Add support for bzlmod + Bazel 8 (#289)

This is a full-rewrite of the `WORKSPACE.bazel` rules + a bzlmod
`MODULE.bazel` implementation.

For both Bazel 7.x and Bazel 8.x, all of the following combinations will
work:
```
# Legacy WORKSPACE mode
bazel build --noenable_bzlmod --enable_workspace //... && bazel test --noenable_bzlmod --enable_workspace //...

# Bzlmod-only mode
bazel build --enable_bzlmod --noenable_workspace //... && bazel test --enable_bzlmod --noenable_workspace //...

# Hybrid incremental migration mode
bazel build --enable_bzlmod --enable_workspace //... && bazel test --enable_bzlmod --enable_workspace //...
```

Some modules needed to be updated for Bazel 8.x compatibility. Also,
some `WORKSPACE` code need to be retained for Bazel 7.x compatibility
that could otherwise be omitted.

Gazelle is set up to function in bzlmod mode and can be invoked using
`bazel mod tidy`.

I don't think we should need to substantially change CI except to test
all of the possible configuration modes to ensure they do not break on
accident.

.bazelversion

@@ -1 +1 @@
-7.4.1
+8.0.0

.github/workflows/bazel.yaml

@@ -0,0 +1,32 @@
+name: Bazel CI
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch: {} # support manual runs
+permissions:
+  contents: read
+  pull-requests: write
+jobs:
+  ci:
+    name: CI
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 2
+      - name: Install bazelisk
+        uses: bazelbuild/setup-bazelisk@v3
+      - name: Mount bazel cache
+        uses: actions/cache@v4
+        with:
+          path: "~/.cache/bazel"
+          key: bazel
+      - name: Test Bazel targets with legacy WORKSPACE mode
+        run: bazel build --noenable_bzlmod --enable_workspace //... && bazel test --noenable_bzlmod --enable_workspace //...
+      - name: Test Bazel targets with bzlmod-only mode
+        run: bazel build --enable_bzlmod --noenable_workspace //... && bazel test --enable_bzlmod --noenable_workspace //...
+      - name: Test Bazel targets with hybrid incremental-migration mode
+        run: bazel build --enable_bzlmod --enable_workspace //... && bazel test --enable_bzlmod --enable_workspace //...

MODULE.bazel

@@ -12,9 +12,28 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-###############################################################################
-# Bazel now uses Bzlmod by default to manage external dependencies.
-# Please consider migrating your external dependencies from WORKSPACE to MODULE.bazel.
-#
-# For more details, please check https://github.com/bazelbuild/bazel/issues/18958
-###############################################################################
+module(
+    name = "protovalidate",
+    version = "0.10.0",
+    repo_name = "com_github_bufbuild_protovalidate",
+)
+
+bazel_dep(name = "rules_go", version = "0.51.0", repo_name = "io_bazel_rules_go")
+bazel_dep(name = "gazelle", version = "0.40.0", repo_name = "bazel_gazelle")
+bazel_dep(name = "rules_buf", version = "0.3.0")
+bazel_dep(name = "protobuf", version = "29.2", repo_name = "com_google_protobuf")
+bazel_dep(name = "rules_proto", version = "7.1.0")
+bazel_dep(name = "googleapis", version = "0.0.0-20240819-fe8ba054a")
+
+go_sdk = use_extension("@io_bazel_rules_go//go:extensions.bzl", "go_sdk")
+go_sdk.download(version = "1.20.4")
+
+go_deps = use_extension("@bazel_gazelle//:extensions.bzl", "go_deps")
+go_deps.from_file(go_mod = "//tools:go.mod")
+use_repo(go_deps, "com_github_bufbuild_protocompile", "com_github_spf13_pflag", "com_github_stretchr_testify", "in_gopkg_yaml_v3", "org_golang_google_protobuf", "org_golang_x_sync")
+
+buf = use_extension("@rules_buf//buf:extensions.bzl", "buf")
+buf.toolchains(
+    sha256 = "bb9d7b4a1fc9ddebc285faa09b9c3e4ce176b94585a1d7988371d73b208aa0f5",
+    version = "v1.35.0",
+)

WORKSPACE

@@ -2,33 +2,67 @@ workspace(name = "com_github_bufbuild_protovalidate")
 
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
-# This is needed due to an unresolved issue with protobuf v27+.
-# https://github.com/protocolbuffers/protobuf/issues/17200
+http_archive(
+    name = "rules_java",
+    integrity = "sha256-XCFXV7mmw91TEqPNxIls7z8MWzHbMbqo2g2YhoXUKuQ=",
+    url = "https://github.com/bazelbuild/rules_java/releases/download/8.5.0/rules_java-8.5.0.tar.gz",
+)
+
 http_archive(
     name = "rules_python",
-    sha256 = "0a8003b044294d7840ac7d9d73eef05d6ceb682d7516781a4ec62eeb34702578",
-    strip_prefix = "rules_python-0.24.0",
-    url = "https://github.com/bazelbuild/rules_python/releases/download/0.24.0/rules_python-0.24.0.tar.gz",
+    sha256 = "4f7e2aa1eb9aa722d96498f5ef514f426c1f55161c3c9ae628c857a7128ceb07",
+    strip_prefix = "rules_python-1.0.0",
+    url = "https://github.com/bazelbuild/rules_python/releases/download/1.0.0/rules_python-1.0.0.tar.gz",
 )
 
-# Use a newer protobuf toolchain for editions support.
 http_archive(
-    name = "com_google_protobuf",
-    sha256 = "e4ff2aeb767da6f4f52485c2e72468960ddfe5262483879ef6ad552e52757a77",
-    strip_prefix = "protobuf-27.2",
-    urls = ["https://github.com/protocolbuffers/protobuf/archive/v27.2.tar.gz"],
+    name = "bazel_skylib",
+    sha256 = "bc283cdfcd526a52c3201279cda4bc298652efa898b10b4db0837dc51652756f",
+    urls = [
+        "https://mirror.bazel.build/github.com/bazelbuild/bazel-skylib/releases/download/1.7.1/bazel-skylib-1.7.1.tar.gz",
+        "https://github.com/bazelbuild/bazel-skylib/releases/download/1.7.1/bazel-skylib-1.7.1.tar.gz",
+    ],
 )
 
-load("@com_google_protobuf//:protobuf_deps.bzl", "protobuf_deps")
+load("@bazel_skylib//:workspace.bzl", "bazel_skylib_workspace")
 
-protobuf_deps()
+bazel_skylib_workspace()
+
+# rules_go v0.51.0 + gazelle v0.37.0
+http_archive(
+    name = "io_bazel_rules_go",
+    integrity = "sha256-CTbJvDxDIe43LLj2bdly02jLlA7QGpup/X3rzwCT8Js=",
+    urls = [
+        "https://mirror.bazel.build/github.com/bazel-contrib/rules_go/releases/download/v0.51.0/rules_go-v0.51.0.zip",
+        "https://github.com/bazel-contrib/rules_go/releases/download/v0.51.0/rules_go-v0.51.0.zip",
+    ],
+)
+
+http_archive(
+    name = "bazel_gazelle",
+    integrity = "sha256-12v3pg/YsFBEQJDfooN6Tq+YKeEWVhjuNdzspcvfWNU=",
+    urls = [
+        "https://mirror.bazel.build/github.com/bazelbuild/bazel-gazelle/releases/download/v0.37.0/bazel-gazelle-v0.37.0.tar.gz",
+        "https://github.com/bazelbuild/bazel-gazelle/releases/download/v0.37.0/bazel-gazelle-v0.37.0.tar.gz",
+    ],
+)
+
+load("@io_bazel_rules_go//go:deps.bzl", "go_register_toolchains", "go_rules_dependencies")
+load("@bazel_gazelle//:deps.bzl", "gazelle_dependencies", "go_repository")
+
+go_rules_dependencies()
+
+go_register_toolchains(version = "1.20.4")
+
+gazelle_dependencies()
 
+# rules_buf v0.3.0
 http_archive(
     name = "rules_buf",
-    sha256 = "523a4e06f0746661e092d083757263a249fedca535bd6dd819a8c50de074731a",
-    strip_prefix = "rules_buf-0.1.1",
+    integrity = "sha256-Hr64Q/CaYr0E3ptAjEOgdZd1yc+cBjp7OG1wzuf3DIs=",
+    strip_prefix = "rules_buf-0.3.0",
     urls = [
-        "https://github.com/bufbuild/rules_buf/archive/refs/tags/v0.1.1.zip",
+        "https://github.com/bufbuild/rules_buf/archive/refs/tags/v0.3.0.zip",
     ],
 )
 
@@ -38,41 +72,51 @@ rules_buf_dependencies()
 
 rules_buf_toolchains(version = "v1.35.0")
 
-load("@rules_proto//proto:repositories.bzl", "rules_proto_dependencies", "rules_proto_toolchains")
-
-rules_proto_dependencies()
-
-rules_proto_toolchains()
+load("@rules_buf//gazelle/buf:repositories.bzl", "gazelle_buf_dependencies")
 
-# Gazelle Setup
+gazelle_buf_dependencies()
 
+# protobuf v29.2
 http_archive(
-    name = "io_bazel_rules_go",
-    sha256 = "6b65cb7917b4d1709f9410ffe00ecf3e160edf674b78c54a894471320862184f",
+    name = "com_google_protobuf",
+    integrity = "sha256-YxUKuiP3qQ/X2HvfUU5FndX+cCP93gG1asUzNd9k1L0=",
+    strip_prefix = "protobuf-29.2",
     urls = [
-        "https://mirror.bazel.build/github.com/bazelbuild/rules_go/releases/download/v0.39.0/rules_go-v0.39.0.zip",
-        "https://github.com/bazelbuild/rules_go/releases/download/v0.39.0/rules_go-v0.39.0.zip",
+        "https://github.com/protocolbuffers/protobuf/releases/download/v29.2/protobuf-29.2.tar.gz",
     ],
 )
 
+load("@com_google_protobuf//:protobuf_deps.bzl", "protobuf_deps")
+
+protobuf_deps()
+
+load("@rules_proto//proto:repositories.bzl", "rules_proto_dependencies", "rules_proto_toolchains")
+
+rules_proto_dependencies()
+
+rules_proto_toolchains()
+
+# googleapis
 http_archive(
-    name = "bazel_gazelle",
-    sha256 = "ecba0f04f96b4960a5b250c8e8eeec42281035970aa8852dda73098274d14a1d",
+    name = "googleapis",
+    strip_prefix = "googleapis-fe8ba054ad4f7eca946c2d14a63c3f07c0b586a0",
     urls = [
-        "https://mirror.bazel.build/github.com/bazelbuild/bazel-gazelle/releases/download/v0.29.0/bazel-gazelle-v0.29.0.tar.gz",
-        "https://github.com/bazelbuild/bazel-gazelle/releases/download/v0.29.0/bazel-gazelle-v0.29.0.tar.gz",
+        "https://github.com/googleapis/googleapis/archive/fe8ba054ad4f7eca946c2d14a63c3f07c0b586a0.zip",
     ],
 )
 
-load("@io_bazel_rules_go//go:deps.bzl", "go_register_toolchains", "go_rules_dependencies")
-load("@bazel_gazelle//:deps.bzl", "gazelle_dependencies")
+load("@googleapis//:repository_rules.bzl", "switched_rules_by_language")
 
-go_rules_dependencies()
+switched_rules_by_language(
+    name = "com_google_googleapis_imports",
+)
 
-go_register_toolchains(version = "1.20.4")
+# Dependencies that need to be loaded later
 
-gazelle_dependencies()
+load("@rules_java//java:rules_java_deps.bzl", "rules_java_dependencies")
 
-load("@rules_buf//gazelle/buf:repositories.bzl", "gazelle_buf_dependencies")
+rules_java_dependencies()
 
-gazelle_buf_dependencies()
+load("@rules_python//python:repositories.bzl", "py_repositories")
+
+py_repositories()

examples/BUILD.bazel

@@ -12,8 +12,10 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-load("@rules_proto//proto:defs.bzl", "proto_library")
 load("@rules_buf//buf:defs.bzl", "buf_lint_test")
+load("@rules_proto//proto:defs.bzl", "proto_library")
+
+# gazelle:resolve proto proto google/type/postal_address.proto @googleapis//google/type:postal_address_proto
 
 proto_library(
     name = "examples_proto",
@@ -107,7 +109,7 @@ proto_library(
         "@com_google_protobuf//:struct_proto",
         "@com_google_protobuf//:timestamp_proto",
         "@com_google_protobuf//:wrappers_proto",
-        "@go_googleapis//google/type:postaladdress_proto",
+        "@googleapis//google/type:postal_address_proto",
     ],
 )
 

proto/protovalidate-testing/buf/validate/conformance/cases/BUILD.bazel

@@ -12,8 +12,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-load("@rules_proto//proto:defs.bzl", "proto_library")
 load("@rules_buf//buf:defs.bzl", "buf_lint_test")
+load("@rules_proto//proto:defs.bzl", "proto_library")
 
 proto_library(
     name = "buf_validate_conformance_cases_proto",

proto/protovalidate-testing/buf/validate/conformance/cases/custom_constraints/BUILD.bazel

@@ -12,8 +12,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-load("@rules_proto//proto:defs.bzl", "proto_library")
 load("@rules_buf//buf:defs.bzl", "buf_lint_test")
+load("@rules_proto//proto:defs.bzl", "proto_library")
 
 proto_library(
     name = "buf_validate_conformance_cases_custom_constraints_proto",

proto/protovalidate-testing/buf/validate/conformance/cases/other_package/BUILD.bazel

@@ -12,8 +12,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-load("@rules_proto//proto:defs.bzl", "proto_library")
 load("@rules_buf//buf:defs.bzl", "buf_lint_test")
+load("@rules_proto//proto:defs.bzl", "proto_library")
 
 proto_library(
     name = "buf_validate_conformance_cases_other_package_proto",

proto/protovalidate-testing/buf/validate/conformance/cases/subdirectory/BUILD.bazel

@@ -12,8 +12,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-load("@rules_proto//proto:defs.bzl", "proto_library")
 load("@rules_buf//buf:defs.bzl", "buf_lint_test")
+load("@rules_proto//proto:defs.bzl", "proto_library")
 
 proto_library(
     name = "buf_validate_conformance_cases_subdirectory_proto",

proto/protovalidate-testing/buf/validate/conformance/cases/yet_another_package/BUILD.bazel

@@ -12,8 +12,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-load("@rules_proto//proto:defs.bzl", "proto_library")
 load("@rules_buf//buf:defs.bzl", "buf_lint_test")
+load("@rules_proto//proto:defs.bzl", "proto_library")
 
 proto_library(
     name = "buf_validate_conformance_cases_yet_another_package_proto",

proto/protovalidate-testing/buf/validate/conformance/harness/BUILD.bazel

@@ -12,8 +12,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-load("@rules_proto//proto:defs.bzl", "proto_library")
 load("@rules_buf//buf:defs.bzl", "buf_lint_test")
+load("@rules_proto//proto:defs.bzl", "proto_library")
 
 proto_library(
     name = "buf_validate_conformance_harness_proto",

proto/protovalidate/buf/validate/BUILD.bazel

@@ -12,8 +12,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-load("@rules_proto//proto:defs.bzl", "proto_library")
 load("@rules_buf//buf:defs.bzl", "buf_lint_test")
+load("@rules_proto//proto:defs.bzl", "proto_library")
 
 # gazelle:proto file