fix: handle unsubstituted template placeholders for external native py_binary (#3495)

### Problem
In #3242, it looks like `rules_python` introduced new template
placeholders in the bootstrap scripts: `%stage2_bootstrap%` and
`%interpreter_args%`. And from what I can tell, also made their
successful substitution a requirement.

This works totally fine when the caller is calling `rules_python`
directly. However, when external repositories (like gRPC's cython)
define py_binary using the native rule, these placeholders don't seem to
be substituted? The result is that the literal placeholder text ends up
in the generated bootstrap scripts, causing `SyntaxError`s or
file-not-found errors at runtime

### Fix

Detect if the `%stage2_bootstrap%` variable isn't expanded and fallback
to
`%main%` which IS substituted even for native `py_binary`.

For `%interpreter_args%`, wrap it in triple-quotes so it's hopefully
always valid Python syntax, then detect the sentinel and default to an
empty list. This is a bit hacky,
but is fairly non-invasive.

---------

Co-authored-by: Richard Levasseur <rlevasseur@google.com>

Author: thomasdesr

python/private/py_executable.bzl

@@ -728,10 +728,7 @@ def _create_stage1_bootstrap(
         resolve_python_binary_at_runtime = "1"
 
     subs = {
-        "%interpreter_args%": "\n".join([
-            '"{}"'.format(v)
-            for v in ctx.attr.interpreter_args
-        ]),
+        "%interpreter_args%": "\n".join(ctx.attr.interpreter_args),
         "%is_zipfile%": "1" if is_for_zip else "0",
         "%python_binary%": python_binary_path,
         "%python_binary_actual%": python_binary_actual,

python/private/python_bootstrap_template.txt

@@ -10,10 +10,31 @@ import sys
 import os
 import subprocess
 import uuid
-
 # runfiles-relative path
+# NOTE: The sentinel strings are split (e.g., "%stage2" + "_bootstrap%") so that
+# the substitution logic won't replace them. This allows runtime detection of
+# unsubstituted placeholders, which occurs when native py_binary is used in
+# external repositories. In that case, we fall back to %main% which Bazel's
+# native rule does substitute.
+_STAGE2_BOOTSTRAP_SENTINEL = "%stage2" + "_bootstrap%"
 STAGE2_BOOTSTRAP="%stage2_bootstrap%"
 
+# NOTE: The fallback logic from stage2_bootstrap to main is only present
+# as a courtesy for an older, unsupported, configuration. It can be removed
+# when that case is unlikely to be a concern anymore.
+# See https://github.com/bazel-contrib/rules_python/pull/3495
+if STAGE2_BOOTSTRAP == _STAGE2_BOOTSTRAP_SENTINEL:
+  _MAIN_SENTINEL = "%main" + "%"
+  _main = "%main%"
+  if _main != _MAIN_SENTINEL and _main:
+    STAGE2_BOOTSTRAP = _main
+  else:
+    STAGE2_BOOTSTRAP = ""
+
+if not STAGE2_BOOTSTRAP:
+  print("ERROR: %stage2_bootstrap% (or %main%) was not substituted.", file=sys.stderr)
+  sys.exit(1)
+
 # runfiles-relative path to venv's python interpreter
 # Empty string if a venv is not setup.
 PYTHON_BINARY = '%python_binary%'
@@ -35,9 +56,13 @@ RECREATE_VENV_AT_RUNTIME="%recreate_venv_at_runtime%"
 WORKSPACE_NAME = "%workspace_name%"
 
 # Target-specific interpreter args.
-INTERPRETER_ARGS = [
-%interpreter_args%
-]
+# Sentinel split to detect unsubstituted placeholder (see STAGE2_BOOTSTRAP above).
+_INTERPRETER_ARGS_SENTINEL = "%interpreter" + "_args%"
+_INTERPRETER_ARGS_RAW = "%interpreter_args%"
+if _INTERPRETER_ARGS_RAW == _INTERPRETER_ARGS_SENTINEL:
+  INTERPRETER_ARGS = []
+else:
+  INTERPRETER_ARGS = [arg for arg in _INTERPRETER_ARGS_RAW.split("\n") if arg]
 
 ADDITIONAL_INTERPRETER_ARGS = os.environ.get("RULES_PYTHON_ADDITIONAL_INTERPRETER_ARGS", "")