From e9d5ffcceaa98e010e9963356741141864fab0bb Mon Sep 17 00:00:00 2001
From: David Zbarsky <dzbarsky@gmail.com>
Date: Thu, 2 Jul 2026 23:54:19 -0400
Subject: [PATCH 1/2] fix: run executable zip action with execution Python

The legacy self-executable zip action used run_shell and an undeclared cat binary, so a Windows-hosted Bazel invocation could not run the action remotely on Linux.

Run the existing exe_zip_maker through actions_run so the helper and Python runtime come from the execution configuration.
---
 python/private/py_executable.bzl | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/python/private/py_executable.bzl b/python/private/py_executable.bzl
index c519af8c09..242b09344e 100644
--- a/python/private/py_executable.bzl
+++ b/python/private/py_executable.bzl
@@ -38,6 +38,7 @@ load(":cc_helper.bzl", "cc_helper")
 load(
     ":common.bzl",
     "ExplicitSymlink",
+    "actions_run",
     "collect_cc_info",
     "collect_deps",
     "collect_imports",
@@ -219,6 +220,10 @@ accepting arbitrary Python versions.
             default = "//python/private:debugger_if_target_config",
             providers = [PyInfo],
         ),
+        "_exe_zip_maker": lambda: attrb.Label(
+            cfg = "exec",
+            default = "//tools/private/zipapp:exe_zip_maker",
+        ),
         "_launcher": lambda: attrb.Label(
             cfg = "target",
             # NOTE: This is an executable, but is only used for Windows. It
@@ -1095,15 +1100,16 @@ def _create_executable_zip_file(
     else:
         ctx.actions.write(prelude, "#!/usr/bin/env python3\n")
 
-    ctx.actions.run_shell(
-        command = "cat {prelude} {zip} > {output}".format(
-            prelude = prelude.path,
-            zip = zip_file.path,
-            output = output.path,
-        ),
-        inputs = [prelude, zip_file],
+    args = ctx.actions.args()
+    args.add(prelude)
+    args.add(zip_file)
+    args.add(output)
+    actions_run(
+        ctx,
+        executable = ctx.attr._exe_zip_maker,
+        arguments = [args],
+        inputs = depset([prelude, zip_file]),
         outputs = [output],
-        use_default_shell_env = True,
         mnemonic = "PyBuildExecutableZip",
         progress_message = "Build Python zip executable: %{label}",
     )

From 3367ac21dc4440d22e38a08ab1d6aea391f4aece Mon Sep 17 00:00:00 2001
From: Richard Levasseur <richardlev@gmail.com>
Date: Fri, 3 Jul 2026 14:10:06 +0000
Subject: [PATCH 2/2] chore: add news entry for PR 3890

---
 news/3890.fixed.md | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 news/3890.fixed.md

diff --git a/news/3890.fixed.md b/news/3890.fixed.md
new file mode 100644
index 0000000000..59cd5fc5ca
--- /dev/null
+++ b/news/3890.fixed.md
@@ -0,0 +1,2 @@
+(binaries) Fixed building of legacy zipapps on Windows execution platforms by
+using a hermetic tool instead of host `cat`.