allow value of --credential_helper to be an inline bash script

[thesayyn]

Description of the feature request:

Currently, the value of --credential_helper can be either the path to a script that resides in the workspace or an executable on PATH. This forces users to install the helper beforehand which is undesirable for ruleset authors to force upon users.

Which category does this issue belong to?

CLI, Loading API, Rules API

What underlying problem are you trying to solve with this feature?

Our two rulesets suffer from this because rctx.download[_and_extract] does not support setting arbitrary headers to be sent over the HTTP requests. See #17829, therefore we are forced to use credential helpers to be able to set custom headers.

The motivation for this change is that it is easy to tell users to add a few lines to their bazelrc which will add headers based on our custom logic using a bash script.

For example, i can tell users to add these to their bazelrc

--credential_helper=".*dl-cdn.alpinelinux.org.*=bash -c '{\"headers\": {}}'"

whereas telling them to install an obscure binary from the internet.

Which operating system are you running Bazel on?

darwin/arm64

What is the output of bazel info release?

release 6.3.0

If bazel info release returns development version or (@non-git), tell us how you built Bazel.

No response

What's the output of git remote get-url origin; git rev-parse master; git rev-parse HEAD ?

No response

Have you found anything relevant by searching the web?

No response

Any other information, logs, or outputs that you want to share?

No response

[thesayyn]

cc @Yannic @@Wyverald

[fmeum]

Our two rulesets suffer from this because rctx.download[_and_extract] does not support setting arbitrary headers to be sent over the HTTP requests. See #17829, therefore we are forced to use credential helpers to be able to set custom headers.

This does sound to me as if we should really fix #17829 instead of trying to make --credential_helper work better in a case it wasn't designed for (ruleset usage).

[Yannic]

Agree with @fmeum. Rulesets shouldn't force all their users into credential helper