perf: migrate bash launcher to hermetic-build

[jbedard]

Changes are visible to end-users: yes

• Searched for relevant documentation and updated as needed: yes
• Breaking change (forces users to change their own code or config): no
• Suggested release notes appear below: yes

Use https://github.com/hermeticbuild/hermetic-launcher to launch the python toolchain instead of depending on a shell wrapper.

Test plan

• Covered by existing test cases
• Manual testing

[aspect-workflows]

Bazel 8 (Test)

All tests were cache hits

183 tests (100.0%) were fully cached saving 1m 5s.

---

Bazel 9 (Test)

All tests were cache hits

182 tests (100.0%) were fully cached saving 1m 10s.

---

Bazel 8 (Test)

e2e

All tests were cache hits

136 tests (100.0%) were fully cached saving 1m 21s.

---

Bazel 9 (Test)

e2e

All tests were cache hits

131 tests (100.0%) were fully cached saving 1m 1s.

---

Bazel 8 (Test)

examples/uv_pip_compile

All tests were cache hits

1 test (100.0%) was fully cached saving 444ms.

---

Buildifier      Gazelle

[jbedard]

Does anyone know of a better way of doing this? Should it be opt-in?

[jbedard]

I've found no better way of doing this. Alternatives would be:

• wrapper script, exactly what this PR is dropping
• hermetic_launcher supporting env vars (or appending to them specifically) which seems like a bad idea

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: dbccde5e29

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[aspect-workflows]

✨ Aspect Workflows Tasks

📅 Fri Jun 5 20:57:36 UTC 2026

✅ 6 successful tasks

• ✅ buildifier · ⏱ 19.8s · 🐙 GitHub Actions · ☑️ Check
  💬 Format complete (clean)
• ✅ gazelle · ⏱ 22.2s · 🐙 GitHub Actions · ☑️ Check
  💬 Gazelle complete (clean)
• ✅ test (test-e2e-bazel-8) · ⏱ 2m 5s · 🐙 GitHub Actions · ☑️ Check
  💬 Bazel test complete (139/139 passed)
• ✅ test (test-e2e-bazel-9) · ⏱ 2m 45s · 🐙 GitHub Actions · ☑️ Check
  💬 Bazel test complete (134/134 passed)
• ✅ test (test-examples-uv_pip_compile-bazel-8) · ⏱ 24.9s · 🐙 GitHub Actions · ☑️ Check
  💬 Bazel test complete (1/1 passed · 1 cached)
• ✅ test (test-root-bazel-8) · ⏱ 2m 2s · 🐙 GitHub Actions · ☑️ Check
  💬 Bazel test complete (184/184 passed)

---

_{⏱ Last updated Fri Jun 5 21:00:40 UTC 2026 · 📊 GitHub API quota 317/15,000 (2% used, resets in 37m)
🚀 Powered by Aspect CLI (v2026.22.44)  |  Aspect Build · X · LinkedIn · YouTube}

[github-actions]

py_binary startup benchmark

Version	Mean (ms)	Median (ms)	± stddev	vs BCR	vs main	Build (s)
BCR 1.11.5 (baseline)	318.202	315.340	±8.520	—	—	32.94
HEAD main	125.581	125.019	±2.681	-60.5%	—	12.10
This PR	59.534	59.387	±0.908	-81.3%	-52.6%	11.46

Measured with hyperfine --warmup 5 --runs 50 on Linux
Gate: PR vs HEAD main (threshold: 10%). BCR is shown only as a historical baseline.
Build time: cold bazel build //:bench with isolated output base, no disk cache.

sys.path quality

Version	sys.path entries	distinct site-packages roots	duplicate realpaths
BCR 1.11.5 (baseline)	6	1	0
HEAD main	7	2	0
This PR	7	2	0

sys.path quality measured by bench_syspath inside the assembled venv. Duplicate realpaths indicate symlink redundancy; many distinct site-packages roots suggest an inefficient venv layout.