Add bash to #! line for python wrapper in nixpkgs

Leverage makeScriptWriter from nixpkgs that includes fix
NixOS/nixpkgs#93757 for macOS compatibility.

Fixes tweag#186

.github/workflows/workflow.yaml

@@ -64,8 +64,6 @@ jobs:
           without_nix=( cc go rust )
 
           if [ "${{ runner.os }}" == "macOS" ]; then
-            # Python - https://github.com/tweag/rules_nixpkgs/issues/186
-            skip with_nix python
             # Rust - https://github.com/tweag/rules_nixpkgs/issues/187
             skip with_nix rust
             skip without_nix rust

nixpkgs/nixpkgs.bzl

@@ -1057,16 +1057,15 @@ _nixpkgs_python_toolchain = repository_rule(
 )
 
 def _python_nix_file_content(attribute_path, bin_path, version):
-    if versions.is_at_least("4.2.0", versions.get()):
-        stub_shebang = """stub_shebang = "#!${{{attribute_path}}}/{bin_path}",""".format(
-            attribute_path = attribute_path,
-            bin_path = bin_path,
-        )
-    else:
-        stub_shebang = ""
+    add_shebang = versions.is_at_least("4.2.0", versions.get())
 
     return """
 with import <nixpkgs> {{ config = {{}}; overlays = []; }};
+let
+  addShebang = {add_shebang};
+  interpreterPath = "${{{attribute_path}}}/{bin_path}";
+  shebangLine = interpreter: writers.makeScriptWriter {{ inherit interpreter; }} "shebang" "";
+in
 runCommand "bazel-nixpkgs-python-toolchain"
   {{ executable = false;
     # Pointless to do this on a remote machine.
@@ -1080,17 +1079,19 @@ runCommand "bazel-nixpkgs-python-toolchain"
     cat >>$n <<EOF
     py_runtime(
         name = "runtime",
-        interpreter_path = "${{{attribute_path}}}/{bin_path}",
+        interpreter_path = "${{interpreterPath}}",
         python_version = "{version}",
-        {stub_shebang}
+        ${{lib.optionalString addShebang ''
+          stub_shebang = "$(cat ${{shebangLine interpreterPath}})",
+        ''}}
         visibility = ["//visibility:public"],
     )
     EOF
   ''
 """.format(
+        add_shebang = "true" if add_shebang else "false",
         attribute_path = attribute_path,
         bin_path = bin_path,
-        stub_shebang = stub_shebang,
         version = version,
     )