From 51d6154f157c4d1643a4c53952bc1fa9b063736b Mon Sep 17 00:00:00 2001 From: Aleksandr Sokolovskii Date: Thu, 8 Oct 2026 22:32:24 +0200 Subject: [PATCH 1/9] Update protovalidate-buffa, ruff, uv, rules_go, and the markdownlint toolchain. protoc-gen-protovalidate-buffa v0.10.2 joins the catalog and becomes the pin; ruff goes to 0.16.10; uv is pinned to 0.12.23 in this module instead of aspect_rules_py's 0.11.6; rules_go goes to 0.64.1. The markdown module moves to aspect_rules_js 3.5.1, rules_nodejs 6.7.6, Node 24.21.0, and pnpm 12.10.1. Node and pnpm are newer than the rules' catalogs, so their checksums are pinned here from nodejs.org SHASUMS256.txt and npm. Every release is at least two days old. Each sha256 comes from the upstream checksum file and was checked against the downloaded asset. The README plugin tables now list every catalog version. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Aleksandr Sokolovskii --- CHANGELOG.md | 23 +++ MODULE.bazel.lock | 185 +++++++++--------- README.md | 46 ++--- go/MODULE.bazel | 2 +- markdown/MODULE.bazel | 52 ++++- markdown/package.json | 2 +- protoc/MODULE.bazel | 2 +- .../registry.bzl | 32 +++ python/MODULE.bazel | 14 +- python/ruff.MODULE.bazel | 14 +- 10 files changed, 239 insertions(+), 133 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 07998b5..76bc767 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,29 @@ patch; breaking Starlark API changes bump the minor. ## [Unreleased] +### Added + +- `bazel_utils_protoc`: `protoc-gen-protovalidate-buffa` catalog version + v0.10.2 (optional and oneof strings get the plain-string format and length + rules, `IGNORE_IF_ZERO_VALUE` covers field CEL and predefined rules, custom + rule paths keep the extension's package and messages) for linux, darwin, + and windows on amd64 and arm64. + +### Changed + +- `protoc-gen-protovalidate-buffa` pin from v0.10.1 to v0.10.2. +- `bazel_utils_go`: rules_go from 0.63.0 to 0.64.1. +- `bazel_utils_python`: ruff from 0.16.9 to 0.16.10. +- `bazel_utils_python`: uv pinned to 0.12.23 in `uv_bin.toolchain` (version + and sha256s from the release's `sha256.sum`) instead of aspect_rules_py's + default 0.11.6. +- `bazel_utils_markdown`: aspect_rules_js from 3.4.1 to 3.5.1, rules_nodejs + from 6.7.5 to 6.7.6, Node from 24.18.0 to 24.21.0, and pnpm from 11.20.0 + to 12.10.1. Both are newer than the rules' catalogs, so Node's sha256s + (`node_repositories`) come from nodejs.org `SHASUMS256.txt` and pnpm's + `pnpm_version_integrity` from npm. `package.json` `packageManager` from + pnpm 12.6.0 to 12.10.1. + ## [0.2.14] - 2026-10-07 ### Added diff --git a/MODULE.bazel.lock b/MODULE.bazel.lock index f4dd448..4d928ef 100644 --- a/MODULE.bazel.lock +++ b/MODULE.bazel.lock @@ -25,11 +25,10 @@ "https://bcr.bazel.build/modules/apple_support/1.24.2/MODULE.bazel": "0e62471818affb9f0b26f128831d5c40b074d32e6dda5a0d3852847215a41ca4", "https://bcr.bazel.build/modules/apple_support/2.3.0/MODULE.bazel": "d48f824ae8eeea5f837eb3038cef3615075d996d3e82eb9187192c2820605a81", "https://bcr.bazel.build/modules/apple_support/2.3.0/source.json": "d99b0a50918c4484856d773026b2fd60a694668c70fc0e19d592786dc7e5e469", - "https://bcr.bazel.build/modules/aspect_rules_js/3.4.1/MODULE.bazel": "e46853c134b48bc84c9bb5c4a4c8ae792dcfd5277acac9d90c444d65fa43dd19", - "https://bcr.bazel.build/modules/aspect_rules_js/3.4.1/source.json": "b11f550b53d451800ebd0b4f38a048aea33fbfbd78fb5c77dca847f6b9b47a3b", + "https://bcr.bazel.build/modules/aspect_rules_js/3.5.1/MODULE.bazel": "f01b4f1bf26713e875ec0fbe9d9c2146d2b173d6194850a7cb63b579c557aab1", + "https://bcr.bazel.build/modules/aspect_rules_js/3.5.1/source.json": "f2dc028f9110d8aaf262a23267484f1c9d310f8ecf5f832e2a740d192a97756f", "https://bcr.bazel.build/modules/aspect_rules_py/1.12.1/MODULE.bazel": "c4dfd569c3e34e0e3e845e01453d5c19bd0496c01f54e37b6a4375df02578aed", "https://bcr.bazel.build/modules/aspect_rules_py/1.12.1/source.json": "3b80f00180755642ae39d0401738b5872a53130c1020eb743658cd72b716d526", - "https://bcr.bazel.build/modules/aspect_tools_telemetry/0.5.1/MODULE.bazel": "9d94e5c22c0019995c0a3216a6abb1717dc3f35acccf4e6267a55d6df38367aa", "https://bcr.bazel.build/modules/aspect_tools_telemetry/0.5.2/MODULE.bazel": "c715a5fb6b13a0086c061618f00d033a4ab6d76cbd1083e38d7ca953b5e547f4", "https://bcr.bazel.build/modules/aspect_tools_telemetry/0.5.2/source.json": "4dd300d44767ad4860098b006dda614e67ab0409ae6ec6e133faad303fe9ede8", "https://bcr.bazel.build/modules/bazel_features/1.1.0/MODULE.bazel": "cfd42ff3b815a5f39554d97182657f8c4b9719568eb7fded2b9135f084bf760b", @@ -107,6 +106,8 @@ "https://bcr.bazel.build/modules/googletest/1.15.2/MODULE.bazel": "6de1edc1d26cafb0ea1a6ab3f4d4192d91a312fd2d360b63adaa213cd00b2108", "https://bcr.bazel.build/modules/googletest/1.17.0/MODULE.bazel": "dbec758171594a705933a29fcf69293d2468c49ec1f2ebca65c36f504d72df46", "https://bcr.bazel.build/modules/googletest/1.17.0/source.json": "38e4454b25fc30f15439c0378e57909ab1fd0a443158aa35aec685da727cd713", + "https://bcr.bazel.build/modules/hermetic_launcher/0.0.15/MODULE.bazel": "1a04856a10bd6a3d23bad08673bceb59b061c4bf9b76d335e30386832acc1b33", + "https://bcr.bazel.build/modules/hermetic_launcher/0.0.15/source.json": "aceb903a3bda5131b0a3132ccf77f36f32b96dcb70864049ec8cfdf9c0b0f068", "https://bcr.bazel.build/modules/jq.bzl/0.4.0/MODULE.bazel": "a7b39b37589f2b0dad53fd6c1ccaabbdb290330caa920d7ef3e6aad068cd4ab2", "https://bcr.bazel.build/modules/jq.bzl/0.4.0/source.json": "52ec7530c4618e03f634b30ff719814a68d7d39c235938b7aa2abbfe1eb1c52c", "https://bcr.bazel.build/modules/jsoncpp/1.9.5/MODULE.bazel": "31271aedc59e815656f5736f282bb7509a97c7ecb43e927ac1a37966e0578075", @@ -192,8 +193,8 @@ "https://bcr.bazel.build/modules/rules_go/0.46.0/MODULE.bazel": "3477df8bdcc49e698b9d25f734c4f3a9f5931ff34ee48a2c662be168f5f2d3fd", "https://bcr.bazel.build/modules/rules_go/0.53.0/MODULE.bazel": "a4ed760d3ac0dbc0d7b967631a9a3fd9100d28f7d9fcf214b4df87d4bfff5f9a", "https://bcr.bazel.build/modules/rules_go/0.59.0/MODULE.bazel": "b7e43e7414a3139a7547d1b4909b29085fbe5182b6c58cbe1ed4c6272815aeae", - "https://bcr.bazel.build/modules/rules_go/0.63.0/MODULE.bazel": "a2079e783a5d2715a90e6e2970ec8ffd717a487ff2aecb5f553e3975c5294a21", - "https://bcr.bazel.build/modules/rules_go/0.63.0/source.json": "5bf37b45c440ac03abad0cbfa8b8b8dd89cc4e82bc8305f468b8436fa58bae78", + "https://bcr.bazel.build/modules/rules_go/0.64.1/MODULE.bazel": "fed5606cfca6cf9e90618318f7d3d37451a9b2f2b61dc33b82917ebe2fd42396", + "https://bcr.bazel.build/modules/rules_go/0.64.1/source.json": "04fe02350ffc3b4564f72ff2fb346631ef7c3faf91fe3b28d6babdeebbe32d6e", "https://bcr.bazel.build/modules/rules_java/4.0.0/MODULE.bazel": "5a78a7ae82cd1a33cef56dc578c7d2a46ed0dca12643ee45edbb8417899e6f74", "https://bcr.bazel.build/modules/rules_java/5.3.5/MODULE.bazel": "a4ec4f2db570171e3e5eb753276ee4b389bae16b96207e9d3230895c99644b86", "https://bcr.bazel.build/modules/rules_java/6.3.0/MODULE.bazel": "a97c7678c19f236a956ad260d59c86e10a463badb7eb2eda787490f4c969b963", @@ -229,8 +230,8 @@ "https://bcr.bazel.build/modules/rules_license/1.0.0/MODULE.bazel": "a7fda60eefdf3d8c827262ba499957e4df06f659330bbe6cdbdb975b768bb65c", "https://bcr.bazel.build/modules/rules_license/1.0.0/source.json": "a52c89e54cc311196e478f8382df91c15f7a2bfdf4c6cd0e2675cc2ff0b56efb", "https://bcr.bazel.build/modules/rules_nodejs/6.7.3/MODULE.bazel": "c22a48b2a0dbf05a9dc5f83837bbc24c226c1f6e618de3c3a610044c9f336056", - "https://bcr.bazel.build/modules/rules_nodejs/6.7.5/MODULE.bazel": "97e6794043821d23c013baa4a50fd1c599f2e6ae92b06e2c5f1cd7074fd83e7c", - "https://bcr.bazel.build/modules/rules_nodejs/6.7.5/source.json": "d60ee5a76258b1c8f99545ed24172b44d43ba64ca1a2dfc04371ef203df19fdf", + "https://bcr.bazel.build/modules/rules_nodejs/6.7.6/MODULE.bazel": "45f203b9c0d721bcb1a5932815f218091fa2169cede2af3d88a8a17a4fb7676a", + "https://bcr.bazel.build/modules/rules_nodejs/6.7.6/source.json": "ad9987b7979be1ce93d10ffee9b6af4f84f8835cbc7def27937d632da2e4750e", "https://bcr.bazel.build/modules/rules_pkg/0.7.0/MODULE.bazel": "df99f03fc7934a4737122518bb87e667e62d780b610910f0447665a7e2be62dc", "https://bcr.bazel.build/modules/rules_pkg/1.0.1/MODULE.bazel": "5b1df97dbc29623bccdf2b0dcd0f5cb08e2f2c9050aab1092fd39a41e82686ff", "https://bcr.bazel.build/modules/rules_pkg/1.1.0/MODULE.bazel": "9db8031e71b6ef32d1846106e10dd0ee2deac042bd9a2de22b4761b0c3036453", @@ -301,7 +302,7 @@ "@@aspect_tools_telemetry+//:extension.bzl%telemetry": { "general": { "bzlTransitiveDigest": "ihzLOoAnQP6Y5iSYOhEjvb6uxEbA6ZgH8Qikau2lGRU=", - "usagesDigest": "AJQ+jG29XdUUa1mrT7HTapXAXMgXr5M2V1huor81uxk=", + "usagesDigest": "VsQYQgWH1e6TQVPMWBe7oIJnlA767jBjkhBzlFVMjig=", "recordedInputs": [ "REPO_MAPPING:aspect_tools_telemetry+,bazel_lib bazel_lib+", "REPO_MAPPING:aspect_tools_telemetry+,bazel_skylib bazel_skylib+", @@ -312,11 +313,11 @@ "repoRuleId": "@@aspect_tools_telemetry+//:extension.bzl%tel_repository", "attributes": { "deps": { - "aspect_rules_js": "3.4.1", + "aspect_rules_js": "3.5.1", "aspect_rules_py": "1.12.1", "aspect_tools_telemetry": "0.5.2" }, - "last_notice": 1 + "last_notice": 3 } } }, @@ -372,7 +373,7 @@ "@@yq.bzl+//yq:extensions.bzl%yq": { "general": { "bzlTransitiveDigest": "tDqk+ntWTdxNAWPDjRY1uITgHbti2jcXR5ZdinltBs0=", - "usagesDigest": "NIQYQMSfARSdjxNGSnaPYh6knbzGsd2JC2LKznNE208=", + "usagesDigest": "6yAP6zSP7pd5U9jgZmk33qt7N31PoxBjbSvMK/J/0aE=", "recordedInputs": [], "generatedRepoSpecs": { "yq_darwin_amd64": { @@ -2483,166 +2484,162 @@ "5fcd0671a49cecf39b41021621ee1b6e7aa1370f37122b72e80d4fd4185833b6" ] }, - "1.25.0": { + "1.26.7": { "aix_ppc64": [ - "go1.25.0.aix-ppc64.tar.gz", - "e5234a7dac67bc86c528fe9752fc9d63557918627707a733ab4cac1a6faed2d4" + "go1.26.7.aix-ppc64.tar.gz", + "e5aed98bc83f569a374dbfd79d632b058e5130192fbd4c4ee0d4f6e3d9c101bb" ], "darwin_amd64": [ - "go1.25.0.darwin-amd64.tar.gz", - "5bd60e823037062c2307c71e8111809865116714d6f6b410597cf5075dfd80ef" + "go1.26.7.darwin-amd64.tar.gz", + "92e8b34bff3c89ab16404c595669ac8cb004cc2f676dcbd1f5b87a6b8def3b47" ], "darwin_arm64": [ - "go1.25.0.darwin-arm64.tar.gz", - "544932844156d8172f7a28f77f2ac9c15a23046698b6243f633b0a0b00c0749c" + "go1.26.7.darwin-arm64.tar.gz", + "020a1e8224811be75163e920bc77e0926a1390a6aeea19bdcf23f74b9d749f6d" ], "dragonfly_amd64": [ - "go1.25.0.dragonfly-amd64.tar.gz", - "5ed3cf9a810a1483822538674f1336c06b51aa1b94d6d545a1a0319a48177120" + "go1.26.7.dragonfly-amd64.tar.gz", + "d980dc9ecc48de09b2fa1765886abb8c7b0ad738bf8cc483b76019facc2df4d1" ], "freebsd_386": [ - "go1.25.0.freebsd-386.tar.gz", - "abea5d5c6697e6b5c224731f2158fe87c602996a2a233ac0c4730cd57bf8374e" + "go1.26.7.freebsd-386.tar.gz", + "7eecfa4d6c126bcdedb8e16583ec672857e607659c672c60a9d645f8957da117" ], "freebsd_amd64": [ - "go1.25.0.freebsd-amd64.tar.gz", - "86e6fe0a29698d7601c4442052dac48bd58d532c51cccb8f1917df648138730b" + "go1.26.7.freebsd-amd64.tar.gz", + "2ad37146fa8449907716b494dd268aeae6f79592b875915525c28c8c337ad32a" ], "freebsd_arm": [ - "go1.25.0.freebsd-arm.tar.gz", - "d90b78e41921f72f30e8bbc81d9dec2cff7ff384a33d8d8debb24053e4336bfe" + "go1.26.7.freebsd-arm.tar.gz", + "bc56379ed419cd93cf7002dcb95f554b3e3a2bd58d804182f8873e313a870b70" ], "freebsd_arm64": [ - "go1.25.0.freebsd-arm64.tar.gz", - "451d0da1affd886bfb291b7c63a6018527b269505db21ce6e14724f22ab0662e" - ], - "freebsd_riscv64": [ - "go1.25.0.freebsd-riscv64.tar.gz", - "7b565f76bd8bda46549eeaaefe0e53b251e644c230577290c0f66b1ecdb3cdbe" + "go1.26.7.freebsd-arm64.tar.gz", + "23d425a3a51876df8bf050f080b1ae50340048def689fbcc44c939fa23485ce0" ], "illumos_amd64": [ - "go1.25.0.illumos-amd64.tar.gz", - "b1e1fdaab1ad25aa1c08d7a36c97d45d74b98b89c3f78c6d2145f77face54a2c" + "go1.26.7.illumos-amd64.tar.gz", + "be51df2411786e1fa6325461e509224a94c5e8d001da8e4548d9e028a53a3c22" ], "linux_386": [ - "go1.25.0.linux-386.tar.gz", - "8c602dd9d99bc9453b3995d20ce4baf382cc50855900a0ece5de9929df4a993a" + "go1.26.7.linux-386.tar.gz", + "5b6fad4a7fe8fa230c935625b67450305be95e2f4f976b731623f76b88fc4821" ], "linux_amd64": [ - "go1.25.0.linux-amd64.tar.gz", - "2852af0cb20a13139b3448992e69b868e50ed0f8a1e5940ee1de9e19a123b613" + "go1.26.7.linux-amd64.tar.gz", + "ffb5f8de10c62550dfddab66b36b57030721e0a44a3218e9e1181d7b59f121ca" ], "linux_arm64": [ - "go1.25.0.linux-arm64.tar.gz", - "05de75d6994a2783699815ee553bd5a9327d8b79991de36e38b66862782f54ae" + "go1.26.7.linux-arm64.tar.gz", + "5a4ec883379d51ee9ce1040d5e87f8d35e20387574dd8c947feb01eabc3c1b37" ], "linux_armv6l": [ - "go1.25.0.linux-armv6l.tar.gz", - "a5a8f8198fcf00e1e485b8ecef9ee020778bf32a408a4e8873371bfce458cd09" + "go1.26.7.linux-armv6l.tar.gz", + "6a41557335d1d9fa9bfc7439cedcfd0e4df2fc83d916175b5f3eae4685f5fe3f" ], "linux_loong64": [ - "go1.25.0.linux-loong64.tar.gz", - "cab86b1cf761b1cb3bac86a8877cfc92e7b036fc0d3084123d77013d61432afc" + "go1.26.7.linux-loong64.tar.gz", + "89b5e92446e719719e23db447a41860d7d573252bab0704c9acb09ad97e9eca1" ], "linux_mips": [ - "go1.25.0.linux-mips.tar.gz", - "d66b6fb74c3d91b9829dc95ec10ca1f047ef5e89332152f92e136cf0e2da5be1" + "go1.26.7.linux-mips.tar.gz", + "fbdbf78b04494843fde47b15150e12adb7e2c0e2289eacbc18e6629a99604620" ], "linux_mips64": [ - "go1.25.0.linux-mips64.tar.gz", - "4082e4381a8661bc2a839ff94ba3daf4f6cde20f8fb771b5b3d4762dc84198a2" + "go1.26.7.linux-mips64.tar.gz", + "93b1360a29f4a71dbb6995f149b9312f67f5ce52197fea0042e9c9423809a496" ], "linux_mips64le": [ - "go1.25.0.linux-mips64le.tar.gz", - "70002c299ec7f7175ac2ef673b1b347eecfa54ae11f34416a6053c17f855afcc" + "go1.26.7.linux-mips64le.tar.gz", + "402dd2bd57fb4c982ef0eccbb4f7209ae98a753856e99baf962f1ac54493d65d" ], "linux_mipsle": [ - "go1.25.0.linux-mipsle.tar.gz", - "b00a3a39eff099f6df9f1c7355bf28e4589d0586f42d7d4a394efb763d145a73" + "go1.26.7.linux-mipsle.tar.gz", + "967da58e88c45c401593a8552be9beedaa989a3484a3105850d2beb6ca9ed698" ], "linux_ppc64": [ - "go1.25.0.linux-ppc64.tar.gz", - "df166f33bd98160662560a72ff0b4ba731f969a80f088922bddcf566a88c1ec1" + "go1.26.7.linux-ppc64.tar.gz", + "8feee58b3fa8d270343519d10d66736150e627d39aee937e6e889ba5445c8be9" ], "linux_ppc64le": [ - "go1.25.0.linux-ppc64le.tar.gz", - "0f18a89e7576cf2c5fa0b487a1635d9bcbf843df5f110e9982c64df52a983ad0" + "go1.26.7.linux-ppc64le.tar.gz", + "22d3b362d557175fd16b79651cab0cad64f8aaaedca745f66d16f44d56bc5de1" ], "linux_riscv64": [ - "go1.25.0.linux-riscv64.tar.gz", - "c018ff74a2c48d55c8ca9b07c8e24163558ffec8bea08b326d6336905d956b67" + "go1.26.7.linux-riscv64.tar.gz", + "21e1dc0e2f7dd9f80e0e94613fc324f1f99403b99997f9d8c5f80f8132fc642b" ], "linux_s390x": [ - "go1.25.0.linux-s390x.tar.gz", - "34e5a2e19f2292fbaf8783e3a241e6e49689276aef6510a8060ea5ef54eee408" + "go1.26.7.linux-s390x.tar.gz", + "bc3308e05e9397958ad4aac453e3dc4565ba6d548e9ace0a9b4b165feb6382f2" ], "netbsd_386": [ - "go1.25.0.netbsd-386.tar.gz", - "f8586cdb7aa855657609a5c5f6dbf523efa00c2bbd7c76d3936bec80aa6c0aba" + "go1.26.7.netbsd-386.tar.gz", + "c0a28bd30d8c07966cf7bc43fc6936866fb1a0e84ab4e983d4e8ca15edc1a4d1" ], "netbsd_amd64": [ - "go1.25.0.netbsd-amd64.tar.gz", - "ae8dc1469385b86a157a423bb56304ba45730de8a897615874f57dd096db2c2a" + "go1.26.7.netbsd-amd64.tar.gz", + "dff0b16d129f5e70f3bb38ed98d467404b5b130c7c8b3fe6b074601855f2bcd5" ], "netbsd_arm": [ - "go1.25.0.netbsd-arm.tar.gz", - "1ff7e4cc764425fc9dd6825eaee79d02b3c7cafffbb3691687c8d672ade76cb7" + "go1.26.7.netbsd-arm.tar.gz", + "36d15f8c5c5a5a048251b39ce67ed5a7ae2d072f1aa5c301cbde110670e824b2" ], "netbsd_arm64": [ - "go1.25.0.netbsd-arm64.tar.gz", - "e1b310739f26724216aa6d7d7208c4031f9ff54c9b5b9a796ddc8bebcb4a5f16" + "go1.26.7.netbsd-arm64.tar.gz", + "b75802b366e5b60aa6cfded871f0a72abadf297c5a68c523c5857822a5b92d34" ], "openbsd_386": [ - "go1.25.0.openbsd-386.tar.gz", - "4802a9b20e533da91adb84aab42e94aa56cfe3e5475d0550bed3385b182e69d8" + "go1.26.7.openbsd-386.tar.gz", + "c26201688339b2a10bf980be2d64adfd3a383b31a164377b0123ad78bde6979c" ], "openbsd_amd64": [ - "go1.25.0.openbsd-amd64.tar.gz", - "c016cd984bebe317b19a4f297c4f50def120dc9788490540c89f28e42f1dabe1" + "go1.26.7.openbsd-amd64.tar.gz", + "562de088b844764029f59ff52e82218711a4b585ab7ae175b88eff53e051a8df" ], "openbsd_arm": [ - "go1.25.0.openbsd-arm.tar.gz", - "a1e31d0bf22172ddde42edf5ec811ef81be43433df0948ece52fecb247ccfd8d" + "go1.26.7.openbsd-arm.tar.gz", + "646e19cd3449aec767bf75622d368b02c73d529a5478a25f2a7e21148b1a4cb6" ], "openbsd_arm64": [ - "go1.25.0.openbsd-arm64.tar.gz", - "343ea8edd8c218196e15a859c6072d0dd3246fbbb168481ab665eb4c4140458d" + "go1.26.7.openbsd-arm64.tar.gz", + "2045303632e112290e939dfd4678401109f612f7913f459e2d7d079e750723f5" ], "openbsd_ppc64": [ - "go1.25.0.openbsd-ppc64.tar.gz", - "694c14da1bcaeb5e3332d49bdc2b6d155067648f8fe1540c5de8f3cf8e157154" + "go1.26.7.openbsd-ppc64.tar.gz", + "23e89de68225dc41dd981601602e67fab0c4ca87af8f70a25131c06a301f9000" ], "openbsd_riscv64": [ - "go1.25.0.openbsd-riscv64.tar.gz", - "aa510ad25cf54c06cd9c70b6d80ded69cb20188ac6e1735655eef29ff7e7885f" + "go1.26.7.openbsd-riscv64.tar.gz", + "c0de2c6c353a582ca7682ed5a550056a8b5d59649260da4d1e327cf96684c822" ], "plan9_386": [ - "go1.25.0.plan9-386.tar.gz", - "46f8cef02086cf04bf186c5912776b56535178d4cb319cd19c9fdbdd29231986" + "go1.26.7.plan9-386.tar.gz", + "14ae7414a2ea05d26e1fc499d9b372c7f8f17726c49a5222fa9063b0f752a22c" ], "plan9_amd64": [ - "go1.25.0.plan9-amd64.tar.gz", - "29b34391d84095e44608a228f63f2f88113a37b74a79781353ec043dfbcb427b" + "go1.26.7.plan9-amd64.tar.gz", + "f9459b8137bdb81621d4e0cdba4c849a617c89c11a3088083ad3a8c97467c6a5" ], "plan9_arm": [ - "go1.25.0.plan9-arm.tar.gz", - "0a047107d13ebe7943aaa6d54b1d7bbd2e45e68ce449b52915a818da715799c2" + "go1.26.7.plan9-arm.tar.gz", + "4f444bd2e0f8a08ba8799131dd3531bea8723bf96b8ffa0e0948936a3c4aa8f0" ], "solaris_amd64": [ - "go1.25.0.solaris-amd64.tar.gz", - "9977f9e4351984364a3b2b78f8b88bfd1d339812356d5237678514594b7d3611" + "go1.26.7.solaris-amd64.tar.gz", + "04b5b280e0e0de1b91d7da5e34801dbf75e5621615f80cfd9935091d673f1238" ], "windows_386": [ - "go1.25.0.windows-386.zip", - "df9f39db82a803af0db639e3613a36681ab7a42866b1384b3f3a1045663961a7" + "go1.26.7.windows-386.zip", + "59cf0b9814c41c960d70df3cd5360fda0793e5d2230737d58e009392181fb636" ], "windows_amd64": [ - "go1.25.0.windows-amd64.zip", - "89efb4f9b30812eee083cc1770fdd2913c14d301064f6454851428f9707d190b" + "go1.26.7.windows-amd64.zip", + "f4f534a486e4bc3387fa18f08208f2f854b7aaea8a08f2a2d829a914a05abb11" ], "windows_arm64": [ - "go1.25.0.windows-arm64.zip", - "27bab004c72b3d7bd05a69b6ec0fc54a309b4b78cc569dd963d8b3ec28bfdb8c" + "go1.26.7.windows-arm64.zip", + "6f1b08de9e2dd94f69c52e524ab6834737275253291e8fd7f1c12ed4eceeda89" ] }, "1.27.1": { diff --git a/README.md b/README.md index e17b8f9..987e235 100644 --- a/README.md +++ b/README.md @@ -227,17 +227,17 @@ buf_generate( GitHub-release binaries from [`bazel_utils_protoc`](#bazel_utils_protoc). Tag them with `protoc.plugin` in the root module; `buf_generate` puts those on PATH. Do not also list them in `plugins` unless you need an extra binary or an override. This module re-exports the same binaries at `@bazel_utils_buf//protoc/plugins/…`. The target **name** is the PATH name (`local:` in the template). Do not wrap them with `buf_plugin`. -| Label | Upstream | Catalog versions | Platforms | -| ----------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- | ---------------- | ---------------------------------------------------------------- | -| `@bazel_utils_buf//protoc/plugins/protoc-gen-buffa` | [anthropics/buffa](https://github.com/anthropics/buffa) `protoc-gen-buffa` | v0.9.2 | linux/darwin amd64+arm64, windows amd64 (no windows-arm64 asset) | -| `@bazel_utils_buf//protoc/plugins/protoc-gen-buffa-packaging` | [anthropics/buffa](https://github.com/anthropics/buffa) `protoc-gen-buffa-packaging` | v0.9.2 | linux/darwin amd64+arm64, windows amd64 (no windows-arm64 asset) | -| `@bazel_utils_buf//protoc/plugins/protoc-gen-connect-go` | [connectrpc/connect-go](https://github.com/connectrpc/connect-go) `protoc-gen-connect-go` | v1.21.0 | linux/darwin/windows amd64+arm64 | -| `@bazel_utils_buf//protoc/plugins/protoc-gen-connect-rust` | [connectrpc/connect-rust](https://github.com/connectrpc/connect-rust) `protoc-gen-connect-rust` | v0.9.0 | linux/darwin amd64+arm64, windows amd64 (no windows-arm64 asset) | -| `@bazel_utils_buf//protoc/plugins/protoc-gen-contract-rust` | [sonalect/proto-contract.rs](https://github.com/sonalect/proto-contract.rs) | v0.1.0, v0.2.0 | linux/darwin/windows amd64+arm64 | -| `@bazel_utils_buf//protoc/plugins/protoc-gen-go` | [protocolbuffers/protobuf-go](https://github.com/protocolbuffers/protobuf-go) `protoc-gen-go` | v1.36.12 | linux/darwin/windows amd64+arm64 | -| `@bazel_utils_buf//protoc/plugins/protoc-gen-grpc-gateway` | [grpc-ecosystem/grpc-gateway](https://github.com/grpc-ecosystem/grpc-gateway) `protoc-gen-grpc-gateway` | v2.30.0 | linux/darwin/windows amd64+arm64 | -| `@bazel_utils_buf//protoc/plugins/protoc-gen-openapiv2` | [grpc-ecosystem/grpc-gateway](https://github.com/grpc-ecosystem/grpc-gateway) `protoc-gen-openapiv2` | v2.30.0 | linux/darwin/windows amd64+arm64 | -| `@bazel_utils_buf//protoc/plugins/protoc-gen-protovalidate-buffa` | [mathematic-inc/protovalidate-buffa](https://github.com/mathematic-inc/protovalidate-buffa) | v0.10.0 | linux/darwin/windows amd64+arm64 | +| Label | Upstream | Catalog versions | Platforms | +| ----------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- | ------------------------- | ---------------------------------------------------------------- | +| `@bazel_utils_buf//protoc/plugins/protoc-gen-buffa` | [anthropics/buffa](https://github.com/anthropics/buffa) `protoc-gen-buffa` | v0.9.2 | linux/darwin amd64+arm64, windows amd64 (no windows-arm64 asset) | +| `@bazel_utils_buf//protoc/plugins/protoc-gen-buffa-packaging` | [anthropics/buffa](https://github.com/anthropics/buffa) `protoc-gen-buffa-packaging` | v0.9.2 | linux/darwin amd64+arm64, windows amd64 (no windows-arm64 asset) | +| `@bazel_utils_buf//protoc/plugins/protoc-gen-connect-go` | [connectrpc/connect-go](https://github.com/connectrpc/connect-go) `protoc-gen-connect-go` | v1.21.0 | linux/darwin/windows amd64+arm64 | +| `@bazel_utils_buf//protoc/plugins/protoc-gen-connect-rust` | [connectrpc/connect-rust](https://github.com/connectrpc/connect-rust) `protoc-gen-connect-rust` | v0.9.0, v0.9.1 | linux/darwin amd64+arm64, windows amd64 (no windows-arm64 asset) | +| `@bazel_utils_buf//protoc/plugins/protoc-gen-contract-rust` | [sonalect/proto-contract.rs](https://github.com/sonalect/proto-contract.rs) | v0.1.0, v0.2.0 | linux/darwin/windows amd64+arm64 | +| `@bazel_utils_buf//protoc/plugins/protoc-gen-go` | [protocolbuffers/protobuf-go](https://github.com/protocolbuffers/protobuf-go) `protoc-gen-go` | v1.36.12 | linux/darwin/windows amd64+arm64 | +| `@bazel_utils_buf//protoc/plugins/protoc-gen-grpc-gateway` | [grpc-ecosystem/grpc-gateway](https://github.com/grpc-ecosystem/grpc-gateway) `protoc-gen-grpc-gateway` | v2.30.0, v2.31.0 | linux/darwin/windows amd64+arm64 | +| `@bazel_utils_buf//protoc/plugins/protoc-gen-openapiv2` | [grpc-ecosystem/grpc-gateway](https://github.com/grpc-ecosystem/grpc-gateway) `protoc-gen-openapiv2` | v2.30.0, v2.31.0 | linux/darwin/windows amd64+arm64 | +| `@bazel_utils_buf//protoc/plugins/protoc-gen-protovalidate-buffa` | [mathematic-inc/protovalidate-buffa](https://github.com/mathematic-inc/protovalidate-buffa) | v0.10.0, v0.10.1, v0.10.2 | linux/darwin/windows amd64+arm64 | ```starlark load("@bazel_utils_buf//:buf.bzl", "buf_generate") @@ -375,7 +375,7 @@ protoc.plugin( ) protoc.plugin( name = "protoc-gen-protovalidate-buffa", - version = "v0.10.0", + version = "v0.10.2", ) ``` @@ -390,17 +390,17 @@ Module-extension tag. One per plugin name per module; the root module's tag wins | `name` | `string` | yes | — | PATH name (`protoc-gen-buffa`, `protoc-gen-buffa-packaging`, `protoc-gen-connect-go`, `protoc-gen-connect-rust`, `protoc-gen-contract-rust`, `protoc-gen-go`, `protoc-gen-grpc-gateway`, `protoc-gen-openapiv2`, `protoc-gen-protovalidate-buffa`). | | `version` | `string` | yes | — | GitHub release tag (must exist in this module's `plugins//registry.bzl`). | -| Label | Upstream | Catalog versions | Platforms | -| ------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- | ---------------- | ---------------------------------------------------------------- | -| `@bazel_utils_protoc//plugins/protoc-gen-buffa` | [anthropics/buffa](https://github.com/anthropics/buffa) `protoc-gen-buffa` | v0.9.2 | linux/darwin amd64+arm64, windows amd64 (no windows-arm64 asset) | -| `@bazel_utils_protoc//plugins/protoc-gen-buffa-packaging` | [anthropics/buffa](https://github.com/anthropics/buffa) `protoc-gen-buffa-packaging` | v0.9.2 | linux/darwin amd64+arm64, windows amd64 (no windows-arm64 asset) | -| `@bazel_utils_protoc//plugins/protoc-gen-connect-go` | [connectrpc/connect-go](https://github.com/connectrpc/connect-go) `protoc-gen-connect-go` | v1.21.0 | linux/darwin/windows amd64+arm64 | -| `@bazel_utils_protoc//plugins/protoc-gen-connect-rust` | [connectrpc/connect-rust](https://github.com/connectrpc/connect-rust) `protoc-gen-connect-rust` | v0.9.0 | linux/darwin amd64+arm64, windows amd64 (no windows-arm64 asset) | -| `@bazel_utils_protoc//plugins/protoc-gen-contract-rust` | [sonalect/proto-contract.rs](https://github.com/sonalect/proto-contract.rs) | v0.1.0, v0.2.0 | linux/darwin/windows amd64+arm64 | -| `@bazel_utils_protoc//plugins/protoc-gen-go` | [protocolbuffers/protobuf-go](https://github.com/protocolbuffers/protobuf-go) `protoc-gen-go` | v1.36.12 | linux/darwin/windows amd64+arm64 | -| `@bazel_utils_protoc//plugins/protoc-gen-grpc-gateway` | [grpc-ecosystem/grpc-gateway](https://github.com/grpc-ecosystem/grpc-gateway) `protoc-gen-grpc-gateway` | v2.30.0 | linux/darwin/windows amd64+arm64 | -| `@bazel_utils_protoc//plugins/protoc-gen-openapiv2` | [grpc-ecosystem/grpc-gateway](https://github.com/grpc-ecosystem/grpc-gateway) `protoc-gen-openapiv2` | v2.30.0 | linux/darwin/windows amd64+arm64 | -| `@bazel_utils_protoc//plugins/protoc-gen-protovalidate-buffa` | [mathematic-inc/protovalidate-buffa](https://github.com/mathematic-inc/protovalidate-buffa) | v0.10.0 | linux/darwin/windows amd64+arm64 | +| Label | Upstream | Catalog versions | Platforms | +| ------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- | ------------------------- | ---------------------------------------------------------------- | +| `@bazel_utils_protoc//plugins/protoc-gen-buffa` | [anthropics/buffa](https://github.com/anthropics/buffa) `protoc-gen-buffa` | v0.9.2 | linux/darwin amd64+arm64, windows amd64 (no windows-arm64 asset) | +| `@bazel_utils_protoc//plugins/protoc-gen-buffa-packaging` | [anthropics/buffa](https://github.com/anthropics/buffa) `protoc-gen-buffa-packaging` | v0.9.2 | linux/darwin amd64+arm64, windows amd64 (no windows-arm64 asset) | +| `@bazel_utils_protoc//plugins/protoc-gen-connect-go` | [connectrpc/connect-go](https://github.com/connectrpc/connect-go) `protoc-gen-connect-go` | v1.21.0 | linux/darwin/windows amd64+arm64 | +| `@bazel_utils_protoc//plugins/protoc-gen-connect-rust` | [connectrpc/connect-rust](https://github.com/connectrpc/connect-rust) `protoc-gen-connect-rust` | v0.9.0, v0.9.1 | linux/darwin amd64+arm64, windows amd64 (no windows-arm64 asset) | +| `@bazel_utils_protoc//plugins/protoc-gen-contract-rust` | [sonalect/proto-contract.rs](https://github.com/sonalect/proto-contract.rs) | v0.1.0, v0.2.0 | linux/darwin/windows amd64+arm64 | +| `@bazel_utils_protoc//plugins/protoc-gen-go` | [protocolbuffers/protobuf-go](https://github.com/protocolbuffers/protobuf-go) `protoc-gen-go` | v1.36.12 | linux/darwin/windows amd64+arm64 | +| `@bazel_utils_protoc//plugins/protoc-gen-grpc-gateway` | [grpc-ecosystem/grpc-gateway](https://github.com/grpc-ecosystem/grpc-gateway) `protoc-gen-grpc-gateway` | v2.30.0, v2.31.0 | linux/darwin/windows amd64+arm64 | +| `@bazel_utils_protoc//plugins/protoc-gen-openapiv2` | [grpc-ecosystem/grpc-gateway](https://github.com/grpc-ecosystem/grpc-gateway) `protoc-gen-openapiv2` | v2.30.0, v2.31.0 | linux/darwin/windows amd64+arm64 | +| `@bazel_utils_protoc//plugins/protoc-gen-protovalidate-buffa` | [mathematic-inc/protovalidate-buffa](https://github.com/mathematic-inc/protovalidate-buffa) | v0.10.0, v0.10.1, v0.10.2 | linux/darwin/windows amd64+arm64 | --- diff --git a/go/MODULE.bazel b/go/MODULE.bazel index 7b54960..b61be50 100644 --- a/go/MODULE.bazel +++ b/go/MODULE.bazel @@ -8,7 +8,7 @@ module( bazel_dep(name = "bazel_skylib", version = "1.9.2") bazel_dep(name = "bazel_utils_core", version = "0.2.14") bazel_dep(name = "gazelle", version = "0.54.0") -bazel_dep(name = "rules_go", version = "0.63.0") +bazel_dep(name = "rules_go", version = "0.64.1") go_sdk = use_extension("@rules_go//go:extensions.bzl", "go_sdk") go_sdk.from_file(go_mod = "//:go.mod") diff --git a/markdown/MODULE.bazel b/markdown/MODULE.bazel index c87c7f8..bffda67 100644 --- a/markdown/MODULE.bazel +++ b/markdown/MODULE.bazel @@ -5,17 +5,59 @@ module( version = "0.2.14", ) -bazel_dep(name = "aspect_rules_js", version = "3.4.1") +bazel_dep(name = "aspect_rules_js", version = "3.5.1") bazel_dep(name = "bazel_skylib", version = "1.9.2") bazel_dep(name = "bazel_utils_core", version = "0.2.14") -bazel_dep(name = "rules_nodejs", version = "6.7.5") +bazel_dep(name = "rules_nodejs", version = "6.7.6") -# Latest Node in rules_nodejs 6.7.5's catalog (24.19.0 is not listed yet). +# Newer than rules_nodejs 6.7.6's catalog, so the sha256s come from +# https://nodejs.org/dist/v24.21.0/SHASUMS256.txt. +# Key: "-"; value: [filename, strip_prefix, sha256]. node = use_extension("@rules_nodejs//nodejs:extensions.bzl", "node") -node.toolchain(node_version = "24.18.0") +node.toolchain( + node_repositories = { + "24.21.0-darwin_amd64": [ + "node-v24.21.0-darwin-x64.tar.gz", + "node-v24.21.0-darwin-x64", + "1462cb3b3046b815cf8ea436d3da450ec1a9f11dac7e5a46b0ada5305d7e8097", + ], + "24.21.0-darwin_arm64": [ + "node-v24.21.0-darwin-arm64.tar.gz", + "node-v24.21.0-darwin-arm64", + "bed7eea5325e1108f32ce5228ddd6a5f0f08a499ee42aa7442aea583702f6057", + ], + "24.21.0-linux_amd64": [ + "node-v24.21.0-linux-x64.tar.xz", + "node-v24.21.0-linux-x64", + "fd8e59d5a511510f6a298afb548f18c7d2b1be404d8b4a27d94fbe49f56cb2d6", + ], + "24.21.0-linux_arm64": [ + "node-v24.21.0-linux-arm64.tar.xz", + "node-v24.21.0-linux-arm64", + "6ad1325edbdb5649c379b75a237147a666c95d4f9ae8d340fef2d1575d289ad2", + ], + "24.21.0-windows_amd64": [ + "node-v24.21.0-win-x64.zip", + "node-v24.21.0-win-x64", + "158f7685b44de51f6c0df1d153526cbcd3e1bc739a8dfc607721cef75de9e541", + ], + "24.21.0-windows_arm64": [ + "node-v24.21.0-win-arm64.zip", + "node-v24.21.0-win-arm64", + "8779b1bde1d39f8d420e3b57aa657b39891af434d3de44a919044cec06785921", + ], + }, + node_version = "24.21.0", +) +# Newer than rules_js 3.5.1's catalog, so the integrity comes from npm +# (https://registry.npmjs.org/pnpm/12.10.1, dist.integrity). +# Keep in sync with package.json `packageManager`. pnpm = use_extension("@aspect_rules_js//npm:extensions.bzl", "pnpm") -pnpm.pnpm(pnpm_version = "11.20.0") +pnpm.pnpm( + pnpm_version = "12.10.1", + pnpm_version_integrity = "sha512-ukCjfrGjcNYP6oxM8dNkwTvMzvUY6YrSvO6VT1OdONo3RY5YJho/pV4GUjRQ6g//+fSXsTW+QfLBXBZCusrObA==", +) use_repo(pnpm, "pnpm") npm = use_extension("@aspect_rules_js//npm:extensions.bzl", "npm") diff --git a/markdown/package.json b/markdown/package.json index 4ce31b3..367c611 100644 --- a/markdown/package.json +++ b/markdown/package.json @@ -1,7 +1,7 @@ { "name": "bazel_utils", "private": true, - "packageManager": "pnpm@12.6.0", + "packageManager": "pnpm@12.10.1", "devDependencies": { "markdownlint-cli2": "catalog:" } diff --git a/protoc/MODULE.bazel b/protoc/MODULE.bazel index 99034c1..6b7f5cf 100644 --- a/protoc/MODULE.bazel +++ b/protoc/MODULE.bazel @@ -45,7 +45,7 @@ protoc.plugin( ) protoc.plugin( name = "protoc-gen-protovalidate-buffa", - version = "v0.10.1", + version = "v0.10.2", ) use_repo( protoc, diff --git a/protoc/plugins/protoc-gen-protovalidate-buffa/registry.bzl b/protoc/plugins/protoc-gen-protovalidate-buffa/registry.bzl index e040469..57dd147 100644 --- a/protoc/plugins/protoc-gen-protovalidate-buffa/registry.bzl +++ b/protoc/plugins/protoc-gen-protovalidate-buffa/registry.bzl @@ -77,5 +77,37 @@ PLUGIN = { "sha256": "a6f2b8109cfa9b9cd33cb7143213c649c7b73175153c2e17995e04b74cb28e03", }, }, + "v0.10.2": { + "linux_amd64": { + "bin": "protoc-gen-protovalidate-buffa", + "file": "x86_64-unknown-linux-gnu.tar.gz", + "sha256": "e709fe8c52c6e5fb32c6d2c14f4ed784c1c209b80ea9f90bdcdc318f303ac0ce", + }, + "linux_arm64": { + "bin": "protoc-gen-protovalidate-buffa", + "file": "aarch64-unknown-linux-gnu.tar.gz", + "sha256": "3db5ca1c7977a123a29f52016e00e1632fea54d37ad681ebb51905daa4a3fe37", + }, + "darwin_amd64": { + "bin": "protoc-gen-protovalidate-buffa", + "file": "x86_64-apple-darwin.tar.gz", + "sha256": "efd2f63f440e32c23bc28b053e0f272e55b5bf5be9e909c3610c9729bf6241ab", + }, + "darwin_arm64": { + "bin": "protoc-gen-protovalidate-buffa", + "file": "aarch64-apple-darwin.tar.gz", + "sha256": "a005b34525749236ea3030806c0083430eca9b9faf414406db6aee98121b7864", + }, + "windows_amd64": { + "bin": "protoc-gen-protovalidate-buffa.exe", + "file": "x86_64-pc-windows-msvc.zip", + "sha256": "a8d71929ed8e2c8a0e5a272ac3dd3618edb2c049fc7bdf63849f566be0587fa2", + }, + "windows_arm64": { + "bin": "protoc-gen-protovalidate-buffa.exe", + "file": "aarch64-pc-windows-msvc.zip", + "sha256": "3efdd9fc97e0dcfef80a8f31563b5e4813675b85dcfc662b37d1d0cd6d0d156b", + }, + }, }, } diff --git a/python/MODULE.bazel b/python/MODULE.bazel index 7b0b0b3..e9a381c 100644 --- a/python/MODULE.bazel +++ b/python/MODULE.bazel @@ -14,8 +14,20 @@ python = use_extension("@rules_python//python/extensions:python.bzl", "python") python.defaults(python_version = "3.14") python.toolchain(python_version = "3.14") +# Pinned here, not rules_py's default. sha256 from the release's sha256.sum: +# https://github.com/astral-sh/uv/releases/download/0.12.23/sha256.sum uv_bin = use_extension("@aspect_rules_py//uv/unstable:extension.bzl", "uv_bin") -uv_bin.toolchain() +uv_bin.toolchain( + sha256s = { + "aarch64-apple-darwin": "50487ae565ccd96e499056b4674d438f4c53170202617b4c759defe0c6a1b544", + "aarch64-pc-windows-msvc": "13294e232ececbe709c06b74e6ced06f2a225ea5591476685362f22be56a50d5", + "aarch64-unknown-linux-musl": "b536543cc4d50661986b165c76ee8aa9056e4fa332edcd153ff2e98760f9359b", + "x86_64-apple-darwin": "960da44cb4b73685206ddd250b19e0a117fa41095710c1038f081f5cb613efb4", + "x86_64-pc-windows-msvc": "75d05de6762778c31ee183398de7dd15093fad0ed90b1f236d8205ea5ec00c90", + "x86_64-unknown-linux-musl": "1cff8783850e794470aadb73f54b749542a511fc57b0ce6468b64bd3852e0ade", + }, + version = "0.12.23", +) use_repo(uv_bin, "uv") uv = use_extension("@aspect_rules_py//uv/unstable:extension.bzl", "uv") diff --git a/python/ruff.MODULE.bazel b/python/ruff.MODULE.bazel index de5dcc6..9ab6d48 100644 --- a/python/ruff.MODULE.bazel +++ b/python/ruff.MODULE.bazel @@ -2,7 +2,7 @@ http_archive = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive") -_RUFF = "0.16.9" +_RUFF = "0.16.10" _RUFF_URL = "https://github.com/astral-sh/ruff/releases/download/{version}/ruff-{platform}" @@ -13,7 +13,7 @@ _WIN_BUILD = """exports_files(["ruff.exe"], visibility = ["//visibility:public"] http_archive( name = "ruff_linux_amd64", build_file_content = _UNIX_BUILD, - sha256 = "1bfbb819b5d4f9af501748862276b60e412d336034d99387691a4d4bce7a6f13", + sha256 = "9567ff1201e2fb3da31ff04c35587d768c66d6cb42dfa84de474e2bfe360b608", strip_prefix = "ruff-x86_64-unknown-linux-gnu", urls = [_RUFF_URL.format( platform = "x86_64-unknown-linux-gnu.tar.gz", @@ -24,7 +24,7 @@ http_archive( http_archive( name = "ruff_linux_arm64", build_file_content = _UNIX_BUILD, - sha256 = "a13061e8f471b49c9d2aa284c32dd54a0e5534d702d1a44e1d7f4c875569586d", + sha256 = "dc0d74de837ef0a7bcc62ce98c48a622b075d057161f13b958be2934becd55a6", strip_prefix = "ruff-aarch64-unknown-linux-gnu", urls = [_RUFF_URL.format( platform = "aarch64-unknown-linux-gnu.tar.gz", @@ -35,7 +35,7 @@ http_archive( http_archive( name = "ruff_darwin_amd64", build_file_content = _UNIX_BUILD, - sha256 = "e98ea259a021c87d3a1f8bf18639d2e32dcd45cb2ef1afcb41b13e295de1e2b3", + sha256 = "ace641df42926e962cf04bc52c79eb6c50ba1ae6a17b602f081960616ecc1bd1", strip_prefix = "ruff-x86_64-apple-darwin", urls = [_RUFF_URL.format( platform = "x86_64-apple-darwin.tar.gz", @@ -46,7 +46,7 @@ http_archive( http_archive( name = "ruff_darwin_arm64", build_file_content = _UNIX_BUILD, - sha256 = "33d35394499094cf6eb90f730dc82f11c0fab05d176378ae4f67de985ecc4146", + sha256 = "f051cd306de2691262a0574f8857cd1f4d6bfcd448084ea23d61b9c1c37df510", strip_prefix = "ruff-aarch64-apple-darwin", urls = [_RUFF_URL.format( platform = "aarch64-apple-darwin.tar.gz", @@ -58,7 +58,7 @@ http_archive( http_archive( name = "ruff_windows_amd64", build_file_content = _WIN_BUILD, - sha256 = "fe5eb06b2f185b0d8035e17df9df0c831e59b3c98f11170206500650218a0b76", + sha256 = "6b90457fbd249923db196044d5f3c26e4f7cefacc769c26fd52520fa033f736e", urls = [_RUFF_URL.format( platform = "x86_64-pc-windows-msvc.zip", version = _RUFF, @@ -68,7 +68,7 @@ http_archive( http_archive( name = "ruff_windows_arm64", build_file_content = _WIN_BUILD, - sha256 = "98f41e001af9ccbbd16a9948b1214e711af9bacfaa204951d831584dfe109fcf", + sha256 = "cde60dbdf2697144474e6d87b8b51b73bb1fd218f4c180acb40abbd3b659d56f", urls = [_RUFF_URL.format( platform = "aarch64-pc-windows-msvc.zip", version = _RUFF, From 3adf9272c0cb8b14f19b0c55d6ec38aec6f75144 Mon Sep 17 00:00:00 2001 From: Aleksandr Sokolovskii Date: Thu, 8 Oct 2026 22:33:08 +0200 Subject: [PATCH 2/9] Make every rule hermetic on all six platforms, replace pip_audit_test with uv_audit_test, and test each public rule in CI. Windows no longer needs a host bash or Python. bazel_utils_core downloads busybox-w32: test and run rules return a .bat launcher that runs their wrapper with busybox sh, and buf_module/buf_generate run their scripts with it. Wrappers are ash-compatible. Prebuilt binaries get a .exe output on Windows, buf_plugin keeps the wrapped binary's extension, and protoc-gen-buffa, protoc-gen-buffa-packaging, and protoc-gen-connect-rust use their x64 build on windows-arm64. protoc.plugin zips are extracted at build time with the hermetic bsdtar from tar.bzl instead of host Python; Bazel 9.2's zip reader still crashes on protobuf-go's zip comment. Breaking: pip_audit_test is replaced by uv_audit_test, which runs `uv audit --frozen` with the pinned uv. The python module drops pip-audit, its lock, and the Python toolchain. golangci_test and govulncheck_test now run in the go.mod directory, so a go.mod below the repo root works. tests/ has a fixture for every public rule, including buf_generate with all nine prebuilt plugins, and CI runs build, test, and the format targets on linux, darwin, and windows for amd64 and arm64 for pull requests and v* tags. Cursor rules are removed; CLAUDE.md holds the maintainer notes. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Aleksandr Sokolovskii --- .cursor/skills/versioning/SKILL.md | 57 -- .github/workflows/ci.yml | 145 ++++- BUILD.bazel | 5 + CHANGELOG.md | 57 +- CLAUDE.md | 134 +++++ MODULE.bazel.lock | 184 ++++++- README.md | 74 +-- bazel/BUILD.bazel | 1 + bazel/buildifier.bzl | 12 +- buf/BUILD.bazel | 7 +- buf/extensions.bzl | 6 +- buf/format.bzl | 10 +- buf/generate.bzl | 45 +- buf/lint.bzl | 10 +- buf/plugin.bzl | 5 +- core/BUILD.bazel | 22 + core/MODULE.bazel | 24 + core/internal/BUILD.bazel | 10 + core/internal/launcher.bzl | 116 ++++ core/internal/workspace_cd.bzl | 21 +- core/internal/workspace_tool.bzl | 12 +- go/BUILD.bazel | 12 +- go/dirs.bzl | 34 +- go/dirs_test.bzl | 23 + go/go_sdk_env.bzl | 9 +- go/golangci.bzl | 9 +- go/govulncheck.bzl | 9 +- protoc/BUILD.bazel | 5 +- protoc/MODULE.bazel | 3 + protoc/extensions.bzl | 84 ++- protoc/plugins/BUILD.bazel | 5 + .../protoc-gen-buffa-packaging/registry.bzl | 7 + protoc/plugins/protoc-gen-buffa/registry.bzl | 7 + .../protoc-gen-connect-rust/registry.bzl | 14 + protoc/plugins/unzip.bzl | 63 +++ python/.python-version | 1 - python/BUILD.bazel | 28 +- python/MODULE.bazel | 23 +- python/pyproject.toml | 18 - python/python.bzl | 6 +- python/uv.lock | 519 ------------------ python/{pip_audit.bzl => uv_audit.bzl} | 77 ++- rust/BUILD.bazel | 7 +- rust/cargo_audit.bzl | 13 +- tests/buf/BUILD.bazel | 50 ++ tests/buf/buf.gen.all.yaml | 31 ++ tests/buf/buf.gen.renamed.yaml | 6 + tests/buf/buf.yaml | 9 + tests/buf/deps/BUILD.bazel | 10 + tests/buf/deps/proto/common/v1/common.proto | 11 + tests/buf/proto/smoke/v1/smoke.proto | 25 + tests/go/.golangci.yaml | 1 + tests/go/BUILD.bazel | 18 + tests/go/go.mod | 3 + tests/go/smoke.go | 7 + tests/python/BUILD.bazel | 24 + tests/python/pyproject.toml | 13 + tests/python/smoke.py | 6 + tests/python/uv.lock | 8 + tests/rust/BUILD.bazel | 8 + tests/rust/Cargo.lock | 7 + tests/rust/Cargo.toml | 8 + tests/rust/src/lib.rs | 6 + 63 files changed, 1307 insertions(+), 877 deletions(-) delete mode 100644 .cursor/skills/versioning/SKILL.md create mode 100644 CLAUDE.md create mode 100644 core/internal/launcher.bzl create mode 100644 go/dirs_test.bzl create mode 100644 protoc/plugins/unzip.bzl delete mode 100644 python/.python-version delete mode 100644 python/pyproject.toml delete mode 100644 python/uv.lock rename python/{pip_audit.bzl => uv_audit.bzl} (53%) create mode 100644 tests/buf/BUILD.bazel create mode 100644 tests/buf/buf.gen.all.yaml create mode 100644 tests/buf/buf.gen.renamed.yaml create mode 100644 tests/buf/buf.yaml create mode 100644 tests/buf/deps/BUILD.bazel create mode 100644 tests/buf/deps/proto/common/v1/common.proto create mode 100644 tests/buf/proto/smoke/v1/smoke.proto create mode 100644 tests/go/.golangci.yaml create mode 100644 tests/go/BUILD.bazel create mode 100644 tests/go/go.mod create mode 100644 tests/go/smoke.go create mode 100644 tests/python/BUILD.bazel create mode 100644 tests/python/pyproject.toml create mode 100644 tests/python/smoke.py create mode 100644 tests/python/uv.lock create mode 100644 tests/rust/BUILD.bazel create mode 100644 tests/rust/Cargo.lock create mode 100644 tests/rust/Cargo.toml create mode 100644 tests/rust/src/lib.rs diff --git a/.cursor/skills/versioning/SKILL.md b/.cursor/skills/versioning/SKILL.md deleted file mode 100644 index 499d448..0000000 --- a/.cursor/skills/versioning/SKILL.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -name: versioning -description: >- - Bump bazel_utils module versions in lockstep (Rust-style 0.x or SemVer after - 1.0.0) and create the matching GitHub tag. Use when releasing, tagging, - bumping module(version), editing MODULE.bazel versions, or updating README - git_override tags. ---- - -# Versioning - -One release version for the whole repo. Even if only one language module changed, bump **every** module and the root `MODULE.bazel`, then tag GitHub. - -## Scheme - -Versions are `MAJOR.MINOR.PATCH`. `module(version = "0.1.0")` has **no** `v`. The git tag and `git_override(tag = …)` **do**: `v0.1.0`. - -If **major is 0** (Rust approach): - -- Breaking change → bump **minor** (`0.1.2` → `0.2.0`) -- Bugfix or new features (compatible) → bump **patch** (`0.1.0` → `0.1.1`) - -If **major > 0** (standard SemVer): - -- Breaking → **major** -- Compatible features → **minor** -- Bugfixes → **patch** - -Do not skip numbers. Do not jump to `1.0.0` unless the user explicitly wants a stable public API. - -**Breaking** means consumer-visible Starlark: renamed/removed rules or attrs, required new attrs, provider changes, `buf.toolchains` contract. Pinned tool upgrades are a patch (0.x) or minor (≥1.0) unless they force a breaking API/output change. - -Tool pins (Buf CLI via `buf.toolchains`, plugins via `protoc.plugin`, ruff) are -**not** this version. CLI hashes live in `buf/registry.bzl`; plugin hashes in -`protoc/plugins//registry.bzl`. The consumer selects the release tag. - -## Lockstep files - -Set the same `MAJOR.MINOR.PATCH` everywhere: - -- Root `MODULE.bazel`: `module(version = …)` and every `bazel_dep(name = "bazel_utils_*", version = …)` -- Each language module `module(version = …)`: `bazel/`, `buf/`, `core/`, `go/`, `markdown/`, `protoc/`, `python/`, `rust/` -- Each language module's `bazel_dep(name = "bazel_utils_core", version = …)` (except `core/` itself) -- `README.md`: “Current module version”, every example `bazel_dep(… version = …)`, every `git_override(… tag = "v…")` - -Refresh `MODULE.bazel.lock` if it changes. - -## Release - -After the version commit is on the default branch, create an annotated tag and push it (only when the user asked to release): - -```bash -git tag -a "vMAJOR.MINOR.PATCH" -m "vMAJOR.MINOR.PATCH" -git push origin "vMAJOR.MINOR.PATCH" -``` - -Examples: `v0.1.0`, `v0.1.1`, `v0.2.0`. Consumers pin that tag in `git_override`. diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 52244df..3f58bf3 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,9 +1,12 @@ name: CI +# Every public rule is exercised by //... (tests/, unit tests, lint) on all six +# supported platforms. Runs for pull requests and release tags, not every push. on: - push: - branches: [main] pull_request: + push: + tags: ["v*"] + workflow_dispatch: concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} @@ -12,48 +15,125 @@ concurrency: permissions: contents: read +env: + BAZELISK_VERSION: 1.29.0 + jobs: - ci: - name: Bazel - runs-on: ubuntu-latest - timeout-minutes: 45 - env: - BAZELISK_VERSION: 1.29.0 - BAZELISK_SHA256: 5a408715e932c0250d28bd84555f12edbf70117de42f9181691c736eacc4a992 - # Portable caches only. Do not persist output_user_root (~/.cache/bazel): - # it includes sandbox, execroot, and a live Bazel server. - BAZEL_DISK_CACHE: /home/runner/.cache/bazel-disk - BAZEL_REPO_CACHE: /home/runner/.cache/bazel-repo + bazel: + name: Bazel (${{ matrix.platform }}) + runs-on: ${{ matrix.runner }} + timeout-minutes: 60 + strategy: + fail-fast: false + matrix: + include: + - platform: linux-amd64 + runner: ubuntu-24.04 + bazelisk: bazelisk-linux-amd64 + bazelisk_sha256: 5a408715e932c0250d28bd84555f12edbf70117de42f9181691c736eacc4a992 + bazel: bazel + shell: bash + cache_root: ~/.cache/bazel-ci + - platform: linux-arm64 + runner: ubuntu-24.04-arm + bazelisk: bazelisk-linux-arm64 + bazelisk_sha256: e20e8b0f4f240091b7a55bf17b9398bd4f40ee70ae0208dff95dd4c445fb4010 + bazel: bazel + shell: bash + cache_root: ~/.cache/bazel-ci + - platform: darwin-amd64 + runner: macos-15-intel + bazelisk: bazelisk-darwin-amd64 + bazelisk_sha256: 16c3d7aa15323a9fb69f56c7ec5733ed18bedb786680d0ba13bb12a3c8083007 + bazel: bazel + shell: bash + cache_root: ~/.cache/bazel-ci + - platform: darwin-arm64 + runner: macos-15 + bazelisk: bazelisk-darwin-arm64 + bazelisk_sha256: cee851f726789227d5561004e9904a52be45c3efb56f8b38b6993d6adbaa0409 + bazel: bazel + shell: bash + cache_root: ~/.cache/bazel-ci + - platform: windows-amd64 + runner: windows-2025 + bazelisk: bazelisk-windows-amd64.exe + bazelisk_sha256: 092a8738d5b41aae7a85c42cc961b1034e3389aba43ffc20c0fabda7b43e095b + bazel: bazel.exe + # PowerShell, not Git Bash, so Bazel does not inherit Git's Unix tools. + shell: pwsh + cache_root: C:/bazel-ci + - platform: windows-arm64 + runner: windows-11-arm + bazelisk: bazelisk-windows-arm64.exe + bazelisk_sha256: 8bc42bd5d7857f18a21440b906469bb6c7cf91a7c72364d4b1e5ec56a76fe94f + bazel: bazel.exe + shell: pwsh + cache_root: C:/bazel-ci + defaults: + run: + shell: ${{ matrix.shell }} steps: + # Keep LF so buildifier, markdownlint, and `git diff` see the committed bytes. + - name: Disable CRLF conversion + shell: bash + run: git config --global core.autocrlf false + - name: Check out repository uses: actions/checkout@v7.0.1 - name: Install Bazelisk + shell: bash + env: + BAZELISK: ${{ matrix.bazelisk }} + BAZELISK_SHA256: ${{ matrix.bazelisk_sha256 }} + BAZEL_EXE: ${{ matrix.bazel }} run: | set -euo pipefail - curl -fsSL -o /tmp/bazelisk \ - "https://github.com/bazelbuild/bazelisk/releases/download/v${BAZELISK_VERSION}/bazelisk-linux-amd64" - echo "${BAZELISK_SHA256} /tmp/bazelisk" | sha256sum -c - sudo install -m 0755 /tmp/bazelisk /usr/local/bin/bazel + dir="${RUNNER_TEMP}/bazelisk" + mkdir -p "${dir}" + curl -fsSL -o "${dir}/${BAZEL_EXE}" \ + "https://github.com/bazelbuild/bazelisk/releases/download/v${BAZELISK_VERSION}/${BAZELISK}" + if command -v sha256sum >/dev/null; then + echo "${BAZELISK_SHA256} ${dir}/${BAZEL_EXE}" | sha256sum -c + else + echo "${BAZELISK_SHA256} ${dir}/${BAZEL_EXE}" | shasum -a 256 -c + fi + chmod +x "${dir}/${BAZEL_EXE}" + echo "${dir}" >> "${GITHUB_PATH}" - name: Cache Bazel uses: actions/cache@v6.1.0 with: path: | - ${{ env.BAZEL_DISK_CACHE }} - ${{ env.BAZEL_REPO_CACHE }} + ${{ matrix.cache_root }} ~/.cache/bazelisk - key: bazel-${{ runner.os }}-cas-${{ hashFiles('.bazelversion', 'MODULE.bazel.lock', 'markdown/pnpm-lock.yaml', 'python/uv.lock', 'go/go.sum') }} + ~/Library/Caches/bazelisk + ~/AppData/Local/bazelisk + key: bazel-${{ matrix.platform }}-${{ hashFiles('.bazelversion', 'MODULE.bazel.lock', 'markdown/pnpm-lock.yaml', 'go/go.sum') }} restore-keys: | - bazel-${{ runner.os }}-cas- + bazel-${{ matrix.platform }}- - - name: Configure Bazel caches + # Portable caches only. Do not persist output_user_root: it includes the + # sandbox, execroot, and a live Bazel server. + - name: Configure Bazel + shell: bash + env: + CACHE_ROOT: ${{ matrix.cache_root }} run: | set -euo pipefail - mkdir -p "${BAZEL_DISK_CACHE}" "${BAZEL_REPO_CACHE}" + root="${CACHE_ROOT/#\~/${HOME}}" + mkdir -p "${root}/disk" "${root}/repo" { - echo "common --disk_cache=${BAZEL_DISK_CACHE}" - echo "common --repository_cache=${BAZEL_REPO_CACHE}" + if [[ "${RUNNER_OS}" == Windows ]]; then + # Short output root: Windows MAX_PATH. + echo "startup --output_user_root=C:/b" + # No host bash: bazel_utils runs its scripts with busybox-w32, so + # anything that still reaches for Bazel's shell fails loudly. + echo "common --shell_executable=C:/no-host-bash/bash.exe" + fi + echo "common --disk_cache=${root}/disk" + echo "common --repository_cache=${root}/repo" } >> "${HOME}/.bazelrc" - name: Build @@ -62,7 +142,20 @@ jobs: - name: Test run: bazel test //... --keep_going --test_output=errors - # Stop the server so repository/disk caches are idle before actions/cache tars them. + # `bazel run` targets: each must run and leave the checkout unchanged. + - name: Run buildifier_format + run: bazel run //:format + + - name: Run buf_format + run: bazel run //tests/buf:format + + - name: Run ruff_format + run: bazel run //tests/python:format + + - name: Check formatters left no changes + run: git diff --exit-code + + # Stop the server so repository/disk caches are idle before actions/cache saves them. - name: Stop Bazel if: always() run: bazel shutdown diff --git a/BUILD.bazel b/BUILD.bazel index ce9b31f..7233c6a 100644 --- a/BUILD.bazel +++ b/BUILD.bazel @@ -35,6 +35,11 @@ test_suite( ], ) +test_suite( + name = "go_tests", + tests = ["@bazel_utils_go//:go_list_patterns_test"], +) + test_suite( name = "buf_tests", tests = [ diff --git a/CHANGELOG.md b/CHANGELOG.md index 76bc767..7a41bb2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,13 +8,67 @@ patch; breaking Starlark API changes bump the minor. ## [Unreleased] +### Removed + +- Cursor rules (`.cursor/`). Maintainer notes (versioning, the 2-day + release quarantine, pin locations, Windows/ash rules, testing) are in + `CLAUDE.md`. +- **Breaking:** `bazel_utils_python` `pip_audit_test`; use `uv_audit_test`. + The module no longer ships pip-audit, its `uv.lock`, `pyproject.toml`, the + `bazel_utils_pypi` hub, or a Python toolchain, so no Python interpreter is + downloaded and Windows needs no bash for it. + ### Added +- `bazel_utils_python`: `uv_audit_test` runs `uv audit --frozen` on the + consumer `uv.lock` (all groups and extras, OSV) with the pinned prebuilt + uv. `flags` are `uv audit` flags (`--ignore`, `--no-dev`, `--no-group`, …) + and the binary override is `uv`. `uv audit` is a uv preview feature; the + wrapper opts in with `--preview-features audit-command`. - `bazel_utils_protoc`: `protoc-gen-protovalidate-buffa` catalog version v0.10.2 (optional and oneof strings get the plain-string format and length rules, `IGNORE_IF_ZERO_VALUE` covers field CEL and predefined rules, custom rule paths keep the extension's package and messages) for linux, darwin, and windows on amd64 and arm64. +- `protoc-gen-buffa`, `protoc-gen-buffa-packaging`, `protoc-gen-connect-rust`: + windows-arm64 entries that use the x64 build (no aarch64 asset upstream; + Windows 11 on ARM runs it under emulation). +- CI runs on all six platforms (linux, darwin, windows on amd64 and arm64) + for pull requests and release tags. Each job builds and tests `//...` and + runs the `*_format` targets, which must leave the checkout unchanged. + Windows jobs set a missing `--shell_executable`, so any use of a host bash + fails. +- `//tests` fixtures for every public rule: `buf_deps`, `buf_module`, + `buf_generate` with all nine prebuilt plugins, `buf_plugin`, + `buf_lint_test`, `buf_format`, `golangci_test`, `govulncheck_test`, + `ruff_test`, `ruff_format`, `uv_audit_test`, `cargo_audit_test` + (buildifier and markdownlint run on the repo itself). Unit test for + `go_list_patterns`. + +### Fixed + +- `golangci_test`, `govulncheck_test`: run in the `go.mod` directory, with + `dirs` relative to it. A `go.mod` below the repo root (`//go:go.mod`) failed + with "directory prefix … does not contain main module" unless a root + `go.work` listed it. +- Windows: no host bash. `bazel_utils_core` downloads busybox-w32 + FRP-6075 (amd64, arm64). `*_test` and `*_format` rules (buildifier, buf + lint/format, golangci-lint, govulncheck, ruff, uv audit, cargo-audit, + markdownlint) return a `.bat` launcher that runs the wrapper with + `busybox sh` (Bazel on Windows does not run a `.bash` file), and + `buf_module` / `buf_generate` run their scripts with it instead of + `run_shell`. Wrapper scripts are ash-compatible (`;` PATH on Windows, + workspace search stops at `C:/`). `bazel_utils_core` now depends on + `bazel_lib` (batch runfiles lookup). +- Windows: prebuilt binaries (buf, protoc plugins, ruff, golangci-lint, + cargo-audit) have a `.exe` output instead of `.bin`, so `bazel run` works + and `buf_generate` puts `.exe` plugins on PATH. `buf_plugin` keeps the + wrapped binary's extension. +- `protoc.plugin` no longer needs host Python. Zip releases (Windows builds of + protoc-gen-go, protoc-gen-connect-go, protoc-gen-protovalidate-buffa) are + downloaded by the repository rule and extracted at build time with the + hermetic bsdtar from `tar.bzl` 0.10.9, only for the platform in use. + Bazel 9.2's own zip reader still crashes on protobuf-go's zip comment. ### Changed @@ -28,8 +82,7 @@ patch; breaking Starlark API changes bump the minor. from 6.7.5 to 6.7.6, Node from 24.18.0 to 24.21.0, and pnpm from 11.20.0 to 12.10.1. Both are newer than the rules' catalogs, so Node's sha256s (`node_repositories`) come from nodejs.org `SHASUMS256.txt` and pnpm's - `pnpm_version_integrity` from npm. `package.json` `packageManager` from - pnpm 12.6.0 to 12.10.1. + `pnpm_version_integrity` from npm. `package.json` `packageManager` from pnpm 12.6.0 to 12.10.1. ## [0.2.14] - 2026-10-07 diff --git a/CLAUDE.md b/CLAUDE.md new file mode 100644 index 0000000..ac96d23 --- /dev/null +++ b/CLAUDE.md @@ -0,0 +1,134 @@ +# bazel_utils: notes for maintaining this repo + +Starlark helpers shipped as separate Bazel modules (`bazel/`, `buf/`, `core/`, +`go/`, `markdown/`, `protoc/`, `python/`, `rust/`). The root module is a dev +aggregator that pulls them in with `local_path_override`; consumers use +`git_override` at a release tag. `README.md` documents the public API, and +`CHANGELOG.md` records every change. + +## Principles + +- **Prebuilt binaries only.** Tools come from upstream release assets, + pinned by version and sha256. Do not build tools from source, do not commit + binaries, and do not publish our own binaries. +- **Nothing on the host.** No host bash, Python, unzip, or Go/Rust toolchain. + On Windows, scripts run with busybox-w32 (`@bazel_utils_core//:busybox`), + and zips are extracted with bsdtar from `tar.bzl`. +- **Six platforms.** linux, darwin, and windows on amd64 and arm64. A public + rule that does not work on one of them is a bug. + +## Updating a pinned tool + +1. **Quarantine: a release must be at least 2 days old.** Measure from its + publish time in UTC (`gh release view -R --json publishedAt`, + npm `time`, or the BCR commit date) against `date -u`. If it is younger, + pin the newest release that is older and say when the newer one clears. +2. Check the publisher (`--json author`) against earlier releases. A change + needs an explanation before the pin is used. +3. Take the sha256 from the upstream checksum file (`sha256.sum`, + `checksums.txt`, `SHA256SUMS`, `*.sha256`). Download every asset you pin + and check it against that file. +4. Update the pin, README (the plugin tables' "Catalog versions" column lists + every catalog version, not only the pin), and CHANGELOG. +5. Rebuild the lockfile and run the checks under "Testing". + +Where pins live: + +| Tool | File | +| -------------- | ------------------------------------------------------------------------------ | +| Buf CLI | `buf/registry.bzl` (+ fallback in `buf/MODULE.bazel`) | +| protoc plugins | `protoc/plugins//registry.bzl` (+ fallback pin in `protoc/MODULE.bazel`) | +| buildifier | `bazel/buildifier.MODULE.bazel` | +| golangci-lint | `go/golangci.MODULE.bazel` | +| govulncheck | `go/go.mod` | +| ruff | `python/ruff.MODULE.bazel` | +| uv | `python/MODULE.bazel` (`uv_bin.toolchain`) | +| cargo-audit | `rust/cargo_audit.MODULE.bazel` | +| Node, pnpm | `markdown/MODULE.bazel` + `markdown/package.json` `packageManager` | +| busybox-w32 | `core/MODULE.bazel` | +| bazelisk (CI) | `.github/workflows/ci.yml` matrix | + +When a version is newer than a rule set's built-in catalog, pin it ourselves: +Node uses `node_repositories` with the sha256s from `SHASUMS256.txt`, pnpm uses +`pnpm_version_integrity` from npm, and uv uses `uv_bin.toolchain(sha256s=…)`. + +## Adding a protoc plugin + +- Add `protoc/plugins//registry.bzl` with all six platforms. If upstream + has no windows-arm64 build, reuse the x64 `.exe` with a comment (Windows 11 + on ARM emulates it). +- `.zip` assets are only downloaded; `protoc/plugins/unzip.bzl` extracts them + at build time. Bazel 9.2's zip reader crashes on zip comments (protobuf-go). +- Register it in `protoc/plugins/defs.bzl` and `protoc/plugins/BUILD.bazel`, + re-export it under `buf/protoc/plugins/`, and add it to the root + `//:protoc_plugins` filegroup, both README tables, and + `tests/buf/buf.gen.all.yaml` plus `//tests/buf:plugins`. + +## Shell scripts and Windows + +Wrapper scripts (`*.bash`) and `buf_module`/`buf_generate` actions run with +bash on Linux/macOS and with busybox-w32 `sh` (ash) on Windows: + +- Test/run rules get the executable from `launcher()` and attrs from + `LAUNCHER_ATTRS` (`core/internal/launcher.bzl`); on Windows that is a `.bat` + that runs the script. Shell actions use `run_shell_action()` with + `SHELL_ACTION_ATTRS`, never `ctx.actions.run_shell`. +- Native binaries need a `.exe` output on Windows: `native_binary(out = select( + {"@bazel_utils_core//:windows": "x.exe", "//conditions:default": "x.bin"}))`. +- Keep scripts ash-compatible: + - ash expands **both** sides of `[[ A && B ]]` before testing, so guard + every variable with `${VAR:-}` under `set -u`; + - the PATH separator is `$_PATHSEP` (`;` when `uname -s` is `Windows_NT`); + - a loop that walks up with `dirname` must stop when the parent equals the + path (`C:/`), not only at `/`; + - no `cygpath` or MSYS assumptions. +- Check ash compatibility locally with `busybox sh