Ah, my suggestion is you have a BUILD file and a BUILD.internal file. In the BUILD file, you have a python_library target containing most of the sources, and a python_binary. The binary would depend on the default, OSS configuration target. In BUILD.internal, you’d have a separate python_binary that depends on the internal config. When publishing the OSS extraction, you skip the BUILD.internal file