feat: Support supplying .netrc file

swiftpkg/bzlmod/swift_deps.bzl

@@ -238,6 +238,7 @@ def _declare_pkg_from_dependency(dep, config_pkg, from_package, config_swift_pac
             env_inherit = from_package.env_inherit,
             init_submodules = init_submodules,
             recursive_init_submodules = recursive_init_submodules,
+            netrc = from_package.netrc,
             patch_args = patch_args,
             patch_cmds = patch_cmds,
             patch_cmds_win = patch_cmds_win,
@@ -289,6 +290,7 @@ def _declare_swift_package_repo(name, from_package, config_swift_package):
             package = from_package.swift.package,
             name = from_package.swift.name,
         ),
+        netrc = from_package.netrc,
         registries = from_package.registries,
         **config_swift_package_kwargs
     )

swiftpkg/internal/swift_package.bzl

@@ -220,7 +220,13 @@ _ALL_ATTRS = dicts.add(
     _GIT_ATTRS,
     repo_rules.env_attrs,
     repo_rules.swift_attrs,
-    {"version": attr.string(doc = "The resolved version of the package.")},
+    {
+        "netrc": attr.label(
+            default = None,
+            doc = "A `.netrc` file for authentication when downloading binary artifacts.",
+        ),
+        "version": attr.string(doc = "The resolved version of the package."),
+    },
 )
 
 swift_package = repository_rule(

swiftpkg/internal/swift_package_tool.bzl

@@ -16,13 +16,17 @@ def _swift_package_tool_impl(ctx):
     cmd = ctx.attr.cmd
     package = ctx.attr.package
     package_path = paths.dirname(package)
+    netrc = ctx.file.netrc
     registries = ctx.file.registries
     runfiles = []
 
     toolchain = swift_common.get_toolchain(ctx)
     swift = toolchain.swift_worker
     runfiles.append(swift.executable)
 
+    if netrc:
+        runfiles.append(netrc)
+
     if registries:
         runfiles.append(registries)
 
@@ -43,6 +47,10 @@ def _swift_package_tool_impl(ctx):
         "true" if ctx.attr.dependency_caching else "false",
     )
     template_dict.add("%(manifest_cache)s", ctx.attr.manifest_cache)
+    template_dict.add(
+        "%(netrc_file)s",
+        netrc.short_path if netrc else "",
+    )
     template_dict.add(
         "%(registries_json)s",
         registries.short_path if registries else "",

swiftpkg/internal/swift_package_tool_attrs.bzl

@@ -1,9 +1,17 @@
 """Attributes shared between rules that interact with the Swift package tool."""
 
 _swift_package_registry_attrs = {
+    "netrc": attr.label(
+        allow_single_file = True,
+        doc = """
+A `.netrc` file that contains authentication credentials used for fetching Swift packages and or binary artifacts.
+
+When provided, this file will be passed to Swift Package Manager commands using \
+the `--netrc-file` flag during package resolution and updates.
+""",
+    ),
     "registries": attr.label(
         allow_single_file = [".json"],
-        cfg = "exec",
         doc = """
 A `registries.json` file that defines the configured Swift package registries.
 

swiftpkg/internal/swift_package_tool_repo.bzl

@@ -35,6 +35,21 @@ def _swift_package_tool_repo_impl(repository_ctx):
     attrs_content = _package_config_attrs_to_content(repository_ctx.attr)
     package_path = repository_ctx.attr.package
 
+    # We copy .netrc file contents to avoid requiring users to use `exports_files(...)`
+    netrc_attr = None
+    if repository_ctx.attr.netrc:
+        netrc_content = repository_ctx.read(repository_ctx.attr.netrc)
+        repository_ctx.file(".netrc", netrc_content)
+        netrc_attr = '    netrc = ":.netrc",'
+
+    attrs_lines = [line for line in attrs_content.split("\n") if "netrc =" not in line]
+    filtered_attrs = "\n".join(attrs_lines)
+
+    final_attrs_parts = [filtered_attrs]
+    if netrc_attr:
+        final_attrs_parts.append(netrc_attr)
+    final_attrs_content = "\n".join([p for p in final_attrs_parts if p])
+
     repository_ctx.file(
         "BUILD.bazel",
         content = """
@@ -55,7 +70,7 @@ swift_package_tool(
 )
 """.format(
             package = package_path,
-            attrs_content = attrs_content,
+            attrs_content = final_attrs_content,
         ),
     )
 

swiftpkg/internal/swift_package_tool_runner_template.sh

@@ -27,6 +27,7 @@ config_path="%(config_path)s"
 enable_build_manifest_caching="%(enable_build_manifest_caching)s"
 enable_dependency_cache="%(enable_dependency_cache)s"
 manifest_cache="%(manifest_cache)s"
+netrc_file="%(netrc_file)s"
 registries_json="%(registries_json)s"
 replace_scm_with_registry="%(replace_scm_with_registry)s"
 security_path="%(security_path)s"
@@ -57,6 +58,11 @@ fi
 
 args+=("--manifest-cache=$manifest_cache")
 
+# If netrc_file is set, add the --netrc-file flag.
+if [ -n "$netrc_file" ]; then
+	args+=("--netrc-file" "$(readlink -f "$netrc_file")")
+fi
+
 # If registries_json is set, symlink the `.json` file to the `config_path/configuration` directory.
 if [ -n "$registries_json" ]; then
 	mkdir -p "$config_path"