expect_failure \
+    missing-extra-build-dep \
+    '@missing_extra_build_dep//:*' \
+    'Unable to resolve extra build dependency `"cython"` for package "cchardet" in @@//:pyproject.toml.' \
+    '`uv.lock` does not include packages referenced only by `tool.uv.extra-build-dependencies`' \
+    'Add the dependency as a dependency and regenerate the lock.'
 
 expect_failure \
     custom-complete \
     '@sdist_build__uv_invalid_build_overrides_custom__cowsay__6_0//:*' \
-    'complete `build_file_content`, which bypasses the generated `pep517_*whl(...)` call, so these attributes cannot be applied: resource_set, env, monitor_memory, toolchains'
+    'complete `build_file_content`, which bypasses the generated `pep517_*whl(...)` call,' \
+    'so these attributes cannot be applied: resource_set, env, monitor_memory, toolchains'
 expect_failure \
     custom-pure \
     '@sdist_build__uv_invalid_build_overrides_custom__cowsay__6_0//:*' \