Adopt bzlmod to build the repository

.aspect/bazelrc/bazel7.bazelrc

@@ -1,8 +1,12 @@
 # Speed up all builds by not checking if external repository files have been modified.
 # Docs: https://github.com/bazelbuild/bazel/blob/1af61b21df99edc2fc66939cdf14449c2661f873/src/main/java/com/google/devtools/build/lib/bazel/repository/RepositoryOptions.java#L244
-build --noexperimental_check_external_repository_files
-fetch --noexperimental_check_external_repository_files
-query --noexperimental_check_external_repository_files
+common --noexperimental_check_external_repository_files
+
+# Don't report when the root module's lower bound for a dependency happens to be less than the resolved version.
+# This is expected and should NOT prompt an engineer to update our lower bound to match.
+# WARNING: For repository 'aspect_bazel_lib', the root module requires module version aspect_bazel_lib@1.30.2,
+# but got aspect_bazel_lib@1.31.2 in the resolved dependency graph.
+common --check_direct_dependencies=off
 
 # Directories used by sandboxed non-worker execution may be reused to avoid unnecessary setup costs.
 # Save time on Sandbox creation and deletion when many of the same kind of action run during the

.aspect/bazelrc/convenience.bazelrc

@@ -3,7 +3,7 @@
 build --keep_going
 
 # Output test errors to stderr so users don't have to `cat` or open test failure log files when test
-# fail. This makes the log noiser in exchange for reducing the time-to-feedback on test failures for
+# fail. This makes the log noisier in exchange for reducing the time-to-feedback on test failures for
 # users.
 # Docs: https://bazel.build/docs/user-manual#test-output
 test --test_output=errors

.aspect/bazelrc/correctness.bazelrc

@@ -68,7 +68,7 @@ build --incompatible_default_to_explicit_init_py
 common --incompatible_disallow_empty_glob
 
 # Always download coverage files for tests from the remote cache. By default, coverage files are not
-# downloaded on test result cahce hits when --remote_download_minimal is enabled, making it impossible
+# downloaded on test result cache hits when --remote_download_minimal is enabled, making it impossible
 # to generate a full coverage report.
 # Docs: https://bazel.build/reference/command-line-reference#flag--experimental_fetch_all_coverage_outputs
 # detching remote cache results

.bazelrc

@@ -1,13 +1,15 @@
 # Import Aspect bazelrc presets
-try-import %workspace%/.aspect/bazelrc/local/bazel7.bazelrc # will only work in bazel7+
+try-import %workspace%/.aspect/bazelrc/bazel7.bazelrc # will only work in bazel7+
 import %workspace%/.aspect/bazelrc/bazel6.bazelrc # will only work in bazel6+
 import %workspace%/.aspect/bazelrc/convenience.bazelrc
 import %workspace%/.aspect/bazelrc/correctness.bazelrc
 import %workspace%/.aspect/bazelrc/debug.bazelrc
 import %workspace%/.aspect/bazelrc/performance.bazelrc
 
 # Specific project flags go here if we have some
+common --incompatible_enable_proto_toolchain_resolution
 
+# inside the rules project we build from source
 common --extra_toolchains=//cmd:bazeldnf-host-toolchain
 
 # Load any settings & overrides specific to the current user from `.bazelrc.user`.

.bazelversion

@@ -1 +1 @@
-6.5.0
+7.x

.gitattributes

@@ -0,0 +1,11 @@
+docs/*.md linguist-generated=true
+
+# Configuration for 'git archive'
+# see https://git-scm.com/docs/git-archive/2.40.0#ATTRIBUTES
+# Exclude a bunch of paths to save some disk space
+e2e export-ignore
+.aspect export-ignore
+.github export-ignore
+pkg/*/testdata export-ignore
+tools/release export-ignore
+

.github/workflows/action.yml

@@ -45,8 +45,8 @@ jobs:
               import %workspace%/../../.aspect/bazelrc/bazel6.bazelrc
           - version: 7.x
             bazelrc: |
-              import %workspace%/../../.aspect/bazelrc/bazel6.bazelrc
               import %workspace%/../../.aspect/bazelrc/bazel7.bazelrc
+              import %workspace%/../../.aspect/bazelrc/bazel6.bazelrc
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
@@ -64,3 +64,55 @@ jobs:
           import %workspace%/../../.github/workflows/ci.bazelrc
           ${{ matrix.version.bazelrc }}
     - run: cd e2e/bazel-workspace && USE_BAZEL_VERSION=${{ matrix.version.version }} bazelisk build //...
+
+  e2e-bzlmod-matrix:
+    strategy:
+      matrix:
+        version: [6.x, 7.x]
+        path:
+          - bazel-bzlmod
+          - bazel-bzlmod-non-legacy-mode
+          - bazel-bzlmod-lock-file
+
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - uses: bazel-contrib/setup-bazel@0.8.5
+      with:
+        # Avoid downloading Bazel every time.
+        bazelisk-cache: true
+        # Keep a disk-cache
+        disk-cache: true
+        # Share repository cache between workflows.
+        repository-cache: true
+        # enable some flags for CI
+        bazelrc: |
+          import %workspace%/../../.aspect/bazelrc/ci.bazelrc
+          import %workspace%/../../.github/workflows/ci.bazelrc
+    - run: cd e2e/${{ matrix.path }} && USE_BAZEL_VERSION=${{ matrix.version }} bazelisk build //...
+
+  e2e-bzlmod-build-toolchain-matrix:
+    strategy:
+      matrix:
+        config:
+          - version: 6.x
+            flags:
+          - version: 7.x
+            flags: --incompatible_enable_proto_toolchain_resolution
+
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - uses: bazel-contrib/setup-bazel@0.8.5
+      with:
+        # Avoid downloading Bazel every time.
+        bazelisk-cache: true
+        # Keep a disk-cache
+        disk-cache: true
+        # Share repository cache between workflows.
+        repository-cache: true
+        # enable some flags for CI
+        bazelrc: |
+          import %workspace%/../../.aspect/bazelrc/ci.bazelrc
+          import %workspace%/../../.github/workflows/ci.bazelrc
+    - run: cd e2e/bazel-bzlmod-toolchain-from-source && USE_BAZEL_VERSION=${{ matrix.config.version }} bazelisk build //... ${{ matrix.config.flags }}

.github/workflows/build_assets.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+
+set -o errexit -o nounset -o pipefail
+set -x
+
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+
+${SCRIPT_DIR}/generate_tools_versions.sh
+
+bazel run //tools/release

.github/workflows/generate_tools_versions.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+
+set -o errexit -o nounset -o pipefail
+set -x
+
+# Set by GH actions, see
+# https://docs.github.com/en/actions/learn-github-actions/environment-variables#default-environment-variables
+REPO_URL="${GITHUB_REPOSITORY:-rmohr/bazeldnf}"
+OUT=${PREFIX:-.}/tools/version.bzl
+cat > ${OUT} <<EOF
+"Generated during release generate_tools_prebuilts.sh"
+
+VERSION = "${GITHUB_REF_NAME}"
+
+REPO_URL = "${REPO_URL}"
+EOF

.github/workflows/integrity.jq

@@ -0,0 +1,19 @@
+# JQ filter to transform sha256 files to a value we can read from starlark.
+# NB: the sha256 files are expected to be newline-terminated.
+#
+# Input looks like
+# 48552e399a1f2ab97e62ca7fce5783b6214e284330c7555383f43acf82446636 bazeldnf-v0.6.0-rc7-linux-amd64\n...
+#
+# Output should look like
+# {
+#  "linux-amd64": "48552e399a1f2ab97e62ca7fce5783b6214e284330c7555383f43acf82446636",
+#  ...
+# }
+
+.
+| sub($ARGS.named.PREFIX; ""; "g")
+| rtrimstr("\n")
+| split("\n")
+| map(split(" "))
+| map({"key": .[1], "value": .[0]})
+| from_entries

.github/workflows/release.yml

@@ -1,41 +1,49 @@
-
-name: release
-
-# This workflow can be manually triggered to create a GitHub release and upload release bins.
-#
-# Steps to use:
-# - Create a new Git tag and push
-# - Navigate to https://github.com/rmohr/bazeldnf/actions/workflows/release.yml
-# - Click on "Run workflow"
-# - Select the tag you want to release
-# - Click on green button
-#
-# Requires read-write workflow permissions which can be configured in Actions repo settings.
+# Cut a release whenever a new tag is pushed to the repo.
+# You should use an annotated tag, like `git tag -a v1.2.3`
+# and put the release notes into the commit message for the tag.
+name: Release
 
 on:
-  workflow_dispatch:
-    inputs:
-      release_version:
-        description: 'Bazeldnf release version (e.g. v1.2.3)'
-        required: true
+  push:
+    tags:
+      - "v*.*.*"
 
 jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build Binaries
+        run: .github/workflows/build_assets.sh
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: artifacts
+          path: tools/release/latest
+          retention-days: 1
+
   release:
+    needs: build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - uses: bazelbuild/setup-bazelisk@v1
-      - run: |
-          git config --global user.name "CI"
-          git config --global user.email "rmohr@users.noreply.github.com"
-          hack/prepare-release.sh
-          git push origin ${VERSION}
-          git push
-        env:
-          VERSION: ${{ inputs.release_version }}
-      - uses: softprops/action-gh-release@v1
+      - uses: actions/checkout@v4
+
+      # Fetch the built artifacts from build jobs above and extract into
+      # ${GITHUB_WORKSPACE}/artifacts/bazeldnf_dawrin-amd64
+      - uses: actions/download-artifact@v4
+
+      - name: Prepare release
+        run: .github/workflows/release_prep.sh > release_notes.txt
+
+      - name: Release
+        uses: softprops/action-gh-release@v1
         with:
-          body_path: dist/releasenote.txt
-          tag_name: ${{ inputs.release_version }}
+          prerelease: true
+          # Use GH feature to populate the changelog automatically
+          generate_release_notes: true
+          body_path: release_notes.txt
           files: |
-            dist/bazeldnf-*
+            artifacts/*
+            bazeldnf-*.tar.gz
+          fail_on_unmatched_files: true

.github/workflows/release_prep.sh

@@ -0,0 +1,90 @@
+#!/usr/bin/env bash
+
+set -o errexit -o nounset -o pipefail
+set -x
+
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+
+# Set by GH actions, see
+# https://docs.github.com/en/actions/learn-github-actions/environment-variables#default-environment-variables
+
+# The prefix is chosen to match what GitHub generates for source archives
+PREFIX="bazeldnf-${GITHUB_REF_NAME}"
+ARCHIVE="bazeldnf-${GITHUB_REF_NAME}.tar.gz"
+ARCHIVE_TMP=$(mktemp)
+
+# NB: configuration for 'git archive' is in /.gitattributes
+git archive --format=tar --prefix=${PREFIX}/ --worktree-attributes  ${GITHUB_REF_NAME} > $ARCHIVE_TMP
+
+############
+# Patch up the archive to have integrity hashes for built binaries that we downloaded in the GHA workflow.
+# Now that we've run `git archive` we are free to pollute the working directory.
+
+# Delete the placeholder files
+tar --file $ARCHIVE_TMP --delete ${PREFIX}/tools/version.bzl
+tar --file $ARCHIVE_TMP --delete ${PREFIX}/tools/integrity.bzl
+
+mkdir -p ${PREFIX}/tools
+
+PREFIX=$PREFIX ${SCRIPT_DIR}/generate_tools_versions.sh
+
+INTEGRITY=$(jq \
+  --from-file .github/workflows/integrity.jq \
+  --arg PREFIX "bazeldnf-${GITHUB_REF_NAME}-" \
+  --slurp \
+  --raw-input artifacts/*.sha256 \
+)
+
+cat >${PREFIX}/tools/integrity.bzl <<EOF
+"Generated during release by release_prep.sh, using integrity.jq"
+
+INTEGRITY = ${INTEGRITY}
+
+EOF
+
+# Append that generated files back into the archive
+tar --file $ARCHIVE_TMP --append ${PREFIX}/tools/version.bzl
+tar --file $ARCHIVE_TMP --append ${PREFIX}/tools/integrity.bzl
+
+# END patch up the archive
+############
+
+gzip < $ARCHIVE_TMP > $ARCHIVE
+SHA=$(shasum -a 256 $ARCHIVE | awk '{print $1}')
+
+# Set by GH actions, see
+# https://docs.github.com/en/actions/learn-github-actions/environment-variables#default-environment-variables
+REPO_URL="${GITHUB_REPOSITORY:-rmohr/bazeldnf}"
+
+cat << EOF
+## Using [Bzlmod] with Bazel 6:
+
+Add to your \`MODULE.bazel\` file:
+
+\`\`\`starlark
+bazel_dep(name = "bazeldnf", version = "${GITHUB_REF_NAME:1}")
+\`\`\`
+
+This will register a prebuilt bazeldnf
+
+[Bzlmod]: https://bazel.build/build/bzlmod
+
+## Using WORKSPACE
+
+\`\`\`starlark
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+http_archive(
+    name = "bazeldnf",
+    sha256 = "${SHA}",
+    strip_prefix = "${PREFIX}",
+    url = "https://github.com/${REPO_URL}/releases/download/${GITHUB_REF_NAME}/${ARCHIVE}",
+)
+
+load(
+    "@bazeldnf//bazeldnf:repositories.bzl",
+    "bazeldnf_dependencies",
+)
+
+bazeldnf_dependencies()
+\`\`\`
+EOF

.gitignore

@@ -7,5 +7,12 @@ dist
 cmd/cmd
 .bazelrc.user
 
+# release artifacts
+artifacts
+bazeldnf-v*
+
 # temporary files from MODULE.bazel
 MODULE.bazel.lock
+
+# this is where we store the release artifacts, so we can ignore it
+tools/release/latest