Migrate to bzlmod

.bazelci/presubmit.yml

@@ -7,7 +7,7 @@ tasks:
   default_workspace_ubuntu1804:
     platform: ubuntu1804
     build_targets:
-      - "@protoapis//..."
+      - "@protobufapis//..."
       - "@googleapis//..."
     test_targets:
       - //example/...
@@ -19,11 +19,10 @@ tasks:
       - -//pkg/plugin/grpc/grpc:grpc_test # TODO(pcj): error "bazel_testing: read-only filesystem"
     test_flags:
       - --config=bazelci
-      - --deleted_packages=//plugin/grpc-ecosystem/grpc-gateway
   default_workspace_macos:
     platform: macos
     build_targets:
-      - "@protoapis//..."
+      - "@protobufapis//..."
       - "@googleapis//..."
     test_targets:
       - //example/...
@@ -32,5 +31,3 @@ tasks:
       - //plugin/...
       - //rules/...
       - //toolchain/...
-    test_flags:
-      - --deleted_packages=//plugin/grpc-ecosystem/grpc-gateway

.bazelignore

@@ -1,4 +1,3 @@
-docs/
 node_modules
 plugin/bufbuild/node_modules
 plugin/stephenh/ts-proto/node_modules

.bazelrc

@@ -1,29 +1,27 @@
+# =========================================================================
+# STARTUP
+# =========================================================================
 
-common --jvmopt=-Djava.security.manager=allow
-build --java_language_version=17
-build --java_runtime_version=remotejdk_17
-build --tool_java_language_version=17
-build --tool_java_runtime_version=remotejdk_17
+# Use blake3 as digest function instead of the much slower default sha256.
+startup --digest_function=blake3
 
-common --enable_platform_specific_config
-build:windows --cxxopt='/std:c++14'
-build:windows --host_cxxopt='/std:c++14'
-build:linux --cxxopt='-std=c++14'
-build:linux --host_cxxopt='-std=c++14'
-build:macos --cxxopt='-std=c++14'
-build:macos --host_cxxopt='-std=c++14'
-build:freebsd --cxxopt='-std=c++14'
-build:freebsd --host_cxxopt='-std=c++14'
+# =========================================================================
+# COMMON
+# =========================================================================
 
-build:bazelci --deleted_packages=docs
+# Use '+' instead of the legacy '~' when resolving repo names.
+common --incompatible_use_plus_in_repo_names
 
-# workaround for scala
-build --incompatible_java_common_parameters=false
+# =========================================================================
+# BUILD
+# =========================================================================
 
-# HOME appears to be required by //pkg/plugin/grpc/grpc:grpc_test
-# (for github.com/bazelbuild/rules_go/go/tools/bazel_testing)
-test --action_env=HOME
+# Don't leak PATH and LD_LIBRARY_PATH into the build.
+# build --incompatible_strict_action_env
 
-# Don't depend on a JAVA_HOME pointing at a system JDK
-# see https://github.com/bazelbuild/rules_jvm_external/issues/445
-build --repo_env=JAVA_HOME=../bazel_tools/jdk
+# Don't use legacy repository rules.
+build --incompatible_disable_native_repo_rules
+
+# C++17 for protobuf compatibility
+build --host_cxxopt=-std=c++17
+build --cxxopt=-std=c++17

.bazelversion

@@ -1 +1 @@
-6.4.0
+7.6.1

.github/workflows/ci.bazelrc

@@ -1,14 +1,13 @@
-# This file contains Bazel settings to apply on CI only.
-# It is referenced with a --bazelrc option in the call to bazel in ci.yaml
 # Debug where options came from
 build --announce_rc
+
 # Don't rely on test logs being easily accessible from the test runner,
 # though it makes the log noisier.
 test --test_output=errors
+
 # This directory is configured in GitHub actions to be persisted between runs.
 build --disk_cache=$HOME/.cache/bazel
 build --repository_cache=$HOME/.cache/bazel-repo
+
 # Allows tests to run bazelisk-in-bazel, since this is the cache folder used
 test --test_env=XDG_CACHE_HOME
-# Keep until @io_bazel_rules_scala is upgraded
-build --incompatible_java_common_parameters=false

.github/workflows/ci.yaml

@@ -11,44 +11,43 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+concurrency:
+  # Cancel previous actions from the same PR: https://stackoverflow.com/a/72408109
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   test:
     # The type of runner that the job will run on
     runs-on: ubuntu-latest
 
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
-      - uses: actions/checkout@v3
-
-      - uses: bazelbuild/setup-bazelisk@v2
-
-      - name: Mount bazel action cache
-        uses: actions/cache@v3
-        if: always()
-        with:
-          path: "~/.cache/bazel"
-          key: bazel
+      - uses: actions/checkout@v4
 
-      - name: Mount bazel repo cache
-        uses: actions/cache@v3
-        if: always()
+      - uses: bazel-contrib/[email protected]
         with:
-          path: "~/.cache/bazel-repo"
-          key: bazel-repo
+          # Avoid downloading Bazel every time.
+          bazelisk-cache: true
+          # Store build cache per workflow.
+          disk-cache: true
+          # Share repository cache between workflows.
+          repository-cache: true
+          # Share external cache between workflows.
+          external-cache: true
+
+      - name: bazel build
+        run: >-
+          bazelisk
+          --bazelrc=.github/workflows/ci.bazelrc
+          --bazelrc=.bazelrc
+          build
+          ...
 
       - name: bazel test
-        env:
-          # Bazelisk will download bazel to here, ensure it is cached between runs.
-          XDG_CACHE_HOME: ~/.cache/bazel-repo
         run: >-
-          bazel
+          bazelisk
           --bazelrc=.github/workflows/ci.bazelrc
           --bazelrc=.bazelrc
           test
-          --deleted_packages=//plugin/grpc-ecosystem/grpc-gateway
-          //example/...
-          //pkg/...
-          //plugin/...
-          //language/...
-          //rules/...
-          //toolchain/...
+          ...

.github/workflows/publish-to-bcr.yaml

@@ -0,0 +1,35 @@
+# See https://github.com/bazel-contrib/publish-to-bcr
+name: Publish to BCR
+
+on:
+  # Run the publish workflow after a successful release
+  # Can be triggered from the release.yaml workflow
+  workflow_call:
+    inputs:
+      tag_name:
+        required: true
+        type: string
+    secrets:
+      BCR_PUBLISH_TOKEN:
+        required: true
+  # In case of problems, let release engineers retry by manually dispatching
+  # the workflow from the GitHub UI
+  workflow_dispatch:
+    inputs:
+      tag_name:
+        description: 'Publish to BCR'
+        required: true
+        type: string
+
+jobs:
+  publish:
+    uses: bazel-contrib/publish-to-bcr/.github/workflows/[email protected]
+    with:
+      draft: false
+      tag_name: ${{ inputs.tag_name }}
+    permissions:
+      attestations: write
+      contents: write
+      id-token: write
+    secrets:
+      publish_token: ${{ secrets.BCR_PUBLISH_TOKEN }}

.github/workflows/release.yaml

@@ -1,31 +1,30 @@
-# Cut a release whenever a new tag is pushed to the repo.
+# Based on https://github.com/bazel-contrib/rules-template/blob/main/.github/workflows/release.yaml.
 name: Release
-
 on:
   push:
     tags:
-      - "v*.*.*"
-
-  # Allows owner to run this workflow manually from the Actions tab
+      - "*.*.*"
   workflow_dispatch:
-
+    inputs:
+      tag_name:
+        description: git tag to release. The tag must exist.
+        required: true
+        type: string
 jobs:
-  test:
-    # The type of runner that the job will run on
-    runs-on: ubuntu-latest
-
-    # Steps represent a sequence of tasks that will be executed as part of the job
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-
-      - name: Prepare workspace snippet
-        run: .github/workflows/workspace_snippet.sh ${{ env.GITHUB_REF_NAME }} > release_notes.txt
-
-      - name: Release
-        uses: softprops/action-gh-release@v1
-        with:
-          prerelease: false
-          # Use GH feature to populate the changelog automatically
-          generate_release_notes: true
-          body_path: release_notes.txt
+  release:
+    uses: bazel-contrib/.github/.github/workflows/[email protected]
+    with:
+      release_files: rules_proto-*.tar.gz
+      prerelease: true
+      tag_name: ${{ inputs.tag_name || github.ref_name }}
+    permissions:
+      attestations: write
+      contents: write
+      id-token: write
+  publish:
+    needs: release
+    uses: ./.github/workflows/publish-to-bcr.yaml
+    with:
+      tag_name: ${{ inputs.tag_name || github.ref_name }}
+    secrets:
+      publish_token: ${{ secrets.publish_token || secrets.BCR_PUBLISH_TOKEN }}

.gitignore

@@ -1,6 +1,6 @@
 /bazel-*
 /.vscode
 __pycache__
-docs/vendor
 node_modules
 vendor/**/BUILD.bazel
+/MODULE.bazel.lock