refactor: consume tools from source if unstamped (#543)

.bazelrc

@@ -19,11 +19,10 @@ build --embed_label=v1.2.3
 # Mock versioning command to test the --stamp behavior
 build --workspace_status_command="echo BUILD_SCM_VERSION 1.2.3"
 
-# For testing always use toolchains from source
-build --@aspect_bazel_lib//tools:use_source_toolchains
-build --extra_toolchains=//tools:all
-
 # For releasing, use --workspace_status_command and stamp
+# before adding more flags to the release config make sure it does not
+# affect the hashes of /tools. See tools/release.bzl for opt transition
+# add appropriate commandline transition there to match the configuration.
 common:release --workspace_status_command "${PWD}/workspace_status.sh"
 common:release -c opt
 common:release --stamp

.github/workflows/ci.yaml

@@ -173,6 +173,10 @@ jobs:
         if: matrix.bzlmodEnabled
         run: echo "bzlmod_flag=--enable_bzlmod" >> $GITHUB_OUTPUT
 
+      - name: Make dev dependencies available (bzlmod)
+        if: matrix.bzlmodEnabled
+        run: sed -i 's/dev_dependency = True/dev_dependency = False/g' MODULE.bazel
+
       - name: Write rbe credentials
         if: ${{ matrix.config == 'rbe' }}
         working-directory: ${{ matrix.folder }}

.github/workflows/release.yml

@@ -22,16 +22,12 @@ jobs:
             ~/.cache/bazel-repo
           key: bazel-cache-${{ hashFiles('**/BUILD.bazel', '**/*.bzl', 'WORKSPACE') }}
           restore-keys: bazel-cache-
-      - name: bazel test //...
+      - name: bazel test //... (release)
         env:
           # Bazelisk will download bazel to here
           XDG_CACHE_HOME: ~/.cache/bazel-repo
-        run: bazel --bazelrc=.github/workflows/ci.bazelrc --bazelrc=.bazelrc test //...
+        # Warning: DO NOT drop --config=release as it ensures that tools/integrity.bzl is up-to-date with release config.
-      - name: Check Versions
+        run: bazel --bazelrc=.github/workflows/ci.bazelrc --bazelrc=.bazelrc test //... --config=release
-        env:
-          # Bazelisk will download bazel to here
-          XDG_CACHE_HOME: ~/.cache/bazel-repo
-        run: ./scripts/check_versions.sh ${{ env.GITHUB_REF_NAME }}
       - name: Build release artifacts
         run: |
           if [ -n "$(git status --porcelain)" ]; then

.github/workflows/release_prep.sh

@@ -7,6 +7,9 @@ set -o errexit -o nounset -o pipefail
 cat >.git/info/attributes <<EOF
 # Omit folders that users don't need, making the distribution artifact smaller
 lib/tests export-ignore
+
+# Substitution for the _VERSION_PRIVATE placeholder
+tools/version.bzl export-subst
 EOF
 
 # Set by GH actions, see

.pre-commit-config.yaml

@@ -6,8 +6,6 @@
 # but we don't want to run the other hooks on commit messages
 default_stages: [commit]
 
-default_install_hook_types: ["pre-commit", "pre-push"]
-
 repos:
   # Check formatting and lint for starlark code
   - repo: https://github.com/keith/pre-commit-buildifier
@@ -38,11 +36,3 @@ repos:
         exclude: &exclude_pattern "^(docs|e2e|lib/tests)/"
       - id: mixed-line-ending
       - id: trailing-whitespace
-
-  - repo: local
-    hooks:
-      - id: check-versions
-        name: Check Versions
-        entry: ./scripts/check_versions.sh
-        language: script
-        stages: [pre-push]

MODULE.bazel

@@ -25,7 +25,23 @@ register_toolchains(
     "@expand_template_toolchains//:all",
 )
 
+# To allow /tools to be built from source
+bazel_dep(name = "rules_go", version = "0.41.0", dev_dependency = True, repo_name = "io_bazel_rules_go")
+
+go_deps = use_extension(
+    "@gazelle//:extensions.bzl",
+    "go_deps",
+    dev_dependency = True,
+)
+go_deps.from_file(go_mod = "//:go.mod")
+use_repo(
+    go_deps,
+    "com_github_bmatcuk_doublestar_v4",
+    "org_golang_x_exp",
+)
+
 # Development-only dependencies
 
 bazel_dep(name = "bazel_skylib_gazelle_plugin", version = "1.4.1", dev_dependency = True)
 bazel_dep(name = "buildifier_prebuilt", version = "6.1.0", dev_dependency = True)
+bazel_dep(name = "gazelle", version = "0.33.0", dev_dependency = True)

WORKSPACE

@@ -29,6 +29,9 @@ load("//lib:host_repo.bzl", "host_repo")
 
 host_repo(name = "aspect_bazel_lib_host")
 
+############################################
+# rules_go
+
 load("//:deps.bzl", "go_dependencies")
 
 # gazelle:repository_macro deps.bzl%go_dependencies
@@ -36,15 +39,17 @@ load("//:deps.bzl", "go_dependencies")
 # https://github.com/bazelbuild/bazel-gazelle/issues/1217#issuecomment-1152236735
 go_dependencies()
 
-############################################
-# Gazelle, for generating bzl_library targets
 load("@io_bazel_rules_go//go:deps.bzl", "go_register_toolchains", "go_rules_dependencies")
-load("@bazel_gazelle//:deps.bzl", "gazelle_dependencies")
 
 go_rules_dependencies()
 
 go_register_toolchains(version = "1.18.3")
 
+############################################
+# Gazelle, for generating bzl_library targets
+
+load("@bazel_gazelle//:deps.bzl", "gazelle_dependencies")
+
 gazelle_dependencies()
 
 # Buildifier

deps.bzl

@@ -24,8 +24,8 @@ def go_dependencies():
         name = "org_golang_x_exp",
         build_file_proto_mode = "disable_global",
         importpath = "golang.org/x/exp",
-        sum = "h1:m9O6OTJ627iFnN2JIWfdqlZCzneRO6EEBsHXI25P8ws=",
+        sum = "h1:MGwJjxBy0HJshjDNfLsYO8xppfqWlA5ZT9OhtUUhTNw=",
-        version = "v0.0.0-20221230185412-738e83a70c30",
+        version = "v0.0.0-20230713183714-613f0c0eb8a1",
     )
     go_repository(
         name = "org_golang_x_mod",

e2e/copy_to_directory/WORKSPACE

@@ -6,3 +6,24 @@ local_repository(
 load("@aspect_bazel_lib//lib:repositories.bzl", "aspect_bazel_lib_dependencies")
 
 aspect_bazel_lib_dependencies()
+
+############################################
+# rules_go is needed to consume tools from sources
+
+load("@aspect_bazel_lib//:internal_deps.bzl", "bazel_lib_internal_deps")
+
+bazel_lib_internal_deps()
+
+load("@aspect_bazel_lib//:deps.bzl", "go_dependencies")
+
+go_dependencies()
+
+load("@io_bazel_rules_go//go:deps.bzl", "go_register_toolchains", "go_rules_dependencies")
+
+go_rules_dependencies()
+
+go_register_toolchains(version = "1.18.3")
+
+load("@bazel_gazelle//:deps.bzl", "gazelle_dependencies")
+
+gazelle_dependencies()

e2e/smoke/WORKSPACE

@@ -10,3 +10,24 @@ aspect_bazel_lib_dependencies()
 register_jq_toolchains()
 
 register_yq_toolchains()
+
+############################################
+# rules_go is needed to consume tools from sources
+
+load("@aspect_bazel_lib//:internal_deps.bzl", "bazel_lib_internal_deps")
+
+bazel_lib_internal_deps()
+
+load("@aspect_bazel_lib//:deps.bzl", "go_dependencies")
+
+go_dependencies()
+
+load("@io_bazel_rules_go//go:deps.bzl", "go_register_toolchains", "go_rules_dependencies")
+
+go_rules_dependencies()
+
+go_register_toolchains(version = "1.18.3")
+
+load("@bazel_gazelle//:deps.bzl", "gazelle_dependencies")
+
+gazelle_dependencies()

lib/BUILD.bazel

@@ -235,6 +235,7 @@ bzl_library(
         "//lib/private/docs:expand_template_toolchain",
         "//lib/private/docs:jq_toolchain",
         "//lib/private/docs:local_config_platform",
+        "//lib/private/docs:source_toolchains_repo",
         "//lib/private/docs:yq_toolchain",
     ],
 )

lib/private/copy_directory_toolchain.bzl

@@ -6,7 +6,8 @@
 # `tools/copy_directory/mirror_release.sh`. To calculate for a specific release run
 # `tools/copy_directory/mirror_release.sh <release_version>`
 
-load("//tools:versions.bzl", "COPY_DIRECTORY_INTEGRITY", "COPY_DIRECTORY_VERSION")
+load("//tools:integrity.bzl", "COPY_DIRECTORY_INTEGRITY")
+load("//tools:version.bzl", "VERSION")
 
 # Platform names follow the platform naming convention in @aspect_bazel_lib//:lib/private/repo_utils.bzl
 COPY_DIRECTORY_PLATFORMS = {
@@ -158,7 +159,7 @@ def _copy_directory_platform_repo_impl(rctx):
 
     # https://github.com/aspect-build/bazel-lib/releases/download/v1.19.0/copy_directory-linux_amd64
     url = "https://github.com/aspect-build/bazel-lib/releases/download/v{0}/copy_directory-{1}{2}".format(
-        COPY_DIRECTORY_VERSION,
+        VERSION,
         release_platform,
         ".exe" if is_windows else "",
     )

lib/private/copy_to_directory_toolchain.bzl

@@ -6,7 +6,8 @@
 # `tools/copy_to_directory/mirror_release.sh`. To calculate for a specific release run
 # `tools/copy_to_directory/mirror_release.sh <release_version>`
 
-load("//tools:versions.bzl", "COPY_TO_DIRECTORY_INTEGRITY", "COPY_TO_DIRECTORY_VERSION")
+load("//tools:integrity.bzl", "COPY_TO_DIRECTORY_INTEGRITY")
+load("//tools:version.bzl", "VERSION")
 
 # Platform names follow the platform naming convention in @aspect_bazel_lib//:lib/private/repo_utils.bzl
 COPY_TO_DIRECTORY_PLATFORMS = {
@@ -158,7 +159,7 @@ def _copy_to_directory_platform_repo_impl(rctx):
 
     # https://github.com/aspect-build/bazel-lib/releases/download/v1.19.0/copy_to_directory-linux_amd64
     url = "https://github.com/aspect-build/bazel-lib/releases/download/v{0}/copy_to_directory-{1}{2}".format(
-        COPY_TO_DIRECTORY_VERSION,
+        VERSION,
         release_platform,
         ".exe" if is_windows else "",
     )

lib/private/docs/BUILD.bazel

@@ -244,13 +244,24 @@ bzl_library(
 bzl_library(
     name = "copy_directory_toolchain",
     srcs = ["//lib/private:copy_directory_toolchain.bzl"],
-    deps = ["//tools:versions"],
+    deps = [
+        "//tools:sri",
+        "//tools:version",
+    ],
 )
 
 bzl_library(
     name = "copy_to_directory_toolchain",
     srcs = ["//lib/private:copy_to_directory_toolchain.bzl"],
-    deps = ["//tools:versions"],
+    deps = [
+        "//tools:sri",
+        "//tools:version",
+    ],
+)
+
+bzl_library(
+    name = "source_toolchains_repo",
+    srcs = ["//lib/private:source_toolchains_repo.bzl"],
 )
 
 bzl_library(
@@ -263,7 +274,7 @@ bzl_library(
     srcs = ["//lib/private:expand_template_toolchain.bzl"],
     deps = [
         "//lib:stamping",
-        "//tools:versions",
+        "//tools:sri",
     ],
 )
 

lib/private/expand_template_toolchain.bzl

@@ -6,7 +6,8 @@
 # `tools/expand_template/mirror_release.sh`. To calculate for a specific release run
 # `tools/expand_template/mirror_release.sh <release_version>`
 
-load("//tools:versions.bzl", "EXPAND_TEMPLATE_INTEGRITY", "EXPAND_TEMPLATE_VERSION")
+load("//tools:integrity.bzl", "EXPAND_TEMPLATE_INTEGRITY")
+load("//tools:version.bzl", "VERSION")
 
 # Platform names follow the platform naming convention in @aspect_bazel_lib//:lib/private/repo_utils.bzl
 EXPAND_TEMPLATE_PLATFORMS = {
@@ -158,7 +159,7 @@ def _expand_template_platform_repo_impl(rctx):
 
     # https://github.com/aspect-build/bazel-lib/releases/download/v1.19.0/expand_template-linux_amd64
     url = "https://github.com/aspect-build/bazel-lib/releases/download/v{0}/expand_template-{1}{2}".format(
-        EXPAND_TEMPLATE_VERSION,
+        VERSION,
         release_platform,
         ".exe" if is_windows else "",
     )

lib/private/source_toolchains_repo.bzl

@@ -0,0 +1,90 @@
+"""Create a repository to hold the toolchains
+
+This follows guidance here:
+https://docs.bazel.build/versions/main/skylark/deploying.html#registering-toolchains
+"
+Note that in order to resolve toolchains in the analysis phase
+Bazel needs to analyze all toolchain targets that are registered.
+Bazel will not need to analyze all targets referenced by toolchain.toolchain attribute.
+If in order to register toolchains you need to perform complex computation in the repository,
+consider splitting the repository with toolchain targets
+from the repository with <LANG>_toolchain targets.
+Former will be always fetched,
+and the latter will only be fetched when user actually needs to build <LANG> code.
+"
+The "complex computation" in our case is simply downloading large artifacts.
+This guidance tells us how to avoid that: we put the toolchain targets in the alias repository
+with only the toolchain attribute pointing into the platform-specific repositories.
+"""
+
+# Add more platforms as needed to mirror all the binaries
+# published by the upstream project.
+
+DEFS_TMPL = """\
+# Generated by source_toolchains_repo.bzl for {toolchain_type}
+load("@bazel_skylib//lib:structs.bzl", "structs")
+
+# Forward all the providers
+def _resolved_toolchain_impl(ctx):
+    toolchain_info = ctx.toolchains["{toolchain_type}"]
+    return [toolchain_info] + structs.to_dict(toolchain_info).values()
+
+# Copied from java_toolchain_alias
+# https://cs.opensource.google/bazel/bazel/+/master:tools/jdk/java_toolchain_alias.bzl
+resolved_toolchain = rule(
+    implementation = _resolved_toolchain_impl,
+    toolchains = ["{toolchain_type}"],
+    incompatible_use_toolchain_transition = True,
+)
+"""
+
+BUILD_TMPL = """\
+# Generated by source_toolchains_repo.bzl
+#
+# These can be registered in the workspace file or passed to --extra_toolchains flag.
+# By default all of these toolchains are registered by the oci_register_toolchains macro
+# so you don't normally need to interact with these targets.
+
+load(":defs.bzl", "resolved_toolchain")
+load("{toolchain_rule_load_from}", toolchain_rule = "{toolchain_rule}")
+
+resolved_toolchain(name = "current_toolchain", visibility = ["//visibility:public"])
+
+toolchain_rule(
+    name = "source",
+    bin = "{binary}",
+    visibility = ["//visibility:public"],
+)
+
+toolchain(
+    name = "toolchain",
+    toolchain = ":source",
+    toolchain_type = "{toolchain_type}",
+)
+"""
+
+def _source_toolchains_repo_impl(rctx):
+    # Expose a concrete toolchain which is the result of Bazel resolving the toolchain
+    # for the execution or target platform.
+    # Workaround for https://github.com/bazelbuild/bazel/issues/14009
+    rctx.file("defs.bzl", DEFS_TMPL.format(
+        toolchain_type = rctx.attr.toolchain_type,
+    ))
+
+    rctx.file("BUILD.bazel", BUILD_TMPL.format(
+        toolchain_type = rctx.attr.toolchain_type,
+        toolchain_rule_load_from = rctx.attr.toolchain_rule_load_from,
+        toolchain_rule = rctx.attr.toolchain_rule,
+        binary = rctx.attr.binary,
+    ))
+
+source_toolchains_repo = repository_rule(
+    _source_toolchains_repo_impl,
+    doc = "Creates a repository with toolchain definitions for source binaries.",
+    attrs = {
+        "toolchain_type": attr.string(doc = "Label to the toolchain_type", mandatory = True),
+        "toolchain_rule_load_from": attr.string(doc = "Label to the concrete toolchain rule to load from", mandatory = True),
+        "toolchain_rule": attr.string(doc = "Name of the concerete toolchain rule", mandatory = True),
+        "binary": attr.string(doc = "Label to the binary", mandatory = True),
+    },
+)

lib/repositories.bzl

@@ -7,7 +7,9 @@ load("//lib/private:coreutils_toolchain.bzl", "COREUTILS_PLATFORMS", "coreutils_
 load("//lib/private:copy_directory_toolchain.bzl", "COPY_DIRECTORY_PLATFORMS", "copy_directory_platform_repo", "copy_directory_toolchains_repo")
 load("//lib/private:expand_template_toolchain.bzl", "EXPAND_TEMPLATE_PLATFORMS", "expand_template_platform_repo", "expand_template_toolchains_repo")
 load("//lib/private:local_config_platform.bzl", "local_config_platform")
+load("//lib/private:source_toolchains_repo.bzl", "source_toolchains_repo")
 load("//lib:utils.bzl", "is_bazel_6_or_greater", http_archive = "maybe_http_archive")
+load("//tools:version.bzl", "VERSION")
 
 # buildifier: disable=unnamed-macro
 def aspect_bazel_lib_dependencies(override_local_config_platform = False):
@@ -132,6 +134,18 @@ def register_copy_directory_toolchains(name = "copy_directory", register = True)
         register: whether to call through to native.register_toolchains.
             Should be True for WORKSPACE users, but false when used under bzlmod extension
     """
+    if VERSION == "0.0.0":
+        source_toolchains_repo(
+            name = "%s_toolchains" % name,
+            toolchain_type = "@aspect_bazel_lib//lib:copy_directory_toolchain_type",
+            toolchain_rule_load_from = "@aspect_bazel_lib//lib/private:copy_directory_toolchain.bzl",
+            toolchain_rule = "copy_directory_toolchain",
+            binary = "@aspect_bazel_lib//tools/copy_directory",
+        )
+        if register:
+            native.register_toolchains("@%s_toolchains//:toolchain" % name)
+        return
+
     for [platform, meta] in COPY_DIRECTORY_PLATFORMS.items():
         copy_directory_platform_repo(
             name = "%s_%s" % (name, platform),
@@ -153,6 +167,18 @@ def register_copy_to_directory_toolchains(name = "copy_to_directory", register =
         register: whether to call through to native.register_toolchains.
             Should be True for WORKSPACE users, but false when used under bzlmod extension
     """
+    if VERSION == "0.0.0":
+        source_toolchains_repo(
+            name = "%s_toolchains" % name,
+            toolchain_type = "@aspect_bazel_lib//lib:copy_to_directory_toolchain_type",
+            toolchain_rule_load_from = "@aspect_bazel_lib//lib/private:copy_to_directory_toolchain.bzl",
+            toolchain_rule = "copy_to_directory_toolchain",
+            binary = "@aspect_bazel_lib//tools/copy_to_directory",
+        )
+        if register:
+            native.register_toolchains("@%s_toolchains//:toolchain" % name)
+        return
+
     for [platform, meta] in COPY_TO_DIRECTORY_PLATFORMS.items():
         copy_to_directory_platform_repo(
             name = "%s_%s" % (name, platform),
@@ -174,6 +200,18 @@ def register_expand_template_toolchains(name = "expand_template", register = Tru
         register: whether to call through to native.register_toolchains.
             Should be True for WORKSPACE users, but false when used under bzlmod extension
     """
+    if VERSION == "0.0.0":
+        source_toolchains_repo(
+            name = "%s_toolchains" % name,
+            toolchain_type = "@aspect_bazel_lib//lib:expand_template_toolchain_type",
+            toolchain_rule_load_from = "@aspect_bazel_lib//lib/private:expand_template_toolchain.bzl",
+            toolchain_rule = "expand_template_toolchain",
+            binary = "@aspect_bazel_lib//tools/expand_template",
+        )
+        if register:
+            native.register_toolchains("@%s_toolchains//:toolchain" % name)
+        return
+
     for [platform, meta] in EXPAND_TEMPLATE_PLATFORMS.items():
         expand_template_platform_repo(
             name = "%s_%s" % (name, platform),

scripts/check_versions.sh

@@ -1,41 +0,0 @@
-#!/usr/bin/env bash
-
-set -o errexit -o nounset -o pipefail
-
-
-TAG=
-if [[ "${PRE_COMMIT:-"0"}" == "1" ]]; then
-    if [[ ! $( echo "$PRE_COMMIT_REMOTE_BRANCH" | grep -E '^refs/tags/v[0-9]+\.[0-9]+\.[0-9]+$' ) ]]; then
-        # not pushing a tag. skip running.
-        exit 0
-    fi
-    TAG="${PRE_COMMIT_REMOTE_BRANCH/refs\/tags\//}"
-else
-    if [[ $# -eq 0 ]]; then
-        echo "a tag required."
-        exit 1
-    elif [[ ! $( echo "$1" | grep -E 'v[0-9]+\.[0-9]+\.[0-9]+$' ) ]]; then
-        echo "not a valid semver. expected v0.0.0 format."
-        exit 1
-    fi
-    TAG=$1
-fi
-
-BAZEL_ARGS=(
-    --client_env=STABLE_BUILD_SCM_TAG_OVERRIDE="$TAG"
-    --test_output=errors
-    --config=release
-    --ui_event_filters=-stdout
-    --noshow_progress
-    //tools:release_versions_checkin_test
-)
-if ! bazel --bazelrc=.github/workflows/ci.bazelrc --bazelrc=.bazelrc test ${BAZEL_ARGS[@]};  then
-    echo ""
-    echo "Release is aborted to due to wrong version information."
-    echo ""
-    echo "> Please run the following command and retag with a new commit."
-    echo ""
-    echo "./scripts/generate_versions.sh $TAG"
-    echo ""
-    exit 1
-fi

scripts/generate_versions.sh

@@ -1,10 +0,0 @@
-#!/usr/bin/env bash
-
-set -o errexit -o nounset -o pipefail
-
-if [[ $# -eq 0 ]]; then
-    echo "a tag required."
-    exit 1
-fi
-
-bazel --bazelrc=.github/workflows/ci.bazelrc --bazelrc=.bazelrc run --config=release --client_env=STABLE_BUILD_SCM_TAG_OVERRIDE="$1" //tools:release_versions_checkin

tools/BUILD.bazel

@@ -1,16 +1,7 @@
-load("@bazel_skylib//rules:common_settings.bzl", "bool_flag")
 load("@bazel_skylib//:bzl_library.bzl", "bzl_library")
+load("//lib:write_source_files.bzl", "write_source_files")
+load("//lib:utils.bzl", "is_bazel_6_or_greater")
 load(":release.bzl", "multi_platform_go_binaries", "release")
-load(":source_toolchain.bzl", "source_toolchain")
-
-# buildifier: disable=bzl-visibility
-load("//lib/private:expand_template_toolchain.bzl", "expand_template_toolchain")
-
-# buildifier: disable=bzl-visibility
-load("//lib/private:copy_to_directory_toolchain.bzl", "copy_to_directory_toolchain")
-
-# buildifier: disable=bzl-visibility
-load("//lib/private:copy_directory_toolchain.bzl", "copy_directory_toolchain")
 
 exports_files([
     "create_release.sh",
@@ -18,43 +9,23 @@ exports_files([
 ])
 
 bzl_library(
-    name = "versions",
+    name = "sri",
-    srcs = [":versions.bzl"],
+    srcs = [":integrity.bzl"],
     visibility = ["//lib/private/docs:__pkg__"],
 )
 
-bool_flag(
+bzl_library(
-    name = "use_source_toolchains",
+    name = "version",
-    build_setting_default = False,
+    srcs = [":version.bzl"],
+    visibility = ["//lib/private/docs:__pkg__"],
 )
 
-config_setting(
+bzl_library(
-    name = "prefer_source_toolchains",
+    name = "hashes",
-    flag_values = {":use_source_toolchains": "1"},
+    srcs = ["hashes.bzl"],
     visibility = ["//visibility:public"],
 )
 
-source_toolchain(
-    name = "expand_template_toolchain",
-    binary = "//tools/expand_template",
-    toolchain_rule = expand_template_toolchain,
-    toolchain_type = "@aspect_bazel_lib//lib:expand_template_toolchain_type",
-)
-
-source_toolchain(
-    name = "copy_to_directory_toolchain",
-    binary = "//tools/copy_to_directory",
-    toolchain_rule = copy_to_directory_toolchain,
-    toolchain_type = "@aspect_bazel_lib//lib:copy_to_directory_toolchain_type",
-)
-
-source_toolchain(
-    name = "copy_directory_toolchain",
-    binary = "//tools/copy_directory",
-    toolchain_rule = copy_directory_toolchain,
-    toolchain_type = "@aspect_bazel_lib//lib:copy_directory_toolchain_type",
-)
-
 multi_platform_go_binaries(
     name = "copy_to_directory",
     embed = ["//tools/copy_to_directory:copy_to_directory_lib"],
@@ -75,7 +46,11 @@ multi_platform_go_binaries(
 
 release(
     name = "release",
-    tags = ["manual"],
+    tags = [
+        "local",
+        "manual",
+        "no-remote",
+    ],
     targets = [
         ":copy_directory",
         ":copy_to_directory",
@@ -83,8 +58,10 @@ release(
     ],
 )
 
-bzl_library(
+write_source_files(
-    name = "hashes",
+    name = "releases_versions_check_in",
-    srcs = ["hashes.bzl"],
+    files = {
-    visibility = ["//visibility:public"],
+        "integrity.bzl": ":release_versions",
+    },
+    tags = (["manual"] if not is_bazel_6_or_greater() else []),
 )

tools/create_versions.sh

@@ -2,24 +2,11 @@
 
 set -o errexit -o nounset -o pipefail
 
-HAS_LOCAL_CHANGES="{{HAS_LOCAL_CHANGES}}"
-VERSION="{{VERSION}}"
 NAME="$1"
 NAME_UPPER="$(echo $NAME | tr '[a-z]' '[A-Z]')"
 shift
 
-if [[ "$HAS_LOCAL_CHANGES" == "dirty" ]]; then
-  cat >&2 <<EOF
-
-There are local changes that might affect checksums.
-Please commit them before running this command.
-
-EOF
-  exit 1
-fi
-
 cat <<EOF
-${NAME_UPPER}_VERSION = "${VERSION/v/}"
 ${NAME_UPPER}_INTEGRITY = {
 EOF
 
@@ -38,5 +25,5 @@ EOF
 done
 
 
-echo "}"
+echo -n "}"
 echo ""

tools/integrity.bzl

@@ -0,0 +1,26 @@
+"AUTO GENERATED. DO NOT EDIT"
+
+COPY_DIRECTORY_INTEGRITY = {
+    "darwin_amd64": "sha256-EH6Qpf/IzIaGncigN+cMc2xCb0C3XuV8I4cUBtaZ7GE=",
+    "darwin_arm64": "sha256-DH2vl4k0MSyp+lnvfiiOu0ifc+tZSgJUIOFthSOMMvg=",
+    "freebsd_amd64": "sha256-ogXy1bGEMB4EnuF606H1Vi0h77B3xg+9rSnghDHyVEw=",
+    "linux_amd64": "sha256-QGFIoivc0z92barkw/JL4LbggV89nmCfsRkDK7fz4gY=",
+    "linux_arm64": "sha256-lSUkiCmhQaSxPNDaW8Ny+cipW1fcvNogX5Ex3zN1784=",
+    "windows_amd64": "sha256-ioAUxcSJhMRG7tghZRDH/WjATUEUjVyNN1Cs2BAozJs=",
+}
+COPY_TO_DIRECTORY_INTEGRITY = {
+    "darwin_amd64": "sha256-H0FfQ3IbF9RXl0OyLkVHnzNWEtkQuLZq82KTYvhDel4=",
+    "darwin_arm64": "sha256-M3LcBrCqI5ZveZqeo3f78TRJ21ebWTQA/tDOfAul2q0=",
+    "freebsd_amd64": "sha256-zg9qdxYvW/+EcUGNjBqeAxkn0WiZ8cqK2X4ssjl+jSg=",
+    "linux_amd64": "sha256-zNmE7RNMTRJqrU2w04C3twA3NKq7HvFUWim2HBwJ4Kg=",
+    "linux_arm64": "sha256-VhG/VMlBwHw+vMv8gFJR1FdYuUXb85N/CETmEedfH7Y=",
+    "windows_amd64": "sha256-+CcPufT0nD4XKbZUIHK4R+KKiFzC1Ejr/8Sjno3aHRo=",
+}
+EXPAND_TEMPLATE_INTEGRITY = {
+    "darwin_amd64": "sha256-xfHAVVPnlehEhx3iz5b7a0jPgKiH6WSmX692D1t7ZXs=",
+    "darwin_arm64": "sha256-p/ec4ni5Tk7m68ojoMA/pE087rzza1+R4h+WCpmPAGk=",
+    "freebsd_amd64": "sha256-wylWEbSAn2K5PD524Tc85vapN3FOdKkcPTHOPx6Mpfw=",
+    "linux_amd64": "sha256-hqElemiHdXWu7T2Ic4FDK1UjyRHfSihVJh1UtALyZuo=",
+    "linux_arm64": "sha256-aGj0vuCjfejJ5Q8mJ7ROKat8qki5vLqrAmPXgWFP6m8=",
+    "windows_amd64": "sha256-Zr24XvAZDyNPLddYGS19zBvpSQmMpqUVSh+ZS0wu/P8=",
+}

tools/release.bzl

@@ -3,8 +3,6 @@
 
 load("@io_bazel_rules_go//go:def.bzl", "go_binary")
 load(":hashes.bzl", "hashes")
-load("//lib:write_source_files.bzl", "write_source_files")
-load("//lib:expand_template.bzl", "expand_template")
 load("//lib:utils.bzl", "to_label")
 
 PLATFORMS = [
@@ -16,6 +14,36 @@ PLATFORMS = [
     struct(os = "windows", arch = "amd64", ext = ".exe", gc_linkopts = []),
 ]
 
+def _compilation_mode_transition_impl(settings, attr):
+    # buildifier: disable=unused-variable
+    _ignore = (settings, attr)
+    return {"//command_line_option:compilation_mode": "opt"}
+
+compilation_mode_transition = transition(
+    implementation = _compilation_mode_transition_impl,
+    inputs = [],
+    outputs = ["//command_line_option:compilation_mode"],
+)
+
+def _compilation_mode_transition_rule_impl(ctx):
+    runfiles = ctx.runfiles().merge_all([target[DefaultInfo].default_runfiles for target in ctx.attr.targets])
+
+    return DefaultInfo(
+        files = depset(ctx.files.targets),
+        runfiles = runfiles,
+    )
+
+compilation_mode_transition_rule = rule(
+    implementation = _compilation_mode_transition_rule_impl,
+    attrs = {
+        "targets": attr.label_list(),
+        "_allowlist_function_transition": attr.label(
+            default = "@bazel_tools//tools/allowlists/function_transition_allowlist",
+        ),
+    },
+    cfg = compilation_mode_transition,
+)
+
 def multi_platform_go_binaries(name, embed, prefix = "", **kwargs):
     """The multi_platform_go_binaries macro creates a go_binary for each platform.
 
@@ -51,9 +79,10 @@ def multi_platform_go_binaries(name, embed, prefix = "", **kwargs):
         )
         targets.extend([target_label, hashes_label])
 
-    native.filegroup(
+    # binaries should always be compiled in opt mode as it affects the hashes.
+    compilation_mode_transition_rule(
         name = name,
-        srcs = targets,
+        targets = targets,
         **kwargs
     )
 
@@ -69,39 +98,18 @@ def release(name, targets, **kwargs):
         **kwargs: extra arguments.
     """
 
-    expand_template(
-        name = "{}_versions_stamped".format(name),
-        out = "create_versions_stamped.sh",
-        is_executable = True,
-        substitutions = {
-            "{{VERSION}}": "{{STABLE_BUILD_SCM_TAG}}",
-            "{{HAS_LOCAL_CHANGES}}": "{{STABLE_BUILD_SCM_LOCAL_CHANGES}}",
-        },
-        template = "//tools:create_versions.sh",
-        stamp = 1,
-        **kwargs
-    )
-
     native.genrule(
         name = "{}_versions".format(name),
         srcs = targets,
-        outs = ["versions_generated.bzl"],
+        outs = ["{}_versions_generated.bzl".format(name)],
         executable = True,
         cmd = " && ".join([
             """echo '"AUTO GENERATED. DO NOT EDIT"\n' >> $@""",
         ] + [
-            "./$(location :create_versions_stamped.sh) {} $(locations {}) >> $@".format(to_label(target).name, target)
+            "./$(location :create_versions.sh) {} $(locations {}) >> $@".format(to_label(target).name, target)
             for target in targets
         ]),
-        tools = [":create_versions_stamped.sh"],
+        tools = [":create_versions.sh"],
-        **kwargs
-    )
-
-    write_source_files(
-        name = "{}_versions_checkin".format(name),
-        files = {
-            "versions.bzl": ":versions_generated.bzl",
-        },
         **kwargs
     )
 

tools/source_toolchain.bzl

@@ -1,17 +0,0 @@
-"""macros for defining source toolchains for tools"""
-
-def source_toolchain(name, toolchain_rule, toolchain_type, binary):
-    toolchain_rule(
-        name = "{}_source".format(name),
-        bin = binary,
-        visibility = ["//visibility:public"],
-    )
-
-    native.toolchain(
-        name = name,
-        toolchain = ":{}_source".format(name),
-        toolchain_type = toolchain_type,
-        target_settings = [
-            "@aspect_bazel_lib//tools:prefer_source_toolchains",
-        ],
-    )

tools/version.bzl

@@ -0,0 +1,7 @@
+"version information. replaced with stamped info with each release"
+
+# This is automagically replace by git during git archive using `git export-subst`
+# See https://git-scm.com/docs/git-archive/2.29.0#Documentation/git-archive.txt-export-subst
+_VERSION_PRIVATE = "$Format:%(describe:tags=true)$"
+
+VERSION = "0.0.0" if _VERSION_PRIVATE.startswith("$Format") else _VERSION_PRIVATE.replace("v", "", 1)

tools/versions.bzl

@@ -1,28 +0,0 @@
-"AUTO GENERATED. DO NOT EDIT"
-
-COPY_DIRECTORY_VERSION = "1.31.0"
-COPY_DIRECTORY_INTEGRITY = {
-    "darwin_amd64": "sha256-woit3x+tLBneR1uB2vgdBgoysLVjFKOIg0JQUvY31RE=",
-    "darwin_arm64": "sha256-lo40uEgpR47iR76xOuGJ8MTlo9OgGQaxlHSEFVYpBbs=",
-    "linux_amd64": "sha256-DsaFECaxpEzLbv3SfEXcKYpuRk+90FaSYSQuCLEE5i8=",
-    "linux_arm64": "sha256-IH5pYBe42O9iDZm9MdECvnp9e9PpOf6cEab71U0ktXY=",
-    "windows_amd64": "sha256-AWcKeRtEs2djr9Mh3ha5wW0kTq5JNPOBIJbcIKk+BGA=",
-}
-
-COPY_TO_DIRECTORY_VERSION = "1.31.0"
-COPY_TO_DIRECTORY_INTEGRITY = {
-    "darwin_amd64": "sha256-L/vJ/RR+PIyX2yDdlqbnPQP3/3bWo6nncA6RIqGRVVQ=",
-    "darwin_arm64": "sha256-7qHbUZXWFgiDOgInegAGEaPOu0up1gtMurXw/uHy9ys=",
-    "linux_amd64": "sha256-lDFF2xCzHdDSbNlCSgZ+LkXhvceOZE8ghu5aahARcsw=",
-    "linux_arm64": "sha256-eGOZbQl0G0Fn74pjPOWVUwZwe0HkhZqoVen9XWQCuAg=",
-    "windows_amd64": "sha256-ctNXsZzsFb01cGMvYBEOpbtmOMezsorYWocKl34kqtY=",
-}
-
-EXPAND_TEMPLATE_VERSION = "1.34.4"
-EXPAND_TEMPLATE_INTEGRITY = {
-    "darwin_amd64": "sha256-dq7Awfc0SAzz2ViRnRMX4SpVw+09nxBZxTOVu+DrAzM=",
-    "darwin_arm64": "sha256-vgV43WN/dYqcXxCL0yDeLod/eDFA+dWe02LO/HJREVs=",
-    "linux_amd64": "sha256-xmmrCq/I79QDJYj6sObvCMnNC90Onwr/ewsQ+a8vEl8=",
-    "linux_arm64": "sha256-sHXkrjF0kuyJqdME/Pviy7EUA28sGEnEv976Rs+3tX0=",
-    "windows_amd64": "sha256-UgUkTo0gLN/dIkdZUdcRonNv2/Ul9LrdZ6Tv5c6SmPg=",
-}