feat(toolchain): use the uv.lock based coverage hub for the WORKSPACE toolchains

.gitattributes

@@ -1,5 +1,6 @@
 python/features.bzl export-subst
 tests/uv/lock/testdata/requirements.txt text eol=lf
 python/private/runtimes_manifest.bzl text eol=lf
+python/private/coverage/uv_lock.bzl text eol=lf
 
 *.bat text eol=crlf

MODULE.bazel

@@ -97,7 +97,30 @@ pip.dep(name = "pytest")
 pip.dep(name = "pytest-bazel")
 pip.dep(name = "pytest-randomly")
 pip.dep(name = "pytest-shard")
-use_repo(pip, "pypi", "rules_python_publish_deps")
+
+# The default coverage tool for the hermetic toolchains, see
+# `python.toolchain.configure_coverage_tool`. The versions that do not have a
+# registered toolchain are ignored.
+[
+    pip.parse(
+        download_only = True,
+        hub_name = "rules_python_coverage",
+        python_version = python_version,
+        target_platforms = ["*"],
+        uv_lock = "//python/private/coverage:uv.lock",
+    )
+    for python_version in [
+        "3.9",
+        "3.10",
+        "3.11",
+        "3.12",
+        "3.13",
+        "3.14",
+        "3.15",
+    ]
+]
+
+use_repo(pip, "pypi", "rules_python_coverage", "rules_python_publish_deps")
 
 bazel_dep(
     name = "rules_rust",
@@ -416,6 +439,26 @@ dev_python.toolchain(
     python_version = "3.12.16",
 )
 
+# For testing the coverage collection with the coverage tool from a PyPI hub.
+# See //tests/coverage:coverage_from_pypi_test
+dev_python.toolchain(
+    python_version = "3.13.13",
+)
+
+[
+    dev_python.single_version_platform_override(
+        coverage_tool = "@dev_pip//coverage",
+        platform = platform,
+        python_version = "3.13.13",
+    )
+    for platform in [
+        "aarch64-apple-darwin",
+        "aarch64-unknown-linux-gnu",
+        "x86_64-apple-darwin",
+        "x86_64-unknown-linux-gnu",
+    ]
+]
+
 # For testing an arbitrary runtime triggered by a custom flag.
 # See //tests/toolchains:custom_platform_toolchain_test
 dev_python.single_version_platform_override(

WORKSPACE

@@ -75,6 +75,8 @@ python_register_multi_toolchains(
     default_version = "3.14",
     # Integration tests verify each version, so register all of them.
     python_versions = PYTHON_VERSIONS,
+    # See //tests/coverage:coverage_collection_test
+    register_coverage_tool = True,
 )
 
 load("//python/uv:repositories.bzl", "uv_toolchains_manifest")

dev/BUILD.bazel

@@ -29,6 +29,8 @@ multirun(
         "//examples:bzlmod_other_module_uv_lock.update",
         "//examples:bzlmod_uv_lock.update",
         "//examples/wheel:requirements_server.update",
+        # Updates the uv.lock and then the vendored uv_lock.bzl.
+        "//python/private/coverage:uv_lock_bzl.update",
         "//tests/multi_pypi/alpha:requirements.update",
         "//tests/multi_pypi/beta:requirements.update",
         "//tests/multiple_inputs:multiple_inputs.update",

dev/pyproject.toml

@@ -12,6 +12,8 @@ dependencies = [
     "sphinx_rtd_theme >=2.0", # uv insists on downgrading for some reason
     "readthedocs-sphinx-ext",
     "absl-py",
+    # Used to test the coverage collection with coverage from a PyPI hub.
+    "coverage",
     "typing-extensions",
     "sphinx-reredirects",
     "pefile",

dev/update_deps/BUILD.bazel

@@ -31,22 +31,6 @@ py_library(
     imports = ["../.."],
 )
 
-py_binary(
-    name = "update_coverage_deps",
-    srcs = ["update_coverage_deps.py"],
-    data = [
-        "//python/private:coverage_deps_filegroup",
-    ],
-    env = {
-        "UPDATE_FILE": "$(rlocationpath //python/private:coverage_deps_filegroup)",
-    },
-    imports = ["../.."],
-    deps = [
-        ":args",
-        ":update_file",
-    ],
-)
-
 py_binary(
     name = "update_pip_deps",
     srcs = ["update_pip_deps.py"],