hw dev v2: Make the python3 toolchain hermetic (#853)

This change introduces bazel's hermetic toolchain feature to rules_python. Registering rules_python with a toolchain required stage_4() to be created to properly initialize the WORKSPACE file.

Next Steps:
* Merge this pull request.
* Modify the enfabrica-bot enkit version update pull request to also include the stage_4() changes from this pull request. If the enfabrica-bot pull request is merged without stage_4() in the WORKSPACE file, then toolchain registration of rules_python will fail.
* Merge the modified enfabrica-bot pull request.
* Do not merge hw dev v2: Integrate the python3 hermetic toolchain internal#14744 and close it instead.

JIRA: INFRA-4372

WORKSPACE

@@ -21,3 +21,7 @@ stage_2()
 load("//bazel/init:stage_3.bzl", "stage_3")
 
 stage_3()
+
+load("//bazel/init:stage_4.bzl", "stage_4")
+
+stage_4()

bazel/init/stage_2.bzl

@@ -19,6 +19,7 @@ load("@rules_foreign_cc//foreign_cc:repositories.bzl", "rules_foreign_cc_depende
 load("@rules_pkg//:deps.bzl", "rules_pkg_dependencies")
 load("@rules_proto//proto:repositories.bzl", "rules_proto_dependencies", "rules_proto_toolchains")
 load("@rules_python//python:pip.bzl", "pip_parse")
+load("@rules_python//python:repositories.bzl", "py_repositories", "python_register_toolchains")
 
 def stage_2():
     """Stage 2 initialization for WORKSPACE.
@@ -31,16 +32,13 @@ def stage_2():
       dependencies are in stage 2 because they depend on the existence of
       rules_python in a load statement, which is instantiated in stage 1.
     """
-    pip_parse(
-        name = "python_dependencies",
-        extra_pip_args = [
-            # Needed for latest pytorch+CUDA install
-            "--find-links=https://download.pytorch.org/whl/torch_stable.html",
-            # Fixes OOMkill during torch install
-            # See https://github.com/pytorch/pytorch/issues/1022
-            "--no-cache-dir",
-        ],
-        requirements_lock = "//:requirements.txt",
+
+    py_repositories()
+
+    python_register_toolchains(
+        name = "python3_8",
+        python_version = "3.8",
+        ignore_root_user_error = True,
     )
 
     # SDKs that can be used to build Go code. We need:

bazel/init/stage_3.bzl

@@ -1,10 +1,11 @@
-"""Stage 2 configuration for enkit WORKSPACE.
+"""Stage 3 configuration for enkit WORKSPACE.
 
 See README.md for more information.
 """
 
 load("@com_github_grpc_grpc//bazel:grpc_extra_deps.bzl", "grpc_extra_deps")
-load("@python_dependencies//:requirements.bzl", python_deps = "install_deps")
+load("@rules_python//python:pip.bzl", "pip_parse")
+load("@python3_8//:defs.bzl", "interpreter")
 
 def stage_3():
     """Stage 3 initialization for WORKSPACE.
@@ -14,5 +15,18 @@ def stage_3():
     * A transitive load statement that references a repository that doesn't
       exist until stage 2 completes
     """
-    python_deps()
+
+    pip_parse(
+        name = "enkit_pip_deps",
+        extra_pip_args = [
+            # Needed for latest pytorch+CUDA install
+            "--find-links=https://download.pytorch.org/whl/torch_stable.html",
+            # Fixes OOMkill during torch install
+            # See https://github.com/pytorch/pytorch/issues/1022
+            "--no-cache-dir",
+        ],
+        requirements_lock = "//:requirements.txt",
+        python_interpreter_target = interpreter,
+    )
+
     grpc_extra_deps()

bazel/init/stage_4.bzl

@@ -0,0 +1,17 @@
+"""Stage 4 configuration for enkit WORKSPACE.
+
+See README.md for more information.
+"""
+
+load("@enkit_pip_deps//:requirements.bzl", python_deps = "install_deps")
+
+def stage_4():
+    """Stage 4 initialization for WORKSPACE.
+
+    This step includes any initialization which can't take place in stage 3 for
+    various reasons, including:
+    * A transitive load statement that references a repository that doesn't
+      exist until stage 3 completes
+    """
+
+    python_deps()

tools/bzldoc/BUILD.bazel

@@ -1,5 +1,5 @@
 load("@bazel_skylib//:bzl_library.bzl", "bzl_library")
-load("@python_dependencies//:requirements.bzl", "requirement")
+load("@enkit_pip_deps//:requirements.bzl", "requirement")
 load(
     "//bazel/utils:diff_test.bzl",
     "diff_test",

tools/codegen/BUILD.bazel

@@ -1,5 +1,5 @@
 load("@bazel_skylib//:bzl_library.bzl", "bzl_library")
-load("@python_dependencies//:requirements.bzl", "requirement")
+load("@enkit_pip_deps//:requirements.bzl", "requirement")
 
 bzl_library(
     name = "codegen_bzl",

tools/mdfmt/BUILD.bazel

@@ -1,7 +1,7 @@
 load("@bazel_skylib//:bzl_library.bzl", "bzl_library")
 load("//bazel/utils:diff_test.bzl", "diff_test")
 load("//tools/mdfmt:mdfmt.bzl", "mdfmt_filter")
-load("@python_dependencies//:requirements.bzl", "requirement")
+load("@enkit_pip_deps//:requirements.bzl", "requirement")
 
 bzl_library(
     name = "mdfmt_bzl",