.netrc authentication support for private index-url in `requirements_test`

[lalten]

🚀 feature request

Relevant Rules

compile_pip_requirements's _update target works great with custom PyPI indices that require authentication via a ~/.netrc file:

load("@rules_python//python:pip.bzl", "compile_pip_requirements")

compile_pip_requirements(
    name = "requirements",
    extra_args = [
        "--pip-args",
        "--index-url=https://pypi.company.com/simple",
    ],
)

This is likely because pip supports finding and using ~/.netrc out of the box. See https://pip.pypa.io/en/stable/topics/authentication/

See also #503 (comment)

Description

compile_pip_requirements (https://github.com/bazelbuild/rules_python/blob/main/python/pip_install/requirements.bzl#L20) automatically adds a _test rule that checks whether the requirements.in to requirements.txt conversion works.

This fails with authentication issues in pip-compile. My guess is that the Bazel test environment does not propagate the $HOME env var, so pip-compile can not see the .netrc file.

There is also (undocumented) support for a $NETRC variable pypa/pip#11023, which is probably better than providing $HOME to tests.

Describe the solution you'd like

What's not so straightforward is finding out where that netrc is if it's not checked in into the repo.
Setting --test_env=NETRC=$HOME/.netrc is another idea, but that will completely void all benefits of remote caching
I don't really know what a solution could be, so I'm hoping some smart minds here have suggestions on how to achieve this :)

[github-actions]

This issue has been automatically marked as stale because it has not had any activity for 180 days. It will be closed if no further activity occurs in 30 days.
Collaborators can add an assignee to keep this open indefinitely. Thanks for your contributions to rules_python!

[github-actions]

This issue was automatically closed because it went 30 days without a reply since it was labeled "Can Close?"