-
Notifications
You must be signed in to change notification settings - Fork 285
Enable Bzlmod #1722
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Enable Bzlmod #1722
Conversation
All but finishes bazelbuild#1482, save for publication of the first `rules_scala` release to the Bazel Central Registry. Closes bazelbuild#1625. The module extensions and underlying helper macros comprise the most significant part of the change. The extensions provide a thin layer over the existing `WORKSPACE` API. The `scala/private/macros/bzlmod.bzl` docstring explains the common pattern employed throughout. - `scala/extensions/config.bzl`: invokes `scala_config()` - `scala/extensions/deps.bzl`: invokes `scala_toolchains()` - `scala/extensions/protoc.bzl`: invokes `scala_protoc_toolchains()` - `scala/private/extensions/dev_deps.bzl`: internal testing dependencies - `scala/private/macros/bzlmod.bzl`: module extension helper macros Existing tests thoroughly validate `config.bzl`, `deps.bzl`, `dev_deps.bzl`, and `protoc.bzl`. `test/shell/test_bzlmod_macros.sh` tests the helpers from `scala/private/macros/bzlmod.bzl` using the new test files from `scala/private/macros/test/...`. Most of the new files are essentially boilerplate: - Adds `MODULE.bazel` files mirroring existing `WORKSPACE` configurations and copies of the `protobuf` toolchainization patch to the main repo and every nested repo. - Adds empty `WORKSPACE.bzlmod` files to ensure that Bzlmod won't evaluate the `WORKSPACE` files. These changes update CI: - Sets `--noenable_workspace` in `.bazelrc` and `tools/bazel.rc.buildkite`. - Reenables the `last_green` Bazel build in `.bazelci/presubmit.yml`. - Replaces `//tools:lint_check` in CI with `test_lint.sh`, which now runs `test/shell/test_bzlmod_tidy.sh` to lint `MODULE.bazel` files. All other changes: - Adds `.bazelignore` to work around bazelbuild/bazel#22208. - Adds `.bcr/` files for publishing to the Bazel Central Registry using the Publish to BCR GitHub app. See `.bcr/README.md`. - Adds `assert_matches` to `test/shell/test_helper.sh` for use in `test/shell/test_bzlmod_macros.sh`. - `test/shell/test_bzlmod_macros.sh` introduces a mechanism for automatically finding and skipping tests, documented in the comment at the bottom of the file. - Adds `bazel mod tidy` checks to `test_lint.sh` and `test_version.sh`. - Adds `bazel clean --expunge_async` to tests that create temporary repos. - Adds the `test_cleanup.sh` script to reclaim disk space. --- This change enables Bazel 7 and 8 users to migrate their `rules_scala` dependency from `WORKSPACE` to `MODULE.bazel` whenever they're ready. It also ensures that new changes are compatible with the `last_green` build of Bazel, and enables publishing releases to the Bazel Central Registry. Per the "Publish to BCR" workflow setup instructions linked from `.bcr/README.md`, we need to: - create a fork of `bazelbuild/bazel-central-registry` (presumably `simuons/bazel-central-registry`) - configure the "Publish to BCR" app for both that fork and `bazelbuild/rules_scala` Once these items are ready, we can push a release tag to publish the first `rules_scala` Bazel module to https://registry.bazel.build/. At that point, we can close bazelbuild#1482.
Updates `.github/workflows/release.yml` and adds `publish-to-bcr.yml` for publishing to the Bazel Central Registry. Part of bazelbuild#1482 broken out from bazelbuild#1722. `release.yml` now uses the `release_ruleset` workflow from `bazel-contrib/.github`, which does everything `release.yml` did previously and adds SLSA provenance attestations. `release.yml` then invokes the new `publish-to-bcr.yml` workflow after publishing a successful release to GitHub. Based on aspect-build/rules_lint#498 and aspect-build/rules_lint#501. See `.bcr/README.md`. --- Extracting this from bazelbuild#1722 makes that pull request more focused, and prevents holding it up based on any discussion around these workflow changes in particular. It's also unclear if the infrastructure will be in place to support these workflows before we're ready to publish the first `rules_scala` module. Though these workflows will supersede the Publish to BCR app, it may take some time to resolve slsa-framework/slsa-verifier#840. aspect-build/rules_lint#508, @alexeagle manually triggered a workflow run based on these workflows, which generated an attestation: - https://github.com/aspect-build/rules_lint/actions/runs/14095611671 - https://github.com/aspect-build/rules_lint/attestations/5857159 Here are some examples of GitHub's attestation UI in general: - https://github.com/aspect-build/rules_lint/attestations And some relevant GitHub docs: - https://docs.github.com/en/actions/security-for-github-actions/security-guides/using-secrets-in-github-actions#using-secrets-in-a-workflow - https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/accessing-contextual-information-about-workflow-runs#secrets-context - https://docs.github.com/en/actions/sharing-automations/reusing-workflows#passing-inputs-and-secrets-to-a-reusable-workflow - https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#onworkflow_callsecrets
I've made a couple fixes and experimented a bit over the weekend. In the process, I've broken out the following branches based on this one, for after this pull request lands:
This change is definitely larger than I'd like, even after accounting for the boilerplate: $ git show --stat | grep ' | ' | wc -l
85
$ git show --stat | grep ' | ' | grep 'WORKSPACE\.bzlmod' | wc -l
16
$ git show --stat | grep ' | ' | grep 'MODULE.bazel' | wc -l
17
$ git show --stat | grep ' | ' | grep 'protobuf.patch' | wc -l
13
$ bc <<<'85 - 16 - 17 - 13'
39 As always, I'm happy to break this into smaller pull requests if desired. For example, all the |
Because this is under the |
@kormide Thanks for the heads-up; I thought it was optional based on the docs. But now I'm trying to square that with @meteorcloudy's comment in #1616 (comment) indicating a fixed releaser won't be necessary if the repo moves before publishing:
So should I add the |
If you transfer the repo before publishing then it won't be necessary. After transferring, the app will default to using bazel-contrib's fork of the BCR. If you add the config file now and keep it, that override of which fork to use will remain. |
@mbland I'm sorry this PR is hanging for two week now. I'll come to this in the beginning of the next week. |
Updates `.github/workflows/release.yml` and adds `publish-to-bcr.yml` for publishing to the Bazel Central Registry. Part of bazelbuild#1482 broken out from bazelbuild#1722. `release.yml` now uses the `release_ruleset` workflow from `bazel-contrib/.github`, which does everything `release.yml` did previously and adds SLSA provenance attestations. `release.yml` then invokes the new `publish-to-bcr.yml` workflow after publishing a successful release to GitHub. Based on aspect-build/rules_lint#498 and aspect-build/rules_lint#501. See `.bcr/README.md`. --- Extracting this from bazelbuild#1722 makes that pull request more focused, and prevents holding it up based on any discussion around these workflow changes in particular. It's also unclear if the infrastructure will be in place to support these workflows before we're ready to publish the first `rules_scala` module. Though these workflows will supersede the Publish to BCR app, it may take some time to resolve slsa-framework/slsa-verifier#840. aspect-build/rules_lint#508, @alexeagle manually triggered a workflow run based on these workflows, which generated an attestation: - https://github.com/aspect-build/rules_lint/actions/runs/14095611671 - https://github.com/aspect-build/rules_lint/attestations/5857159 Here are some examples of GitHub's attestation UI in general: - https://github.com/aspect-build/rules_lint/attestations And some relevant GitHub docs: - https://docs.github.com/en/actions/security-for-github-actions/security-guides/using-secrets-in-github-actions#using-secrets-in-a-workflow - https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/accessing-contextual-information-about-workflow-runs#secrets-context - https://docs.github.com/en/actions/sharing-automations/reusing-workflows#passing-inputs-and-secrets-to-a-reusable-workflow - https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#onworkflow_callsecrets
Updates `_aspect_impl()` in `test/aspect/aspect.bzl` to return a new `VisitedInfo` provider instead of a `struct`. This fixes `//test/aspect:aspect_test` when building with the `last_green` bazel: - bazel-a91a6a77171c008598bdee53d144792c95211890-darwin-arm64 ```txt $ USE_BAZEL_VERSION=last_green \ bazel test --test_output=errors //test/aspect:aspect_test ERROR: testing/toolchain/BUILD:10:27: in //test/aspect:aspect.bzl%test_aspect aspect on testing_toolchain_deps rule //testing/toolchain:junit_classpath: Returning a struct from an aspect implementation function is deprecated. ERROR: Analysis of target '//testing/toolchain:junit_classpath' failed ERROR: Analysis of target '//test/aspect:aspect_test' failed; build aborted: Analysis failed ``` This `last_green` Bazel build contains the following commit, summarized as "Remove support for returning struct providers from aspects": - bazelbuild/bazel@07cddaf That commit is related to: - bazelbuild/bazel#25836 - bazelbuild/bazel#25819 - bazelbuild/intellij#7606
Hi, @mbland, would it be possible to somehow reuse |
scala/extensions/deps.bzl
Outdated
"jmh": False, | ||
} | ||
|
||
_toolchains_attrs = { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm trying to understand proposed design of how toolchains are defined.
As I understood scala_toolchains()
was needed to gather all the toolchains into single repo, that was a prerequisite for bzlmod. So in that case bool flags made sense which didn't require to invent a complicated schema.
I think in bzlmod each boolean attr could be a separate tag_class with it's own set of attributes.
Do I understand correctly that defaults are configured in module file though extensions, but if users wants custom toolchain they define those via macros in bzl file?
Ideally users should be able to configure "everything" in a module file via extensions.
What I am missing?
Overall PR look amazing. Thanks for thorough documentation and extensive test suite.
I'm currently looking at proposed extensions and pattern of defining defaults, attrs, and tag
which I don't yet fully understand.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The current implementation of the module extensions essentially does two things:
- Collects all the metadata from the graph of
MODULE.bazel
files. Most of them only care about the root module, and set reasonable defaults if the root module doesn't use the extension. (Therules_scala
module _does_use them all, which means they'll always execute either way.) - Calls
scala_toolchains()
with this metadata.
The idea is that the Bzlmod API will look and behave very similarly to the WORKSPACE
API. The comparison between the two in the "New scala_toolchains()
API for WORKSPACE
" and "Bzlmod configuration" sections of README.md
illustrates this.
We could have users instantiate a separate tag class per toolchain, so if you strongly prefer that API, I can update it accordingly. We do already have tag classes specifically for scalafmt
and twitter_scrooge
settings; all other potential tag classes wouldn't contain any members. In other words, instead of:
scala_deps.toolchains(
scalafmt = True,
scalatest = True,
)
We'd have:
scala_deps.scalafmt()
scala_deps.scalatest()
I kinda prefer the existing version (not only because it's already implemented), but will do whatever you want with it here.
As far as trying to support user defined toolchains via module extensions, I don't believe that would work comfortably. User-defined toolchains rely on repos visible to the user's module, possibly via rules_jvm_external
. If we wanted to generate them in our own module extension, the user would then likely have to use inject_repo to inject them all into the extension. It seems like it would complicate the UI with no tangible benefit.
Of course, I could be mistaken about that, and would be happy to try implementing that option if I am. Just let me know what you'd like to do either way!
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
On second thought, regarding having each toolchain have its own tag class: I'll try to experiment with that tomorrow.
I have a couple of other tweaks I'm going to play with tomorrow, too: updating the running of the new Bzlmod tests, and removing the empty WORKSPACE.bzlmod
files since the .bazelrc
flags already work well enough. I'll ping when I'm done with all of these little experiments and updates.
Regarding registering user toolchains through module extensions, I'm currently seeing more problems and fewer benefits. I'll keep thinking about it, but I'm still thinking that it makes more sense to leave the BUILD
macro schema as is.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Regarding registering user toolchains through module extensions, I'm currently seeing more problems and fewer benefits.
Could you clarify what problems this could cause? Definitely you have deeper knowledge that I do at the moment and I might be missing something. My thinking was that we should expose unified interface for configuring toolchains instead of configuring defaults via module extension and for advanced uses resort to macros in build file. Workspaces will go away and I think we should not tie module extensions to it.
I'm taking second round at it and I'll try to understand what I've missed.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Could you clarify what problems this could cause? Definitely you have deeper knowledge that I do at the moment and I might be missing something. My thinking was that we should expose unified interface for configuring toolchains instead of configuring defaults via module extension and for advanced uses resort to macros in build file. Workspaces will go away and I think we should not tie module extensions to it.
I'm taking second round at it and I'll try to understand what I've missed.
Sure. Presenting a more unified interface makes sense, but I feel like releasing the current interface sooner than later provides lower risk and higher value.
Toolchain macros aren't evaluated by either WORKSPACE
or Bzlmod; they're always evaluated in BUILD
files. The scala_toolchains()
call evaluated under both WORKSPACE
and Bzlmod is a wrapper around the _scala_toolchains_repo()
repository rule. That repo rule emits @rules_scala_toolchains
, whose BUILD
files call the toolchain macros. So even when WORKSPACE
goes away, all these mechanisms will remain and continue to work.
Since WORKSPACE
going away won't break toolchain macro calls, replacing them with an extension would delay the next release and add friction to adopting Bzlmod. Then there's potential complications that will likely emerge when actually trying to implement the extension. If this Bzlmod journey has revealed nothing else, it's that complications lurk around almost every corner.
I'd prefer to release what's working now to help rules_scala
users migrate to Bzlmod as soon as possible. Then we can try to experiment with updating the module extension to replace direct toolchain macro access. If it works, it can be part of a point release. Then public access to the workspace macros can go away in the next major release after that. That's my preference, but I don't mind taking the time to do things right, so I'm happy to try it first if you insist.
Replaces all the `protobuf.patch` instances in every nested module with a symlink to `protoc/0001-protobuf-19679-rm-protoc-dep.patch`. This reduces the duplication of the identical `protobuf` patch everywhere. I'd originally copied the file because: - Bzlmod requires that patches reside in the same repo. It does not allow target labels to other repositories. - Target labels cannot contain a relative path. - Windows historically doesn't allow non-admin users to create symlinks. However, Windows should allow symlinks now if permissions are set properly, and the Bazel CI system seems to set them: - https://stackoverflow.com/questions/5917249/git-symbolic-links-in-windows/59761201#59761201 - https://github.com/bazelbuild/continuous-integration/blob/028b90080584ad1fbc600e647a1b801337c0abf3/buildkite/startup-windows-pdssd.ps1#L56-L60
Done, replacing them all with symlinks in 3e377e4. As I mention in that commit message, I was afraid that this might break the Windows build. However, I should've done my research before, as it actually works fine with Windows set up the right way (and the Bazel CI is, of course, set up to allow them). And for that matter, it seems the Windows build doesn't run any tests that depend on nested modules anyway. |
Removes `trap` statements to allow running `test_bzlmod_scala.sh` by sourcing it from `test_rules_scala.sh`. Also removes `trap` statement from `test_bzlmod_tidy.sh` since it's not really necessary. This is an attempt to ensure the `test_bzlmod_scala.sh` test run on all the `test_rules_scala.sh` CI runs on different platforms. I'd noticed that the `test_bzlmod_scala.sh` tests were only executing on macOS runs of `test_rules_scala.sh` in: - https://buildkite.com/bazel/rules-scala-scala/builds/5538 `test_bzlmod_scala.sh` was the only script that `test_rules_scala.sh` ran normally instead of sourcing it. I'd originally set it up that way because the `trap` statements would cause later `test_rules_scala.sh` tests to fail.
It turns out that escaping `{` and `}` in Bash regular expressions isn't necessary on macOS, but is necessary on Linux. Locally, on macOS 15.4.1, I'm running Bash 5.2.37(1)-release. I built the same ubuntu2004 image from bazelbuild/continuous-integration locally, and it uses Bash 5.0.17(1)-release. I can't find a definitive entry in https://tiswww.case.edu/php/chet/bash/CHANGES accounting for the difference. Different underlying regex library implementations, perhaps?
Copies `tools/bazel.rc` to the test repos generated by `test_bzlmod_macros` to fix the `test_rules_scala_jdk21` CI job. Updates `_print_error_msg()` to fix Windows error output, and uses relative paths with `local_path_override` to fix `test_rules_scala_win`. Escaping `}` and `{` characters in the previous commit allowed the `test_bzlmod_macros` tests to run on Linux and Windows. Then `test_rules_scala_jdk21` failed with: ```txt [FATAL 17:39:54.401 src/main/cpp/blaze.cc:1105] Unexpected error reading config file '/workdir/tmp/test_bzlmod_macros/tools/bazel.rc': (error: 2): No such file or directory" Test "test_bzlmod_single_tag_values_returns_defaults_when_no_root_tag" failed (0 sec) ``` `test_rules_scala_win` failed with a malformed looking error message: ```txt ERROR: <builtin>: fetching local_repository rule //:rules_scala+: java.io.IOException: Could not create symlink to repository "/c/b/bk-windows-j20f/bazel/rules-scala-scala" (absolute path: "/c/b/bk-windows-j20f/bazel/rules-scala-scala"): Cannot create junction (name=C: ools\msys64\hom\_bazel_b ules_scala+, target= Test "test_bzlmod_single_tag_values_returns_defaults_when_no_root_tag" failed (3 sec) ``` Recreating this in a local Windows VM revealed a problem with `_print_error_message()` that also mangled local error messages: ```txt Value did not match regular expression Expected: "foo bar baz$" test/shell/test_helper.sh: line 148: printf: missing unicode digit for \u Actual: "Computing main repo mapping: ERROR: <builtin>: fetching local_repository rule //:rules_scala+: java.io.IOException: Could not create symlink to repository "/c/Users/msb/src/bazelbuild/rules_ules_scala+, target=h: "/c/Users/msb/src/bazelbuild/rules_scala"): Cannot create junction (name=C:\users\msb\_bazel_msb\ieysfhucternal Test "test_bzlmod_single_tag_values_returns_defaults_when_no_root_tag" failed (0 sec) ``` Fixing it (changing the `%b` specifier for `printf` to `%s`) revealed a more comprehensible error: ```txt Value did not match regular expression Expected: "foo bar baz$" Actual: "Computing main repo mapping: ERROR: <builtin>: fetching local_repository rule //:rules_scala+: java.io.IOException: Could not create symlink to repository "/c/Users/msb/src/bazelbuild/rules_scala" (absolute path: "/c/Users/msb/src/bazelbuild/rules_scala"): Cannot create junction (name=C:\users\msb\_bazel_msb\ieysfhuc\external\rules_scala+, target=\c\Users\msb\src\bazelbuild\rules_scala): ERROR: src/main/native/windows/file-jni.cc(122): nativeCreateJunction( \\?\C:\users\msb\_bazel_msb\ieysfhuc\external\rules_scala+, \\?\\c\Users\msb\src\bazelbuild\rules_scala): ERROR: src/main/native/windows/file.cc(231): CreateJunction(\\?\\c\Users\msb\src\bazelbuild\rules_scala): expected an absolute Windows path for junction_target ERROR: Error computing the main repository mapping: error during computation of main repo mapping: Could not create symlink to repository "/c/Users/msb/src/bazelbuild/rules_scala" (absolute path: "/c/Users/msb/src/bazelbuild/rules_scala"): Cannot create junction (name=C:\users\msb\_bazel_msb\ieysfhuc\external\rules_scala+, target=\c\Users\msb\src\bazelbuild\rules_scala): ERROR: src/main/native/windows/file-jni.cc(122): nativeCreateJunction( \\?\C:\users\msb\_bazel_msb\ieysfhuc\external\rules_scala+, \\?\\c\Users\msb\src\bazelbuild\rules_scala): ERROR: src/main/native/windows/file.cc(231): CreateJunction(\\?\\c\Users\msb\src\bazelbuild\rules_scala): expected an absolute Windows path for junction_target" Test "test_bzlmod_single_tag_values_returns_defaults_when_no_root_tag" failed (0 sec) ``` This shows clearly that the MSYS2 mapping of `C:\` paths to `/c/` breaks the underlying symlink operation: - https://github.com/bazelbuild/bazel/blob/release-7.6.0/src/main/java/com/google/devtools/build/lib/rules/repository/RepositoryDelegatorFunction.java#L508-L517 The fix was to use relative paths instead of absolute paths in the `local_path_override` directives of the generated `MODULE.bazel` files.
Setting `--noenable_workspace` in `.bazelrc` suffices in Bazel 7, and Bazel 8 defaults to it anyway.
Replaces the `scala_deps.toolchains` tag class, which contained boolean parameters for selecting toolchains, with a series of individual tag classes for each toolchain. Suggested by @simuons in the following comment as an alternative implementation that could allow for adding attributes to each toolchain's tag class. - bazelbuild#1722 (comment) We already had tag classes for `scalafmt`, `scala_proto`, and `twitter_scrooge` options. Now the presence of these tag classes, along with the tag classes added in this commit, translates to a `True` argument for `scala_toolchains()`.
@simuons I updated the tests (involving a bit of Bash and Windows fun), removed the empty |
Should've been part of the previous commit, but I missed them.
Updates `.github/workflows/release.yml` and adds `publish-to-bcr.yml` for publishing to the Bazel Central Registry. Part of bazelbuild#1482 broken out from bazelbuild#1722. `release.yml` now uses the `release_ruleset` workflow from `bazel-contrib/.github`, which does everything `release.yml` did previously and adds SLSA provenance attestations. `release.yml` then invokes the new `publish-to-bcr.yml` workflow after publishing a successful release to GitHub. Based on aspect-build/rules_lint#498 and aspect-build/rules_lint#501. See `.bcr/README.md`. --- Extracting this from bazelbuild#1722 makes that pull request more focused, and prevents holding it up based on any discussion around these workflow changes in particular. It's also unclear if the infrastructure will be in place to support these workflows before we're ready to publish the first `rules_scala` module. Though these workflows will supersede the Publish to BCR app, it may take some time to resolve slsa-framework/slsa-verifier#840. aspect-build/rules_lint#508, @alexeagle manually triggered a workflow run based on these workflows, which generated an attestation: - https://github.com/aspect-build/rules_lint/actions/runs/14095611671 - https://github.com/aspect-build/rules_lint/attestations/5857159 Here are some examples of GitHub's attestation UI in general: - https://github.com/aspect-build/rules_lint/attestations And some relevant GitHub docs: - https://docs.github.com/en/actions/security-for-github-actions/security-guides/using-secrets-in-github-actions#using-secrets-in-a-workflow - https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/accessing-contextual-information-about-workflow-runs#secrets-context - https://docs.github.com/en/actions/sharing-automations/reusing-workflows#passing-inputs-and-secrets-to-a-reusable-workflow - https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#onworkflow_callsecrets
Updates `.github/workflows/release.yml` and adds `publish-to-bcr.yml` for publishing to the Bazel Central Registry. Part of bazelbuild#1482 broken out from bazelbuild#1722. `release.yml` now uses the `release_ruleset` workflow from `bazel-contrib/.github`, which does everything `release.yml` did previously and adds SLSA provenance attestations. `release.yml` then invokes the new `publish-to-bcr.yml` workflow after publishing a successful release to GitHub. Based on aspect-build/rules_lint#498 and aspect-build/rules_lint#501. See `.bcr/README.md`. --- Extracting this from bazelbuild#1722 makes that pull request more focused, and prevents holding it up based on any discussion around these workflow changes in particular. It's also unclear if the infrastructure will be in place to support these workflows before we're ready to publish the first `rules_scala` module. Though these workflows will supersede the Publish to BCR app, it may take some time to resolve slsa-framework/slsa-verifier#840. aspect-build/rules_lint#508, @alexeagle manually triggered a workflow run based on these workflows, which generated an attestation: - https://github.com/aspect-build/rules_lint/actions/runs/14095611671 - https://github.com/aspect-build/rules_lint/attestations/5857159 Here are some examples of GitHub's attestation UI in general: - https://github.com/aspect-build/rules_lint/attestations And some relevant GitHub docs: - https://docs.github.com/en/actions/security-for-github-actions/security-guides/using-secrets-in-github-actions#using-secrets-in-a-workflow - https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/accessing-contextual-information-about-workflow-runs#secrets-context - https://docs.github.com/en/actions/sharing-automations/reusing-workflows#passing-inputs-and-secrets-to-a-reusable-workflow - https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#onworkflow_callsecrets
Updates `.github/workflows/release.yml` and adds `publish-to-bcr.yml` for publishing to the Bazel Central Registry. Part of bazelbuild#1482 broken out from bazelbuild#1722. `release.yml` now uses the `release_ruleset` workflow from `bazel-contrib/.github`, which does everything `release.yml` did previously and adds SLSA provenance attestations. `release.yml` then invokes the new `publish-to-bcr.yml` workflow after publishing a successful release to GitHub. Based on aspect-build/rules_lint#498 and aspect-build/rules_lint#501. See `.bcr/README.md`. --- Extracting this from bazelbuild#1722 makes that pull request more focused, and prevents holding it up based on any discussion around these workflow changes in particular. It's also unclear if the infrastructure will be in place to support these workflows before we're ready to publish the first `rules_scala` module. Though these workflows will supersede the Publish to BCR app, it may take some time to resolve slsa-framework/slsa-verifier#840. aspect-build/rules_lint#508, @alexeagle manually triggered a workflow run based on these workflows, which generated an attestation: - https://github.com/aspect-build/rules_lint/actions/runs/14095611671 - https://github.com/aspect-build/rules_lint/attestations/5857159 Here are some examples of GitHub's attestation UI in general: - https://github.com/aspect-build/rules_lint/attestations And some relevant GitHub docs: - https://docs.github.com/en/actions/security-for-github-actions/security-guides/using-secrets-in-github-actions#using-secrets-in-a-workflow - https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/accessing-contextual-information-about-workflow-runs#secrets-context - https://docs.github.com/en/actions/sharing-automations/reusing-workflows#passing-inputs-and-secrets-to-a-reusable-workflow - https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#onworkflow_callsecrets
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@mbland looks awesome to me. Thanks for this. I'm also grateful for all the improvements you did in testing infra. I'll keep it hanging for couple more days in case someone would be willing to take a look as well and then I'll merge it. Thank you!
Updates `.github/workflows/release.yml` and adds `publish-to-bcr.yml` for publishing to the Bazel Central Registry. Part of bazelbuild#1482 broken out from bazelbuild#1722. `release.yml` now uses the `release_ruleset` workflow from `bazel-contrib/.github`, which does everything `release.yml` did previously and adds SLSA provenance attestations. `release.yml` then invokes the new `publish-to-bcr.yml` workflow after publishing a successful release to GitHub. Based on aspect-build/rules_lint#498 and aspect-build/rules_lint#501. See `.bcr/README.md`. --- Extracting this from bazelbuild#1722 makes that pull request more focused, and prevents holding it up based on any discussion around these workflow changes in particular. It's also unclear if the infrastructure will be in place to support these workflows before we're ready to publish the first `rules_scala` module. Though these workflows will supersede the Publish to BCR app, it may take some time to resolve slsa-framework/slsa-verifier#840. aspect-build/rules_lint#508, @alexeagle manually triggered a workflow run based on these workflows, which generated an attestation: - https://github.com/aspect-build/rules_lint/actions/runs/14095611671 - https://github.com/aspect-build/rules_lint/attestations/5857159 Here are some examples of GitHub's attestation UI in general: - https://github.com/aspect-build/rules_lint/attestations And some relevant GitHub docs: - https://docs.github.com/en/actions/security-for-github-actions/security-guides/using-secrets-in-github-actions#using-secrets-in-a-workflow - https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/accessing-contextual-information-about-workflow-runs#secrets-context - https://docs.github.com/en/actions/sharing-automations/reusing-workflows#passing-inputs-and-secrets-to-a-reusable-workflow - https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#onworkflow_callsecrets
Updates `.github/workflows/release.yml` and adds `publish-to-bcr.yml` for publishing to the Bazel Central Registry. Part of bazelbuild#1482 broken out from bazelbuild#1722. `release.yml` now uses the `release_ruleset` workflow from `bazel-contrib/.github`, which does everything `release.yml` did previously and adds SLSA provenance attestations. `release.yml` then invokes the new `publish-to-bcr.yml` workflow after publishing a successful release to GitHub. Based on aspect-build/rules_lint#498 and aspect-build/rules_lint#501. See `.bcr/README.md`. --- Extracting this from bazelbuild#1722 makes that pull request more focused, and prevents holding it up based on any discussion around these workflow changes in particular. It's also unclear if the infrastructure will be in place to support these workflows before we're ready to publish the first `rules_scala` module. Though these workflows will supersede the Publish to BCR app, it may take some time to resolve slsa-framework/slsa-verifier#840. aspect-build/rules_lint#508, @alexeagle manually triggered a workflow run based on these workflows, which generated an attestation: - https://github.com/aspect-build/rules_lint/actions/runs/14095611671 - https://github.com/aspect-build/rules_lint/attestations/5857159 Here are some examples of GitHub's attestation UI in general: - https://github.com/aspect-build/rules_lint/attestations And some relevant GitHub docs: - https://docs.github.com/en/actions/security-for-github-actions/security-guides/using-secrets-in-github-actions#using-secrets-in-a-workflow - https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/accessing-contextual-information-about-workflow-runs#secrets-context - https://docs.github.com/en/actions/sharing-automations/reusing-workflows#passing-inputs-and-secrets-to-a-reusable-workflow - https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#onworkflow_callsecrets
Updates `.github/workflows/release.yml` and adds `publish-to-bcr.yml` for publishing to the Bazel Central Registry. Part of bazelbuild#1482 broken out from bazelbuild#1722. `release.yml` now uses the `release_ruleset` workflow from `bazel-contrib/.github`, which does everything `release.yml` did previously and adds SLSA provenance attestations. `release.yml` then invokes the new `publish-to-bcr.yml` workflow after publishing a successful release to GitHub. Based on aspect-build/rules_lint#498 and aspect-build/rules_lint#501. See `.bcr/README.md`. --- Extracting this from bazelbuild#1722 makes that pull request more focused, and prevents holding it up based on any discussion around these workflow changes in particular. It's also unclear if the infrastructure will be in place to support these workflows before we're ready to publish the first `rules_scala` module. Though these workflows will supersede the Publish to BCR app, it may take some time to resolve slsa-framework/slsa-verifier#840. aspect-build/rules_lint#508, @alexeagle manually triggered a workflow run based on these workflows, which generated an attestation: - https://github.com/aspect-build/rules_lint/actions/runs/14095611671 - https://github.com/aspect-build/rules_lint/attestations/5857159 Here are some examples of GitHub's attestation UI in general: - https://github.com/aspect-build/rules_lint/attestations And some relevant GitHub docs: - https://docs.github.com/en/actions/security-for-github-actions/security-guides/using-secrets-in-github-actions#using-secrets-in-a-workflow - https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/accessing-contextual-information-about-workflow-runs#secrets-context - https://docs.github.com/en/actions/sharing-automations/reusing-workflows#passing-inputs-and-secrets-to-a-reusable-workflow - https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#onworkflow_callsecrets
Description
All but finishes #1482, save for publication of the first
rules_scala
release to the Bazel Central Registry. Closes #1625.The module extensions and underlying helper macros comprise the most significant part of the change. The extensions provide a thin layer over the existing
WORKSPACE
API. Thescala/private/macros/bzlmod.bzl
docstring explains the common pattern employed throughout.scala/extensions/config.bzl
: invokesscala_config()
scala/extensions/deps.bzl
: invokesscala_toolchains()
scala/extensions/protoc.bzl
: invokesscala_protoc_toolchains()
scala/private/extensions/dev_deps.bzl
: internal testing dependenciesscala/private/macros/bzlmod.bzl
: module extension helper macrosExisting tests thoroughly validate
config.bzl
,deps.bzl
,dev_deps.bzl
, andprotoc.bzl
.test/shell/test_bzlmod_macros.sh
tests the helpers fromscala/private/macros/bzlmod.bzl
using the new test files fromscala/private/macros/test/...
.Most of the new files are essentially boilerplate:
Adds
MODULE.bazel
files mirroring existingWORKSPACE
configurations.Adds symlinks to the
protobuf
toolchainization patch to every nested repo.These changes update CI:
Sets
--noenable_workspace
in.bazelrc
andtools/bazel.rc.buildkite
.Reenables the
last_green
Bazel build in.bazelci/presubmit.yml
.Replaces
//tools:lint_check
in CI withtest_lint.sh
, which now runstest/shell/test_bzlmod_tidy.sh
to lintMODULE.bazel
files.All other changes:
Adds
.bazelignore
to work around Loading top-level targets in local_path_override modules in child directory breaks the build bazel#22208.Adds
.bcr/
files for publishing to the Bazel Central Registry using the Publish to BCR GitHub app. See.bcr/README.md
.Adds
assert_matches
totest/shell/test_helper.sh
for use intest/shell/test_bzlmod_macros.sh
.test/shell/test_bzlmod_macros.sh
introduces a mechanism for automatically finding and skipping tests, documented in the comment at the bottom of the file.Adds
bazel mod tidy
checks totest_lint.sh
andtest_version.sh
.Adds
bazel clean --expunge_async
to tests that create temporary repos.Adds the
test_cleanup.sh
script to reclaim disk space.Motivation
This change enables Bazel 7 and 8 users to migrate their
rules_scala
dependency fromWORKSPACE
toMODULE.bazel
whenever they're ready. It also ensures that new changes are compatible with thelast_green
build of Bazel, and enables publishing releases to the Bazel Central Registry.The rest of the "Publish to BCR" workflow will come in a subsequent PR. Once it's ready, we can push a release tag to publish the first
rules_scala
Bazel module to https://registry.bazel.build/.At that point, we can close #1482.