fix sandboxed integration test

requires exposing `:srcs` for all the toolchain modules, so they can be
added as `runfiles` to the sandbox.

core/BUILD.bazel

@@ -6,6 +6,12 @@ exports_files([
     "nixpkgs.bzl",
 ])
 
+filegroup(
+    name = "srcs",
+    srcs = glob(["**"]),
+    visibility = ["//visibility:public"],
+)
+
 bzl_library(
     name = "bazel_tools",
     srcs = [

nixpkgs/repositories.bzl

@@ -33,39 +33,17 @@ def rules_nixpkgs_dependencies(local = None):
         url = "https://github.com/bazelbuild/rules_java/releases/download/4.0.0/rules_java-4.0.0.tar.gz",
         sha256 = "34b41ec683e67253043ab1a3d1e8b7c61e4e8edefbcad485381328c934d072fe",
     )
-    url =  "https://github.com/tweag/rules_nixpkgs/archive/refs/tags/v0.8.1.tar.gz"
-    if not local:
-       # XXX: no way to use `sha256` here, but if this surrounding repo comes
-        # from that URL, Bazel should hit the cache for the sub-workspaces
-        maybe(
-            http_archive,
-            "rules_nixpkgs_core",
-            url = url,
-            strip_prefix = "core",
-        )
-        maybe(
-            http_archive,
-            "rules_nixpkgs_cc",
-            url = url,
-            strip_prefix = "toolchains/cc",
-        )
-        maybe(
-            http_archive,
-            "rules_nixpkgs_java",
-            url = url,
-            strip_prefix = "toolchains/java",
-        )
-    else:
-        native.local_repository(
-            name = "rules_nixpkgs_core",
-            path = local + "/core",
-        )
-        native.local_repository(
-            name = "rules_nixpkgs_cc",
-            path = local + "/toolchains/cc",
-        )
-        native.local_repository(
-            name = "rules_nixpkgs_java",
-            path = local + "/toolchains/java",
-        )
 
+    url = "https://github.com/tweag/rules_nixpkgs/archive/refs/tags/v0.8.1.tar.gz"
+    for repo, prefix in [
+        ("rules_nixpkgs_core", "core"),
+        ("rules_nixpkgs_cc", "toolchains/cc"),
+        ("rules_nixpkgs_java", "toolchains/java"),
+        ("rules_nixpkgs_python", "toolchains/python"),
+    ]:
+        if not local:
+            # XXX: no way to use `sha256` here, but if this surrounding repo comes
+            # from that URL, Bazel should hit the cache for the sub-workspaces
+            maybe(http_archive, repo, url = url, strip_prefix = prefix)
+        else:
+            maybe(native.local_repository, repo, path = "{}/{}".format(local, prefix))

tests/BUILD.bazel

@@ -1,11 +1,11 @@
-package(default_testonly = 1)
-
 load("@io_bazel_rules_go//go:def.bzl", "go_binary")
-load("@rules_java//java:defs.bzl", "java_binary", "java_test")
+load("@rules_java//java:defs.bzl", "java_test")
 load(":cc-test.bzl", "cc_toolchain_test")
 load(":java-test.bzl", "java_runtime_test")
 load(":location_expansion_unit_test.bzl", "expand_location_unit_test_suite")
 
+package(default_testonly = 1)
+
 expand_location_unit_test_suite()
 
 [
@@ -97,8 +97,8 @@ cc_toolchain_test(
 # Test nixpkgs_java_configure() by building some Java code.
 java_test(
     name = "java-test",
-    test_class = "JavaTest",
     srcs = ["JavaTest.java"],
+    test_class = "JavaTest",
 )
 
 # Test that nixpkgs_java_runtime is selected.
@@ -142,7 +142,10 @@ sh_test(
     data = [
         "//nixpkgs:srcs",
         "//tests/invalid_nixpkgs_package:srcs",
-        "@rules_nixpkgs_cc//:cc.bzl",
+        "@rules_nixpkgs_core//:srcs",
+        "@rules_nixpkgs_cc//:srcs",
+        "@rules_nixpkgs_java//:srcs",
+        "@rules_nixpkgs_python//:srcs",
         "@nix-unstable//:bin",
     ] + select({
         "@platforms//os:linux": ["@busybox_static//:bin"],

tests/invalid_nixpkgs_package/workspace.bazel

@@ -2,6 +2,19 @@ workspace(name = "io_tweag_rules_nixpkgs")
 
 load("//nixpkgs:repositories.bzl", "rules_nixpkgs_dependencies")
 
+# fetch external repositories from runfiles directory. this does not work
+# otherwise, as the test runs in a sandbox and is not aware of the actual
+# directory where the original code lives
+[local_repository(
+    name = repo,
+    path = "external/{}".format(repo),
+) for repo in [
+    "rules_nixpkgs_core",
+    "rules_nixpkgs_cc",
+    "rules_nixpkgs_java",
+    "rules_nixpkgs_python",
+]]
+
 rules_nixpkgs_dependencies()
 
 load(
@@ -13,12 +26,19 @@ load(
 nixpkgs_local_repository(
     name = "nixpkgs",
     nix_file = "//:default.nix",
-    nix_file_deps = [ "//:message.nix" ],
+    nix_file_deps = ["//:message.nix"],
 )
 
 nixpkgs_package(
     name = "hello",
     attribute_path = "hello",
+    nixopts = [
+        "--option",
+        "sandbox",
+        "false",
+        "--option",
+        "binary-caches",
+        "",
+    ],
     repository = "@nixpkgs",
-    nixopts = [ "--option", "sandbox", "false", "--option", "binary-caches", "" ]
 )

toolchains/cc/BUILD.bazel

@@ -5,3 +5,9 @@ exports_files([
     "foreign_cc.bzl",
     "cc.nix",
 ])
+
+filegroup(
+    name = "srcs",
+    srcs = glob(["**"]),
+    visibility = ["//visibility:public"],
+)

toolchains/java/BUILD.bazel

@@ -2,4 +2,10 @@ package(default_visibility = ["//visibility:public"])
 
 exports_files([
     "java.bzl",
-])
+])
+
+filegroup(
+    name = "srcs",
+    srcs = glob(["**"]),
+    visibility = ["//visibility:public"],
+)