fix(pip): do not use experimental_index_url for publish_deps

[aignas]

This usage means that all users will query PyPI to get SimpleAPI
metadata. Once bazelbuild/bazel#24777 is merged, we can roll it back,
but then we may need to check-in the MODULE.bazel.lock file into git.

This should be no-op for most users because the publisher is usually run
from with host == exec, but there is a small chance that people will
hit #2241.

Work towards #2937

[gemini-code-assist]

Summary of Changes

Hello @aignas, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses an issue where publishing dependencies were configured to use experimental_index_url, leading to all users querying PyPI for metadata. By removing this specific configuration, the change ensures that dependency resolution for publishing components is handled more efficiently and prevents unnecessary external queries, mitigating a potential problem described in #2241. This is a temporary fix, with a future rollback planned once a related Bazel change is merged.

Highlights

• Dependency Resolution: The experimental_index_url attribute has been removed from the pip.parse call for rules_python_publish_deps in MODULE.bazel. This change prevents all users from querying PyPI for SimpleAPI metadata when resolving publishing dependencies.
• Changelog Update: A new entry has been added to CHANGELOG.md to reflect that publishing dependencies are no longer pulled via experimental_index_url, addressing issue rules_python_publish_deps causing pip extension resolution to always require network access #2937.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request correctly disables the use of experimental_index_url for publish_deps to work around a Bazel issue, as described in #2937. The changes in MODULE.bazel and CHANGELOG.md are accurate. For improved long-term maintainability, I've suggested adding a comment in MODULE.bazel to document the reason for this temporary change and the conditions under which it can be reverted.