refactor: remove workspace

.bazelrc

@@ -6,9 +6,6 @@ build --incompatible_strict_action_env
 build --nolegacy_external_runfiles
 common --test_env=DOCKER_HOST --action_env=DOCKER_HOST --repo_env=DOCKER_HOST
 
-# Disable bzlmod lockfile
-common --lockfile_mode=off
-
 # On bazel 6.4.0 these are needed to successfully fetch images.
 common:needs_credential_helpers --credential_helper=public.ecr.aws=%workspace%/examples/credential_helper/auth.sh
 common:needs_credential_helpers --credential_helper=index.docker.io=%workspace%/examples/credential_helper/auth.sh

.gitattributes

@@ -8,3 +8,7 @@ docs/load.md linguist-generated=true
 #################################
 # Configuration for 'git archive'
 # See https://git-scm.com/docs/git-archive#ATTRIBUTES
+
+# Don't include examples or tools in the distribution artifact, to reduce size
+examples export-ignore
+tools export-ignore

.github/workflows/ci.yaml

@@ -74,12 +74,17 @@ jobs:
             folder: e2e/assertion
           - os: macos-13
             bazelversion: 6.4.0
+          - folder: .
+            bazelversion: 6.4.0
           # e2e/assertion is bzlmod only but it has test for both cases.
           - folder: e2e/assertion
             bzlmodEnabled: false
           # TODO: fix
           - folder: e2e/wasm
             bzlmodEnabled: true
+          # Don't test the root module with WORKSPACE at all
+          - folder: .
+            bzlmodEnabled: false
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it

BUILD.bazel

@@ -1,5 +1,4 @@
 load("@bazel_gazelle//:def.bzl", "gazelle", "gazelle_binary")
-load("@bazel_skylib//:bzl_library.bzl", "bzl_library")
 
 gazelle_binary(
     name = "gazelle_bin",
@@ -11,13 +10,3 @@ gazelle(
     name = "gazelle",
     gazelle = "gazelle_bin",
 )
-
-bzl_library(
-    name = "internal_deps",
-    srcs = ["internal_deps.bzl"],
-    visibility = ["//visibility:public"],
-    deps = [
-        "@bazel_tools//tools/build_defs/repo:http.bzl",
-        "@bazel_tools//tools/build_defs/repo:utils.bzl",
-    ],
-)

MODULE.bazel

@@ -36,3 +36,8 @@ bazel_dep(name = "gazelle", version = "0.35.0", dev_dependency = True, repo_name
 bazel_dep(name = "bazel_skylib_gazelle_plugin", version = "1.4.1", dev_dependency = True)
 bazel_dep(name = "rules_multirun", version = "0.9.0", dev_dependency = True)
 bazel_dep(name = "stardoc", version = "0.6.2", dev_dependency = True, repo_name = "io_bazel_stardoc")
+bazel_dep(name = "rules_multitool", version = "0.9.0", dev_dependency = True)
+
+multitool = use_extension("@rules_multitool//multitool:extension.bzl", "multitool", dev_dependency = True)
+multitool.hub(lockfile = "//tools:tools.lock.json")
+use_repo(multitool, "multitool")

README.md

@@ -9,14 +9,14 @@ _Need help?_ This ruleset has support provided by [Aspect Build](https://www.asp
 
 ## Comparison with rules_docker
 
-This ruleset is not intended as a complete replacement for [rules_docker]!
-Many use cases can be accomodated, and we know that many users have completely replaced rules*docker.
-You can find a migration guide at <https://docs.aspect.build/guides/rules_oci_migration>.
+This ruleset is not intended as a complete replacement for [rules_docker].
+Most use cases can be accomodated, and we know many users who have completely replaced rules_docker.
 However, some other use cases such as `container_run_and*\*` rules have no equivalent.
+You might still decide to use rules_docker, and perhaps even volunteer to help maintain it.
+
+You can find a migration guide at <https://docs.aspect.build/guides/rules_oci_migration>.
 
-[rules_docker] was largely unmaintained for 18 months, and as of October 2023 it has been archived.
-See https://github.com/bazelbuild/rules_docker/discussions/2038.
-You might still decide to use rules_docker, and perhaps even sign up as a maintainer so that it may be un-archived.
+## Design
 
 We started from first principles and avoided some pitfalls we learned from rules_docker:
 

WORKSPACE

@@ -1,80 +1,11 @@
-# Declare the local Bazel workspace.
-# This is *not* included in the published distribution.
-workspace(name = "rules_oci")
-
-# Fetch deps needed only locally for development
-load(":internal_deps.bzl", "rules_oci_internal_deps")
-
-rules_oci_internal_deps()
-
-## Setup rules_oci
-load("//oci:dependencies.bzl", "rules_oci_dependencies")
-
-rules_oci_dependencies()
-
-load("//oci:repositories.bzl", "oci_register_toolchains")
-
-oci_register_toolchains(name = "oci")
-
-# Transitive dep for rules_multirun
-load("@rules_python//python:repositories.bzl", "py_repositories")
-
-py_repositories()
-
-## Setup bazel-lib
-load("@aspect_bazel_lib//lib:repositories.bzl", "aspect_bazel_lib_dependencies", "aspect_bazel_lib_register_toolchains")
-
-aspect_bazel_lib_dependencies()
-
-aspect_bazel_lib_register_toolchains()
-
-## Setup cosign
-load("//cosign:repositories.bzl", "cosign_register_toolchains")
-
-cosign_register_toolchains(name = "oci_cosign")
-
-## Setup skylib unittest
-load("@bazel_skylib//lib:unittest.bzl", "register_unittest_toolchains")
-
-register_unittest_toolchains()
-
-## Setup rules_go
-load("@io_bazel_rules_go//go:deps.bzl", "go_register_toolchains", "go_rules_dependencies")
-
-go_rules_dependencies()
-
-go_register_toolchains(version = "1.20.5")
-
-## Setup gazelle
-load("@bazel_gazelle//:deps.bzl", "gazelle_dependencies")
-
-gazelle_dependencies()
-
 ## Setup test repositories
 load(":fetch.bzl", "fetch_images", "fetch_test_repos")
 
 fetch_images()
 
 fetch_test_repos()
 
-############################################
-# Stardoc
-load("@io_bazel_stardoc//:setup.bzl", "stardoc_repositories")
-
-stardoc_repositories()
-
-load("@rules_jvm_external//:repositories.bzl", "rules_jvm_external_deps")
-
-rules_jvm_external_deps()
-
-load("@rules_jvm_external//:setup.bzl", "rules_jvm_external_setup")
-
-rules_jvm_external_setup()
-
-load("@io_bazel_stardoc//:deps.bzl", "stardoc_external_deps")
-
-stardoc_external_deps()
-
-load("@stardoc_maven//:defs.bzl", stardoc_pinned_maven_install = "pinned_maven_install")
+### Setup rules_oci cosign
+load("//cosign:repositories.bzl", "cosign_register_toolchains")
 
-stardoc_pinned_maven_install()
+cosign_register_toolchains(name = "oci_cosign")

examples/BUILD.bazel

@@ -1,17 +1,5 @@
-load("@bazel_skylib//rules:native_binary.bzl", "native_binary")
-
 package(default_visibility = ["//examples:__subpackages__"])
 
-native_binary(
-    name = "docker_cli",
-    src = select({
-        "@bazel_tools//src/conditions:linux_x86_64": "@docker_cli_linux_amd64//:docker",
-        "@bazel_tools//src/conditions:darwin_arm64": "@docker_cli_darwin_arm64//:docker",
-        "@bazel_tools//src/conditions:darwin_x86_64": "@docker_cli_darwin_amd64//:docker",
-    }),
-    out = "docker",
-)
-
 platform(
     name = "linux_arm64",
     constraint_values = [

examples/assert.bzl

@@ -108,11 +108,7 @@ def assert_oci_config(
             "$(location %s)" % expected,
             "$(location %s)" % actual,
         ],
-        src = select({
-            "//examples:platform_darwin_arm64": "@jd_darwin_arm64//file",
-            "//examples:platform_linux_amd64": "@jd_linux_amd64//file",
-            "//examples:platform_darwin_amd64": "@jd_darwin_amd64//file",
-        }),
+        src = "@multitool//tools/jd",
         out = name,
     )
 
@@ -140,7 +136,7 @@ def assert_oci_image_command(
         name = name + "_gen",
         output_to_bindir = True,
         cmd = """
-docker=$(location //examples:docker_cli)
+docker=$(location @multitool//tools/docker)
 $(location :{name}_tarball)
 container_id=$$($$docker run -d {docker_args})
 $$docker wait $$container_id > $(location :{name}_exit_code)
@@ -152,7 +148,7 @@ $$docker logs $$container_id > $(location :{name}_output)
             name + "_exit_code",
         ],
         target_compatible_with = TARGET_COMPATIBLE_WITH,
-        tools = [name + "_tarball", "//examples:docker_cli"],
+        tools = [name + "_tarball", "@multitool//tools/docker"],
     )
 
     if output_eq:

examples/dockerfile/BUILD.bazel

@@ -1,19 +1,8 @@
 load("@aspect_bazel_lib//lib:run_binary.bzl", "run_binary")
-load("@bazel_skylib//rules:native_binary.bzl", "native_binary")
 load("@configure_buildx//:defs.bzl", "BUILDER_NAME", "TARGET_COMPATIBLE_WITH")
 load("@rules_oci//oci:defs.bzl", "oci_image")
 load("//examples:assert.bzl", "assert_oci_config", "assert_oci_image_command")
 
-native_binary(
-    name = "buildx",
-    src = select({
-        "@bazel_tools//src/conditions:linux_x86_64": "@buildx_linux_amd64//file",
-        "@bazel_tools//src/conditions:darwin_arm64": "@buildx_darwin_arm64//file",
-        "@bazel_tools//src/conditions:darwin_x86_64": "@buildx_darwin_amd64//file",
-    }),
-    out = "buildx",
-)
-
 # docker buildx create --name container --driver=docker-container
 run_binary(
     name = "base",
@@ -29,7 +18,7 @@ run_binary(
     mnemonic = "BuildDocker",
     out_dirs = ["base"],
     target_compatible_with = TARGET_COMPATIBLE_WITH,
-    tool = ":buildx",
+    tool = "@multitool//tools/buildx",
 )
 
 oci_image(

examples/dockerfile/buildx.bzl

@@ -1,10 +1,10 @@
 "repos for buildx"
 
 load("@aspect_bazel_lib//lib:repo_utils.bzl", "repo_utils")
-load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_file")
 
 def _impl_configure_buildx(rctx):
     has_docker = False
+
     # See if standard docker sock exists
     if not has_docker:
         r = rctx.execute(["stat", "/var/run/docker.sock"])
@@ -14,7 +14,17 @@ def _impl_configure_buildx(rctx):
     compatible_with = "[]"
     builder_name = "builder-docker"
     if has_docker:
-        buildx = rctx.path(Label("@buildx_%s//file:downloaded" % repo_utils.platform(rctx)))
+        # TODO(alex): a less hacky way for a repo rule to find this transitive repo label?
+        if repo_utils.platform(rctx) == "darwin_amd64":
+            multitool_label = "@@rules_multitool~~multitool~multitool.macos_x86_64//tools/buildx:macos_x86_64_executable"
+        elif repo_utils.platform(rctx) == "darwin_arm64":
+            multitool_label = "@@rules_multitool~~multitool~multitool.macos_arm64//tools/buildx:macos_arm64_executable"
+        elif repo_utils.platform(rctx) == "linux_amd64":
+            multitool_label = "@@rules_multitool~~multitool~multitool.linux_x86_64//tools/buildx:linux_x86_64_executable"
+        else:
+            fail("platform {} is not known", repo_utils.platform(rctx))
+
+        buildx = rctx.path(Label(multitool_label))
 
         r = rctx.execute([buildx, "ls"])
         if not builder_name in r.stdout:
@@ -40,33 +50,3 @@ configure_buildx = repository_rule(
     implementation = _impl_configure_buildx,
     local = True,
 )
-
-def fetch_buildx():
-    http_file(
-        name = "buildx_linux_amd64",
-        urls = [
-            "https://github.com/docker/buildx/releases/download/v0.14.0/buildx-v0.14.0.linux-amd64",
-        ],
-        integrity = "sha256-Mvjxfso1vy7+bA5H9A5Gkqh280UxtCHvyYR5mltBIm4=",
-        executable = True,
-    )
-
-    http_file(
-        name = "buildx_darwin_arm64",
-        urls = [
-            "https://github.com/docker/buildx/releases/download/v0.14.0/buildx-v0.14.0.darwin-arm64",
-        ],
-        integrity = "sha256-3BdvI2ZgnMITKubwi7IZOjL5/ZNUv9Agz3+juNt0hA0=",
-        executable = True,
-    )
-
-    http_file(
-        name = "buildx_darwin_amd64",
-        urls = [
-            "https://github.com/docker/buildx/releases/download/v0.14.0/buildx-v0.14.0.darwin-amd64",
-        ],
-        integrity = "sha256-J6rZfENSvCzFBHDgnA8Oqq2FDXR+M9CTejhhg9DruPU=",
-        executable = True,
-    )
-
-    configure_buildx(name = "configure_buildx")