.bazelrc

@@ -7,5 +7,14 @@ build --incompatible_strict_action_env
 # Prevent symlink forest under `.runfiles/wsname/external/repo`
 build --nolegacy_external_runfiles
 
+# Avoid building all targets when testing
+test --build_tests_only
+
+# Print relative paths where possible to reduce noise
+common --attempt_to_print_relative_paths
+
+# Enable hermetic `rules_python`
+common --@rules_python//python/config_settings:bootstrap_impl=script
+
 # User-specific .bazelrc
 try-import %workspace%/.bazelrc.user

.bazelrc.ci

@@ -22,9 +22,6 @@ common --attempt_to_print_relative_paths
 # Output as much information in the CI log about failures as possible
 build --verbose_failures
 
-# Avoid building all targets when testing
-test --build_tests_only
-
 # Noisy logs but allows debugging CI run failures
 test --test_output=errors
 

.bazelversion

-7.0.0rc3
-# TODO: this is broken in 7.0.0rc4 and 7.0.0, see https://github.com/bazel-contrib/rules_oci/issues/425
+7.2.0

CHANGELOG.md

+# [1.0.0-beta.4](https://git.gitlab.arm.com/ci/component/bazelisk/compare/v1.0.0-beta.3...v1.0.0-beta.4) (2024-08-13)
+
+### Bug Fixes
+
+- **nope:** spelling mistake correction ([e03a9c2](https://git.gitlab.arm.com/ci/component/bazelisk/commit/e03a9c25ad991e8441996c0af050d00deea61535))
+- only cache the Bazelisk downloads ([e17c630](https://git.gitlab.arm.com/ci/component/bazelisk/commit/e17c63099638718ba2981e60db9baa8754dce376))
+- **python:** restrict rule visibility ([704b573](https://git.gitlab.arm.com/ci/component/bazelisk/commit/704b573e867e4813b0294b5f4bbfe980dc88a8c0))
+- upgrade to `rules_oci@2.0.0-beta1` ([a909ef9](https://git.gitlab.arm.com/ci/component/bazelisk/commit/a909ef9d0302ceb45fd14696cafb4737e1a92062))
+
 # [1.0.0-beta.3](https://git.gitlab.arm.com/ci/component/bazelisk/compare/v1.0.0-beta.2...v1.0.0-beta.3) (2024-02-26)
 
 ### Bug Fixes

MODULE.bazel

 module(
     name = "bazelisk",
-    version = "1.0.0-beta.3",
+    version = "1.0.0-beta.4",
     bazel_compatibility = [
         ">=7.0.0",
     ],
 )
 
-bazel_dep(name = "bazel_skylib", version = "1.5.0")
-bazel_dep(name = "aspect_bazel_lib", version = "2.4.1")
-bazel_dep(name = "platforms", version = "0.0.8")
-bazel_dep(name = "rules_oci", version = "1.7.2")
-bazel_dep(name = "rules_pkg", version = "0.10.1")
-bazel_dep(name = "container_structure_test", version = "1.16.0")
-bazel_dep(name = "download_utils", version = "1.0.0-beta.1")
-bazel_dep(name = "rules_python", version = "0.31.0")
+bazel_dep(name = "aspect_bazel_lib", version = "2.7.9")
+bazel_dep(name = "bazel_skylib", version = "1.7.1")
+bazel_dep(name = "platforms", version = "0.0.10")
+bazel_dep(name = "rules_oci", version = "2.0.0-beta1")
+bazel_dep(name = "rules_pkg", version = "1.0.1")
+bazel_dep(name = "container_structure_test", version = "1.19.1")
+bazel_dep(name = "download_utils", version = "1.0.0-beta.2")
+bazel_dep(name = "rules_python", version = "0.34.0")
 
-python = use_extension("@rules_python//python/extensions:python.bzl", "python")
-python.toolchain(
+# We have to avoid the `chmod`/`chown`/`id` unhermetic-ness
+# TODO: remove this when `ignore_root_user_error` is hermetic
+# https://github.com/bazelbuild/rules_python/issues/2016
+dev = use_extension("@rules_python//python/extensions:python.bzl", "python", dev_dependency = True)
+dev.toolchain(
     configure_coverage_tool = True,
+    # TODO: change the code to use Python for `chmod`/`id`
     ignore_root_user_error = True,
-    python_version = "3.9",
+    python_version = "3.11",
 )
-use_repo(python, python = "python_3_9")
-
-register_toolchains("//python:all")
 
 oci = use_extension("@rules_oci//oci:extensions.bzl", "oci")
 oci.pull(
     name = "distroless",
-    digest = "sha256:2102ce121ff1448316b93c5f347118a8e604f5ba7ec9dd7a5c2d8b0eac2941fe",
+    digest = "sha256:1aae189e3baecbb4044c648d356ddb75025b2ba8d14cdc9c2a19ba784c90bfb9",
     image = "gcr.io/distroless/base-debian12",
     platforms = [
         "linux/amd64",
@@ -41,7 +42,7 @@ oci.pull(
         "linux/s390x",
     ],
 )
-use_repo(oci, "distroless")
+use_repo(oci, "distroless", "distroless_linux_386", "distroless_linux_amd64", "distroless_linux_arm64_v8", "distroless_linux_arm_v5", "distroless_linux_arm_v7", "distroless_linux_mips64le", "distroless_linux_ppc64le", "distroless_linux_s390x")
 
 download_file = use_repo_rule("@download_utils//download/file:defs.bzl", "download_file")
 

bazelisk/BUILD.bazel

 load("@container_structure_test//:defs.bzl", "container_structure_test")
-load("@rules_oci//oci:defs.bzl", "oci_image", "oci_tarball")
-load("@rules_oci//examples/multi_arch:transition.bzl", "multi_arch")
+load("@rules_oci//oci:defs.bzl", "oci_image", "oci_load")
+load(":transition.bzl", "multi_arch")
 
 oci_image(
     name = "image",
@@ -47,12 +47,18 @@ multi_arch(
     visibility = ["//visibility:public"],
 )
 
-oci_tarball(
-    name = "tar",
+oci_load(
+    name = "load",
     image = ":image",
     repo_tags = ["bazelisk:latest"],
 )
 
+filegroup(
+    name = "tar",
+    srcs = [":load"],
+    output_group = "tarball",
+)
+
 container_structure_test(
     name = "bazelisk",
     size = "small",

bazelisk/coreutils/nope/nope.sh

@@ -4,7 +4,7 @@ set -eu
 cat <<EOF >&2
 ${0} ${*}
 
-Resolve \`${0##*/}\` heremetically rather than using this local stub.
+Resolve \`${0##*/}\` hermetically rather than using this local stub.
 
 The \`bazelisk\` container provides stubs for common Unix facilities such as
 \`${0##*/}\` that fail by default.

bazelisk/transition.bzl

+visibility("//bazelisk")
+
+def _multiarch_transition(settings, attr):
+    return [
+        {"//command_line_option:platforms": str(platform)}
+        for platform in attr.platforms
+    ]
+
+multiarch_transition = transition(
+    implementation = _multiarch_transition,
+    inputs = [],
+    outputs = ["//command_line_option:platforms"],
+)
+
+def _impl(ctx):
+    return DefaultInfo(files = depset(ctx.files.image))
+
+multi_arch = rule(
+    implementation = _impl,
+    attrs = {
+        "image": attr.label(cfg = multiarch_transition),
+        "platforms": attr.label_list(),
+        "_allowlist_function_transition": attr.label(
+            default = "@bazel_tools//tools/allowlists/function_transition_allowlist",
+        ),
+    },
+)

python/BUILD.bazel

-load("@rules_python//python:defs.bzl", "py_runtime_pair")
-load("//python/runtime:rule.bzl", py_runtime = "runtime")
-
-py_runtime(
-    name = "runtime",
-    files = ["@python//:files"],
-    interpreter = "@python//:python3",
-)
-
-py_runtime_pair(
-    name = "info",
-    py3_runtime = ":runtime",
-)
-
-toolchain(
-    name = "toolchain",
-    toolchain = ":info",
-    toolchain_type = "@rules_python//python:toolchain_type",
-)

python/runtime/rule.bzl

-ATTRS = {
-    "interpreter": attr.label(
-        doc = "The Python interpreter.",
-        allow_single_file = True,
-        executable = True,
-        cfg = "exec",
-    ),
-    "python_version": attr.string(
-        doc = "Whether this runtime is for Python major version 2 or 3. Valid values are `PY2` and `PY3`.",
-        default = "PY3",
-        values = ["PY2", "PY3"],
-    ),
-    "files": attr.label_list(
-        doc = "The set of files comprising this runtime. These files will be added to the runfiles of Python binaries that use this runtime.",
-    ),
-    "stub_shebang": attr.string(
-        doc = "The hashbang for the bootstrap template",
-        default = '''#!/usr/bin/env sh
-"""set" -eu
-"$0.runfiles/{interpreter}" "$0" "$@"
-exit
-"""
-''',
-    ),
-    "bootstrap_template": attr.label(
-        doc = "The bootstrapping template for creating Python binaries.",
-        default = "@bazel_tools//tools/python:python_bootstrap_template.txt",
-        allow_single_file = True,
-    ),
-}
-
-def implementation(ctx):
-    # `rules_python` needs a Python interpreter to launch Python
-    # This hashbang:
-    #   - Overrides to launch the POSIX shell
-    #   - POSIX shell ignores the first triplet quote
-    #   - Uses the script path to find the interpreter in the runfiles
-    #   - Launches the same script within the Python interpreter
-    #   - Python ignores the shell script because it is in a triplet quote
-    #   - The POSIX shell then exits before reading the rest of the Python code
-    hashbang = ctx.attr.stub_shebang.format(interpreter = ctx.file.interpreter.path.removeprefix("external"))
-
-    return PyRuntimeInfo(
-        interpreter = ctx.file.interpreter,
-        python_version = ctx.attr.python_version,
-        stub_shebang = hashbang,
-        bootstrap_template = ctx.file.bootstrap_template,
-        files = depset(transitive = [t.files for t in ctx.attr.files]),
-    )
-
-runtime = rule(
-    doc = "Creates a hermetic Python runtime.",
-    implementation = implementation,
-    attrs = ATTRS,
-    provides = [
-        PyRuntimeInfo,
-    ],
-)

templates/bazelisk.yml

@@ -3,7 +3,7 @@ spec:
     image:
       default: registry.gitlab.arm.com/ci/component/bazelisk
     tag:
-      default: 1.0.0-beta.3
+      default: 1.0.0-beta.4
     stage:
       default: test
     src:
@@ -71,7 +71,7 @@ spec:
   cache:
     key: "$[[inputs.key]]"
     paths:
-      - ".cache"
+      - ".cache/bazelisk"
     when: always
   before_script:
     - !reference [.bazelisk-fragment, rc]