[EXP] Bazel 8 support

Update protobuf to v29 – see https://protobuf.dev/news/v29/

- Remove incompatible flag overrides that are now on-by-default in Bazel

.bazelrc

@@ -13,9 +13,7 @@ build --test_timeout=1,15,60,240
 common --noenable_bzlmod
 
 # bazel7 enables Build without the Bytes (BwoB) by default. This significantly speeds up builds
-# using the remote cache since less data needs to be fetched. Set remote_cache_eviction_retries
-# which is required to fully support a "dumb" cache. Bazel 8 already sets this value by default.
-build --experimental_remote_cache_eviction_retries=5
+# using the remote cache since less data needs to be fetched.
 # Note that we use remote_download_minimal for test builds, which avoids fetching build outputs
 # where possible. While several previous BwoB bugs have been fixed, this is slower than it could be
 # due to https://github.com/bazelbuild/bazel/issues/20576.
@@ -32,12 +30,6 @@ import %workspace%/build/lint.bazelrc
 # Enable webgpu
 build --//src/workerd/io:enable_experimental_webgpu=True
 
-# Avoid generating duplicate runfile trees. This will become the default in a future bazel version.
-build --nolegacy_external_runfiles
-
-# Flip this early to avoid breaking compatibility once it becomes the default.
-build --incompatible_disallow_empty_glob
-
 # Prevents bazel cache invalidation when switching terminals
 build --incompatible_strict_action_env
 
@@ -382,3 +374,12 @@ build:windows --cxxopt='/Zc:__cplusplus' --host_cxxopt='/Zc:__cplusplus'
 # enable clang coverage: https://clang.llvm.org/docs/SourceBasedCodeCoverage.html
 build:clang-coverage --copt="-fprofile-instr-generate" --linkopt="-fprofile-instr-generate"
 build:clang-coverage --copt="-fcoverage-mapping" --linkopt="-fcoverage-mapping"
+
+build --enable_workspace
+# As part of starlarkification, Bazel 8 removes a number of rules which now need to be imported from
+# other repositories. In the long term, load() statements will be needed to import these rules. For
+# now, we can still autoload the affected repositories when needed. Do this only for a few
+# handpicked rules_python rules_shell, and protobuf components instead of the larger default
+# autoload set – some dependencies aren't importing the required shell rules yet, but we don't want
+# to accidentally rely on autoloading more dependencies.
+build --incompatible_autoload_externally="+py_binary,+py_library,+py_test,+ProtoInfo,+sh_binary,+proto_library,+cc_proto_library"

.bazelversion

@@ -1 +1 @@
-7.4.1rc2
+8.0.0rc3

MODULE.bazel

@@ -0,0 +1 @@
+# We don't use bzlmod at this time, but bazel 8 still expects us to have a MODULE.bazel file.

WORKSPACE

@@ -13,6 +13,11 @@ deps_gen()
 
 load("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository")
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive", "http_file")
+load("@rules_shell//shell:repositories.bzl", "rules_shell_dependencies", "rules_shell_toolchains")
+
+rules_shell_dependencies()
+
+rules_shell_toolchains()
 
 NODE_VERSION = "20.14.0"
 
@@ -161,10 +166,14 @@ bind(
 # OK, now we can bring in tcmalloc itself.
 http_archive(
     name = "com_google_tcmalloc",
-    sha256 = "81f285cb337f445276f37c308cb90120f8ba4311d1be9daf3b93dccf4bfdba7d",
-    strip_prefix = "google-tcmalloc-69c409c",
+    integrity = "sha256-mTDk4ij+KU0px7Mg4NSk15L9lD6RSIWuqZ7ILTkekb8=",
+    patch_args = ["-p1"],
+    patches = [
+        "//:patches/tcmalloc/0001-Support-Bazel-8.patch",
+    ],
+    strip_prefix = "google-tcmalloc-4e8fcfc",
     type = "tgz",
-    url = "https://github.com/google/tcmalloc/tarball/69c409c344bdf894fc7aab83e2d9e280b009b2f3",
+    url = "https://github.com/google/tcmalloc/tarball/4e8fcfc697761a2659fde4ecef15ac50cbc20784",
 )
 
 # ========================================================================================
@@ -277,6 +286,8 @@ esbuild_register_toolchains(
 #
 # There is an official mirror for V8 itself on GitHub, but not for dependencies like zlib (Chromium
 # fork), icu (Chromium fork), and trace_event, so we still have to use git for them.
+# TODO: Upstream 0021-bazel-Add-missing-imports-needed-with-Bazel-8.patch (currently unused here) to
+# avoid needing to autoload py_test.
 
 http_archive(
     name = "v8",

build/deps/build_deps.jsonc

@@ -100,7 +100,10 @@
       "type": "github_release",
       "owner": "bazel-contrib",
       "repo": "bazel-lib",
-      "file_regex": "^bazel-lib-"
+      "file_regex": "^bazel-lib-",
+      "patches": [
+        "//:patches/bazel-lib/0001-Support-Bazel-8.patch"
+      ]
     },
     {
       "name": "aspect_rules_js",
@@ -111,7 +114,10 @@
       // TODO(cleanup): On latest version, Windows build fails with `tar.exe: Error opening archive:
       // Can't initialize filter; unable to run program "gzip -d"`, likely due to
       // https://github.com/aspect-build/rules_js/pull/1905/files. Develop a workaround.
-      "freeze_version": "v2.0.1"
+      "freeze_version": "v2.0.1",
+      "patches": [
+        "//:patches/rules_js/0001-Support-Bazel-8.patch"
+      ]
     },
     {
       "name": "aspect_rules_ts",
@@ -120,6 +126,20 @@
       "repo": "rules_ts",
       "file_regex": "^rules_ts-"
     },
+    {
+      "name": "rules_shell",
+      "type": "github_release",
+      "owner": "bazelbuild",
+      "repo": "rules_shell",
+      "file_regex": "^rules_shell-"
+    },
+    {
+      "name": "rules_cc",
+      "type": "github_release",
+      "owner": "bazelbuild",
+      "repo": "rules_cc",
+      "file_regex": "^rules_cc-"
+    },
     //buildifier
     {
       "name": "buildifier-linux-amd64",

build/deps/deps.jsonc

@@ -84,7 +84,8 @@
       "name": "com_google_protobuf",
       "owner": "protocolbuffers",
       "repo": "protobuf",
-      "file_regex": "protobuf-.*\\.tar\\.gz"
+      "file_regex": "protobuf-.*\\.tar\\.gz",
+      "freeze_version": "v29.0-rc3"
     }
   ]
 }

build/deps/gen/build_deps.bzl

@@ -17,9 +17,11 @@ load("@//build/deps:gen/dep_cargo_bazel_macos_arm64.bzl", "dep_cargo_bazel_macos
 load("@//build/deps:gen/dep_cargo_bazel_macos_x64.bzl", "dep_cargo_bazel_macos_x64")
 load("@//build/deps:gen/dep_cargo_bazel_win_x64.bzl", "dep_cargo_bazel_win_x64")
 load("@//build/deps:gen/dep_cxxbridge_cmd.bzl", "dep_cxxbridge_cmd")
+load("@//build/deps:gen/dep_rules_cc.bzl", "dep_rules_cc")
 load("@//build/deps:gen/dep_rules_pkg.bzl", "dep_rules_pkg")
 load("@//build/deps:gen/dep_rules_python.bzl", "dep_rules_python")
 load("@//build/deps:gen/dep_rules_rust.bzl", "dep_rules_rust")
+load("@//build/deps:gen/dep_rules_shell.bzl", "dep_rules_shell")
 
 def deps_gen():
     dep_bazel_skylib()
@@ -37,6 +39,8 @@ def deps_gen():
     dep_aspect_bazel_lib()
     dep_aspect_rules_js()
     dep_aspect_rules_ts()
+    dep_rules_shell()
+    dep_rules_cc()
     dep_buildifier_linux_amd64()
     dep_buildifier_linux_arm64()
     dep_buildifier_darwin_amd64()

build/deps/gen/dep_aspect_bazel_lib.bzl

@@ -15,4 +15,6 @@ def dep_aspect_bazel_lib():
         strip_prefix = STRIP_PREFIX,
         type = TYPE,
         sha256 = SHA256,
+        patches = ["//:patches/bazel-lib/0001-Support-Bazel-8.patch"],
+        patch_args = ["-p1"],
     )

build/deps/gen/dep_aspect_rules_js.bzl

@@ -15,4 +15,6 @@ def dep_aspect_rules_js():
         strip_prefix = STRIP_PREFIX,
         type = TYPE,
         sha256 = SHA256,
+        patches = ["//:patches/rules_js/0001-Support-Bazel-8.patch"],
+        patch_args = ["-p1"],
     )

build/deps/gen/dep_com_google_protobuf.bzl

@@ -2,10 +2,10 @@
 
 load("@//:build/http.bzl", "http_archive")
 
-TAG_NAME = "v28.3"
-URL = "https://github.com/protocolbuffers/protobuf/releases/download/v28.3/protobuf-28.3.tar.gz"
-STRIP_PREFIX = "protobuf-28.3"
-SHA256 = "7c3ebd7aaedd86fa5dc479a0fda803f602caaf78d8aff7ce83b89e1b8ae7442a"
+TAG_NAME = "v29.0-rc3"
+URL = "https://github.com/protocolbuffers/protobuf/releases/download/v29.0-rc3/protobuf-29.0-rc3.tar.gz"
+STRIP_PREFIX = "protobuf-29.0-rc3"
+SHA256 = "92571ddbab033a5c8facf71cf3c7987cbfeeea472db8bd3f92e94e8d1450c34a"
 TYPE = "tgz"
 
 def dep_com_google_protobuf():

build/deps/gen/dep_rules_cc.bzl

@@ -0,0 +1,18 @@
+# WARNING: THIS FILE IS AUTOGENERATED BY update-deps.py DO NOT EDIT
+
+load("@//:build/http.bzl", "http_archive")
+
+TAG_NAME = "0.0.17"
+URL = "https://github.com/bazelbuild/rules_cc/releases/download/0.0.17/rules_cc-0.0.17.tar.gz"
+STRIP_PREFIX = "rules_cc-0.0.17"
+SHA256 = "abc605dd850f813bb37004b77db20106a19311a96b2da1c92b789da529d28fe1"
+TYPE = "tgz"
+
+def dep_rules_cc():
+    http_archive(
+        name = "rules_cc",
+        url = URL,
+        strip_prefix = STRIP_PREFIX,
+        type = TYPE,
+        sha256 = SHA256,
+    )

build/deps/gen/dep_rules_python.bzl

@@ -2,10 +2,10 @@
 
 load("@//:build/http.bzl", "http_archive")
 
-TAG_NAME = "0.39.0"
-URL = "https://api.github.com/repos/bazelbuild/rules_python/tarball/0.39.0"
-STRIP_PREFIX = "bazelbuild-rules_python-0759322"
-SHA256 = "ed016e6308487de77075474abc5f018dcdb98e77a08eb1e6851e9ad77223663b"
+TAG_NAME = "0.40.0"
+URL = "https://api.github.com/repos/bazelbuild/rules_python/tarball/0.40.0"
+STRIP_PREFIX = "bazelbuild-rules_python-1944874"
+SHA256 = "3e8396b0741231f07e175d0e721969ea3456b4330a4daf32d1520ce427a09937"
 TYPE = "tgz"
 
 def dep_rules_python():

build/deps/gen/dep_rules_shell.bzl

@@ -0,0 +1,18 @@
+# WARNING: THIS FILE IS AUTOGENERATED BY update-deps.py DO NOT EDIT
+
+load("@//:build/http.bzl", "http_archive")
+
+TAG_NAME = "v0.3.0"
+URL = "https://github.com/bazelbuild/rules_shell/releases/download/v0.3.0/rules_shell-v0.3.0.tar.gz"
+STRIP_PREFIX = "rules_shell-0.3.0"
+SHA256 = "d8cd4a3a91fc1dc68d4c7d6b655f09def109f7186437e3f50a9b60ab436a0c53"
+TYPE = "tgz"
+
+def dep_rules_shell():
+    http_archive(
+        name = "rules_shell",
+        url = URL,
+        strip_prefix = STRIP_PREFIX,
+        type = TYPE,
+        sha256 = SHA256,
+    )

patches/bazel-lib/0001-Support-Bazel-8.patch

@@ -0,0 +1,41 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Felix Hanau <felix@cloudflare.com>
+Date: Sat, 23 Nov 2024 22:07:46 -0500
+Subject: Support Bazel 8
+
+
+diff --git a/lib/private/bats.bzl b/lib/private/bats.bzl
+index 65de719a73114c24f837446d35c7a530adb47e94..c71aef825c5d020566abd800f77ab00fa335e200 100644
+--- a/lib/private/bats.bzl
++++ b/lib/private/bats.bzl
+@@ -102,7 +102,7 @@ bats_test = rule(
+     },
+     toolchains = [
+         "@aspect_bazel_lib//lib:bats_toolchain_type",
+-        "@bazel_tools//tools/sh:toolchain_type",
++        "@rules_shell//shell:toolchain_type",
+     ],
+     test = True,
+ )
+diff --git a/lib/windows_utils.bzl b/lib/windows_utils.bzl
+index 30a81fed92d17d7eff4ddd0e96179f3001923712..f0af1fb8397f83773af8883049f093928323c668 100644
+--- a/lib/windows_utils.bzl
++++ b/lib/windows_utils.bzl
+@@ -70,7 +70,7 @@ exit /b 0
+ def create_windows_native_launcher_script(ctx, shell_script):
+     """Create a Windows Batch file to launch the given shell script.
+
+-    The rule should specify @bazel_tools//tools/sh:toolchain_type as a required toolchain.
++    The rule should specify @rules_shell//shell:toolchain_type as a required toolchain.
+
+     Args:
+         ctx: Rule context
+@@ -101,7 +101,7 @@ if defined args (
+ )
+ "{bash_bin}" -c "!run_script! !args!"
+ """.format(
+-            bash_bin = ctx.toolchains["@bazel_tools//tools/sh:toolchain_type"].path,
++            bash_bin = ctx.toolchains["@rules_shell//shell:toolchain_type"].path,
+             sh_script = paths.to_rlocation_path(ctx, shell_script),
+             rlocation_function = BATCH_RLOCATION_FUNCTION,
+         ),

patches/rules_js/0001-Support-Bazel-8.patch

@@ -0,0 +1,32 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Felix Hanau <felix@cloudflare.com>
+Date: Fri, 22 Nov 2024 19:19:24 -0500
+Subject: Support Bazel 8
+
+
+diff --git a/js/private/coverage/merger.bzl b/js/private/coverage/merger.bzl
+index b41acfa6330e0b9dfcd71e83277275601ecd8a2a..08c82e0fff27014c5552af17a5423a6e8ca8cccf 100644
+--- a/js/private/coverage/merger.bzl
++++ b/js/private/coverage/merger.bzl
+@@ -68,7 +68,7 @@ coverage_merger = rule(
+     attrs = _ATTRS,
+     executable = True,
+     toolchains = [
+-        "@bazel_tools//tools/sh:toolchain_type",
++        "@rules_shell//shell:toolchain_type",
+         "@rules_nodejs//nodejs:toolchain_type",
+     ],
+ )
+diff --git a/js/private/js_binary.bzl b/js/private/js_binary.bzl
+index 33e71d92adbd7d9a41575df815db59a1e97f33c2..72147c622ee95d8447ea4896cbf6fdb58149d3b8 100644
+--- a/js/private/js_binary.bzl
++++ b/js/private/js_binary.bzl
+@@ -614,7 +614,7 @@ js_binary_lib = struct(
+     implementation = _js_binary_impl,
+     toolchains = [
+         # TODO: on Windows this toolchain is never referenced
+-        "@bazel_tools//tools/sh:toolchain_type",
++        "@rules_shell//shell:toolchain_type",
+         "@rules_nodejs//nodejs:toolchain_type",
+     ] + COPY_FILE_TO_BIN_TOOLCHAINS,
+ )