refactor!(bzlmod): introduce pypi.install extension
With this PR we are introducing a new extension for managing PyPI dependencies and it seems that we would fix #2268 in doing so. The code has been sitting around for long enough so that we have ironed out most of the bigger bugs already and the maintainers have agreed for long enough that pip.parse is not the best named, so I have chosen pypi.install.
This should not actively break the code and will make some of the experimental parameters noop. This could yield to weird failures in cases where people are building docker containers, so I am thinking that we should potentially add a helpful error message prompting the users to migrate. However I am not sure how that works out when multiple module versions are at play in the same module graph.
Work towards #260
I don't know if I am super happy about the breaking change here, but I do think fixing the bug here takes the priority. Let me know what you think. I think we have discussed enough times and agree on the new better name here.
Taking a step back a little as I am not sure that this should necessarily be merged like this.
- To fix the bug, we could instead only allow root modules to enable
experimental_index_urlfor now. - The missing pieces that the new code does not support yet:
- Pull dependencies when hashes are not specified. I've seen many people in the wild using
pip freezeto generate the requirements files and I think we should just get all of the wheels that we can find if the hashes are not present in the requirements files. This can be done as a separate PR. - Direct URL dependency handling - right now we assume that we always should contact the SimpleAPI. If the URL is in the requirements file, we should just use it.
- Pull dependencies when hashes are not specified. I've seen many people in the wild using
See #2268 for reasons for closing this.