Description of the bug:

It's possible to create private repository rules (whose names start with an underscore) and use them via use_repo_rule. Probably that shouldn't be allowed.

Which category does this issue belong to?

Rules API

What's the simplest, easiest way to reproduce this bug? Please provide a minimal example if possible.

def.bzl:

def _foo_impl(ctx):
    ctx.file("BUILD.bazel", 'exports_files(["foo.txt"])')
    ctx.file("foo.txt", "hello world")

_foo = repository_rule(implementation = _foo_impl)

MODULE.bazel:

foo = use_repo_rule("//:def.bzl", "_foo")
foo(name = "foo")

BUILD.bazel:

genrule(
    name = "bar",
    srcs = ["@foo//:foo.txt"],
    outs = ["bar.txt"],
    cmd = "cp $< $@",
)

Building this repository will succeed even though the _foo repository rule is private (and Buildifier complains that it's unused).

Which operating system are you running Bazel on?

macOS 15.3.1

What is the output of bazel info release?

release 8.1.0

If bazel info release returns development version or (@non-git), tell us how you built Bazel.

No response

What's the output of git remote get-url origin; git rev-parse HEAD ?

If this is a regression, please try to identify the Bazel commit where the bug was introduced with bazelisk --bisect.

No response

Have you found anything relevant by searching the web?

Searched these places for "use_repo_rule", didn't find anything relevant

Any other information, logs, or outputs that you want to share?

No response