Enable Bzlmod

All but finishes bazel-contrib#1482, save for publication of the first `rules_scala`
release to the Bazel Central Registry. Closes bazel-contrib#1625.

The module extensions and underlying helper macros comprise the most
significant part of the change. The extensions provide a thin layer
over the existing `WORKSPACE` API. The `scala/private/macros/bzlmod.bzl`
docstring explains the common pattern employed throughout.

- `scala/extensions/config.bzl`: invokes `scala_config()`
- `scala/extensions/deps.bzl`: invokes `scala_toolchains()`
- `scala/extensions/protoc.bzl`: invokes `scala_protoc_toolchains()`
- `scala/private/extensions/dev_deps.bzl`: internal testing dependencies
- `scala/private/macros/bzlmod.bzl`: module extension helper macros

Existing tests thoroughly validate `config.bzl`, `deps.bzl`,
`dev_deps.bzl`, and `protoc.bzl`. `test/shell/test_bzlmod_macros.sh`
tests the helpers from `scala/private/macros/bzlmod.bzl` using the new
test files from `scala/private/macros/test/...`.

Most of the new files are essentially boilerplate:

- Adds `MODULE.bazel` files mirroring existing `WORKSPACE`
  configurations and copies of the `protobuf` toolchainization patch to
  the main repo and every nested repo.

- Adds empty `WORKSPACE.bzlmod` files to ensure that Bzlmod won't
  evaluate the `WORKSPACE` files.

These changes update CI and the release workflow:

- Sets `--noenable_workspace` in `.bazelrc` and
  `tools/bazel.rc.buildkite`.

- Reenables the `last_green` Bazel build in `.bazelci/presubmit.yml`.

- Adds `.github/workflows/publish-to-bcr.yml` and `.bcr/*` for
  publishing to the Bazel Central Registry.
  `.github/workflows/release.yml` invokes this new workflow after
  publishing a successful release to GitHub. Based on
  aspect-build/rules_lint#498 and aspect-build/rules_lint#501.

All other changes:

- Adds `.bazelignore` to work around bazelbuild/bazel#22208.

- Adds `assert_matches` to `test/shell/test_helper.sh` for use in
  `test/shell/test_bzlmod_macros.sh`.

- `test/shell/test_bzlmod_macros.sh` introduces a mechanism for
  automatically finding and skipping tests, documented in the comment at
  the bottom of the file.

- Adds `bazel mod tidy` checks to `test_lint.sh` and `test_version.sh`.

- Adds `bazel clean --expunge_async` to tests that create temporary
  repos.

- Adds the `test_cleanup.sh` script to reclaim disk space.

---

This change enables Bazel 7 and 8 users to migrate their `rules_scala`
dependency from `WORKSPACE` to `MODULE.bazel` whenever they're ready. It
also ensures that new changes are compatible with the `last_green` build
of Bazel, and enables publishing releases to the Bazel Central Registry.

Per the (prereleased) "Publish to BCR" workflow setup instructions
linked from `.bcr/README.md`, we need to create:

- a fork of `bazelbuild/bazel-central-registry` (which I've proactively
  referred to as `simuons/bazel-central-registry`)

- a personal access token with "workflow" and "repo" permissions, saved
  as `PUBLISH_TOKEN` in the BCR fork (under "Settings > Secrets and
  variables > Actions")

Once these items are ready, we can push a release tag to publish the
first `rules_scala` Bazel module to https://registry.bazel.build/.

At that point, we can close bazel-contrib#1482.

Author: mbland

.bazelci/presubmit.yml

@@ -29,17 +29,15 @@ tasks:
     # Install xmllint
     - sudo apt update && sudo apt install --reinstall libxml2-utils -y
     - "./test_rules_scala.sh"
-  # Switch `last_rc` to `last_green` once Bzlmod lands.
-  # https://github.com/bazelbuild/rules_scala/issues/1482
-  test_rules_scala_linux_last_rc:
-    name: "./test_rules_scala (last_rc Bazel)"
+  test_rules_scala_linux_last_green:
+    name: "./test_rules_scala (last_green Bazel)"
     platform: ubuntu2004
-    bazel: last_rc
+    bazel: last_green
     shell_commands:
     # Install xmllint
     - sudo apt update && sudo apt install --reinstall libxml2-utils -y
     - echo "build --enable_workspace" >> .bazelrc
-    - "./test_rules_scala.sh || buildkite-agent annotate --style 'warning' \"Optional build with last_rc Bazel version failed, [see here](${BUILDKITE_BUILD_URL}#${BUILDKITE_JOB_ID}) (It is not mandatory but worth checking)\""
+    - "./test_rules_scala.sh || buildkite-agent annotate --style 'warning' \"Optional build with last_green Bazel version failed, [see here](${BUILDKITE_BUILD_URL}#${BUILDKITE_JOB_ID}) (It is not mandatory but worth checking)\""
   test_rules_scala_macos:
     name: "./test_rules_scala"
     platform: macos

.bazelignore

@@ -0,0 +1,19 @@
+# Remove once the following is fixed:
+# - bazelbuild/bazel: Loading top-level targets in local_path_override modules
+#   in child directory breaks the build #22208
+#   https://github.com/bazelbuild/bazel/issues/22208
+dt_patches/compiler_sources
+dt_patches/test_dt_patches
+dt_patches/test_dt_patches_user_srcjar
+examples/crossbuild
+examples/overridden_artifacts
+examples/scala3
+examples/semanticdb
+examples/testing/multi_frameworks_toolchain
+examples/testing/scalatest_repositories
+examples/testing/specs2_junit_repositories
+test/proto_cross_repo_boundary/repo
+test_cross_build
+third_party/test/example_external_workspace
+third_party/test/new_local_repo
+third_party/test/proto

.bazelrc

@@ -1,8 +1,7 @@
-# Switch to --noenable_workspace when Bzlmod lands.
-# https://github.com/bazelbuild/rules_scala/issues/1482
-common --enable_workspace --noenable_bzlmod
+# Remove once Bazel 8 becomes the minimum supported version.
+common --noenable_workspace --incompatible_use_plus_in_repo_names
 
-# Remove once proto toolchainization becomes the default
+# Remove if protocol compiler toolchainization ever becomes the default.
 # - https://bazel.build/reference/command-line-reference#flag--incompatible_enable_proto_toolchain_resolution
 # - https://docs.google.com/document/d/1CE6wJHNfKbUPBr7-mmk_0Yo3a4TaqcTPE0OWNuQkhPs/edit
 common --incompatible_enable_proto_toolchain_resolution

.bcr/README.md

@@ -0,0 +1,38 @@
+# Bazel Central Registry publication
+
+The [.github/workflows/publish-to-bcr.yml](
+../.github/workflows/publish-to-bcr.yml) reusable GitHub workflow uses these
+configuration files for publishing Bazel modules to the [Bazel Central Registry
+(BCR)](https://registry.bazel.build/). This workflow also produces attestations
+required by the [Supply chain Levels for Software Artifacts
+(SLSA)](https://slsa.dev/) framework for secure supply chain provenance.
+
+[bazel-contrib/publish-to-bcr](https://github.com/bazel-contrib/publish-to-bcr)
+documentation:
+
+- [Publish to BCR workflow setup (from bazel-contrib/publish-to-bcr@fb1dc68)](
+    https://github.com/bazel-contrib/publish-to-bcr/blob/fb1dc6802c3c999e17ad7afce9474a90bd89e132/README.md#setup)
+- [.bcr/ templates](
+    https://github.com/bazel-contrib/publish-to-bcr/tree/main/templates)
+- [.github/workflows/publish.yaml reusable workflow](
+    https://github.com/bazel-contrib/publish-to-bcr/blob/main/.github/workflows/publish.yaml)
+
+Related documentation:
+
+- [bazelbuild/bazel-central-registry](
+    https://github.com/bazelbuild/bazel-central-registry)
+- [GitHub Actions](https://docs.github.com/actions)
+- [slsa-framework/slsa-verifier](
+    https://github.com/slsa-framework/slsa-verifier)
+- [Security for GitHub Actions](
+    https://docs.github.com/en/actions/security-for-github-actions)
+- [Security for GitHub Actions: Using artifact attestations](
+    https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations)
+
+---
+
+Originally based on the examples from aspect-build/rules_lint#498 and
+aspect-build/rules_lint#501. See also:
+
+- bazelbuild/bazel-central-registry#4060
+- slsa-framework/slsa-verifier#840

.bcr/metadata.template.json

@@ -0,0 +1,20 @@
+{
+  "homepage": "https://github.com/bazelbuild/rules_scala",
+  "maintainers": [
+    {
+      "name": "Simonas Pinevičius",
+      "email": "[email protected]",
+      "github": "simuons"
+    },
+    {
+      "name": "Vaidas Pilkauskas",
+      "email": "[email protected]",
+      "github": "liucijus"
+    }
+  ],
+  "repository": [
+    "github:bazelbuild/rules_scala"
+  ],
+  "versions": [],
+  "yanked_versions": {}
+}

.bcr/presubmit.yml

@@ -0,0 +1,14 @@
+bcr_test_module:
+  module_path: "examples/crossbuild"
+  matrix:
+    platform: ["debian10", "macos", "ubuntu2004", "windows"]
+    bazel: [7.x, 8.x, rolling, last_green]
+  tasks:
+    run_tests:
+      name: "Build and test the example module"
+      platform: ${{ platform }}
+      bazel: ${{ bazel }}
+      build_targets:
+        - "//..."
+      test_targets:
+        - "//..."

.bcr/source.template.json

@@ -0,0 +1,5 @@
+{
+  "integrity": "",
+  "strip_prefix": "{REPO}-{VERSION}",
+  "url": "https://github.com/{OWNER}/{REPO}/releases/download/{TAG}/{REPO}-{TAG}.tar.gz"
+}

.github/workflows/publish-to-bcr.yml

@@ -0,0 +1,31 @@
+# Publishes to the Bazel Central Registry. See .bcr/README.md.
+name: Publish to the Bazel Central Registry
+
+on:
+  # Run from release.yml.
+  workflow_call:
+    inputs:
+      tag_name:
+        required: true
+        type: string
+  # In case of problems, enable manual dispatch from the GitHub UI.
+  workflow_dispatch:
+    inputs:
+      tag_name:
+        required: true
+        type: string
+
+jobs:
+  publish-to-bcr:
+    uses: bazel-contrib/publish-to-bcr/.github/workflows/[email protected]
+    with:
+      tag_name: ${{ inputs.tag_name }}
+      # bazelbuild/bazel-central-registry fork used to open a pull request.
+      registry_fork: simuons/bazel-central-registry
+    permissions:
+      attestations: write
+      contents: write
+      id-token: write
+    secrets:
+      # Necessary to push to the BCR fork and open a pull request.
+      publish_token: ${{ secrets.PUBLISH_TOKEN }}

.github/workflows/release.yml

@@ -8,14 +8,14 @@ on:
       - 'v*.*.*'
 
 jobs:
-  build:
+  release:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v3
 
       - name: Prepare workspace snippet
-        run: .github/workflows/workspace_snippet.sh ${{ env.GITHUB_REF_NAME }} > release_notes.txt
+        run: .github/workflows/workspace_snippet.sh ${{ github.ref_name }} > release_notes.txt
 
       - name: Release
         uses: softprops/action-gh-release@v1
@@ -25,3 +25,11 @@ jobs:
           body_path: release_notes.txt
           fail_on_unmatched_files: true
           files: rules_scala-*.tar.gz
+
+  publish-to-bcr:
+    needs: release
+    uses: ./.github/workflows/publish-to-bcr.yml
+    with:
+      tag_name: ${{ github.ref_name }}
+    permissions:
+      contents: write # allow appending new attestation files to the release

.github/workflows/workspace_snippet.sh

@@ -4,13 +4,23 @@ set -o errexit -o nounset -o pipefail
 
 # Set by GH actions, see
 # https://docs.github.com/en/actions/learn-github-actions/environment-variables#default-environment-variables
-TAG=${GITHUB_REF_NAME}
-PREFIX="rules_scala-${TAG:1}"
+TAG="${GITHUB_REF_NAME}"
+VERSION="${TAG:1}"
+PREFIX="rules_scala-${VERSION}"
 ARCHIVE="rules_scala-$TAG.tar.gz"
 git archive --format=tar --prefix=${PREFIX}/ ${TAG} | gzip > $ARCHIVE
 SHA=$(shasum -a 256 $ARCHIVE | awk '{print $1}')
 
 cat << EOF
+## Using Bzlmod
+
+Paste this snippet into your \`MODULE.bazel\` file:
+
+\`\`\`starlark
+# Set \`repo_name = "io_bazel_rules_scala"\` if you still need it.
+bazel_dep(name = "rules_scala", version = "${VERSION}")
+\`\`\`
+
 ## Using WORKSPACE
 
 Paste this snippet into your \`WORKSPACE\` file:

.gitignore

@@ -16,3 +16,9 @@ test/semanticdb/tempsrc
 
 # From scripts/create_repository.py
 repository-artifacts.json
+
+# Until it settles down
+**/MODULE.bazel.lock
+
+# Used by some tests, but can also be used for local experimentation.
+tmp/