fix(uv): reject malformed python/abi wheel tags via allowlist

[xangcastle]

Completes the tag-validation symmetry started by #844: platform tags have had a strict allowlist since then, but python tags were only prefix-checked (cp311_2 passed) and abi tags were not filtered at all. A single wheel with a malformed tag in the lockfile — e.g. renamed in a private registry — breaks analysis far beyond that wheel.

Problem

Two distinct failure modes, both reproduced by the new e2e case:

1. Malformed python tag (cp311_2-...): crashes the whl_install repository fetch before any select is generated — Error in int: invalid base-10 literal: "11_2" in select_key (whl_install/repository.bzl).
2. Malformed abi tag only (cp311-cp311_2-...): the generated config group name collides with a private intermediate alias that bazel_skylib's selects.bzl creates for the legitimate cp311 group chain (name + "_" + i), leaving the entire pip_configurations BUILD in error — every package of every hub breaks.

Changes

Single source of data for both filtering and generation, mirroring #844:

• constraints/defs.bzl: FOREIGN_INTERPRETER_PREFIXES + foreign_interpreter_tag() — foreign interpreters (pp/pypy/graalpy/ip/jy) skip silently; anything else unsupported warns.
• constraints/python/defs.bzl: PYTHON_TAGS derived from INTERPRETERS×MAJORS×MINORS (exactly what python/macro.bzl generates); supported_python() is now membership, not a prefix check; filter_python_tags() warns per rejected tag.
• constraints/abi/defs.bzl (new): ABI_FEATURES/ABI_FEATURE_SUFFIXES/ABI_TAGS (+none, abi3), supported_abi(), filter_abi_tags().
• constraints/abi/macro.bzl: refactored to generate from that same data — verified by query that the 1438 generated targets are unchanged.
• Both consumers filter before generating: extension/lockfile.bzl (hub configurations) and whl_install/repository.bzl (select arms), so hub and arms stay consistent.

A rejected wheel is skipped with an actionable warning, never a hard failure:

WARNING: iniconfig-2.3.0-cp311-cp311_2-manylinux_2_17_x86_64.whl: abi tag 'cp311_2' does not match any supported configuration; skipping this wheel as an install candidate. This usually means the wheel file was renamed with a malformed tag — fix the filename in the registry and re-lock.

If the malformed wheel was the only candidate, the existing "no compatible wheel" diagnostics take over.

Test plan

• New e2e cases/uv-malformed-abi-tag: crafted uv.lock carrying a real py3-none-any wheel plus two synthetic malformed entries (never fetched). Red without the fix reproduces both failure modes above; green with the fix resolves via the valid wheel and asserts cp311_2 never leaks into the graph.
• New unit suites constraints/python/test.bzl and constraints/abi/test.bzl: cp311_2/cp999/cp321/py4/cp3/cp311td rejected; none/abi3/cp313t/cp312dmtu accepted; foreign interpreters silent.
• bazel test //uv/... 95/95; e2e regressions: uv-platform-filter-844, uv-abi3-compat-853, freethreaded-805, uv-dep-hashes (×2), uv-no-sdist-754, windows-crossbuild-837, uv-deps-650 (×4) all pass; buildifier clean.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: e5af3584-394e-4160-b488-2958d779c639

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[aspect-workflows]

✨ Aspect Workflows Tasks

📅 Tue Sep 8 15:38:27 UTC 2026

🔄 1 in progress task

• 🔄 test (test-e2e-bazel-9) · ⏱ 38m 24s · 🐙 GitHub Actions · ☑️ Check
  💬 Bazel test running... (66 tests run)

✅ 5 successful tasks

• ✅ buildifier · ⏱ 28.4s · 🐙 GitHub Actions · ☑️ Check
  💬 Format complete (clean)
• ✅ gazelle · ⏱ 27.7s · 🐙 GitHub Actions · ☑️ Check
  💬 Gazelle complete (clean)
• ✅ test (test-examples-uv_pip_compile-bazel-8) · ⏱ 30.2s · 🐙 GitHub Actions · ☑️ Check
  💬 Bazel test complete (1/1 passed)
• ✅ test (test-root-bazel-8) · ⏱ 33m 17s · 🐙 GitHub Actions · ☑️ Check
  💬 Bazel test complete (137/137 passed)
• ✅ test (test-root-bazel-9) · ⏱ 30m 34s · 🐙 GitHub Actions · ☑️ Check
  💬 Bazel test complete (136/136 passed)

---

_{⏱ Last updated Tue Sep 8 16:16:44 UTC 2026 · 📊 GitHub API quota 116/15,000 (1% used, resets in 33m, throttle 3×)
🚀 Powered by Aspect CLI (v2026.22.44)  |  Aspect Build · X · LinkedIn · YouTube}