Pull changes from upstream

.bazelignore

@@ -1 +1,2 @@
-examples
+examples/
+.git/

.bazelrc

@@ -1,5 +1,51 @@
-build --verbose_failures
-test --test_output=errors
+########################
+# Import bazelrc presets
+import %workspace%/tools/preset.bazelrc
 
-# required for rules_docker 0.15
-common --incompatible_restrict_string_escapes=false
+# Don’t want to push a rules author to update their deps if not needed.
+# https://bazel.build/reference/command-line-reference#flag--check_direct_dependencies
+# https://bazelbuild.slack.com/archives/C014RARENH0/p1691158021917459?thread_ts=1691156601.420349&cid=C014RARENH0
+common --config=ruleset
+
+# Bazel settings that apply to this repository.
+# Take care to document any settings that you expect users to apply.
+# Settings that apply only to CI are in .github/workflows/ci.bazelrc
+
+# Required until this is the default; expected in Bazel 7
+common --enable_bzlmod
+
+# C++17 is required by protobuf and abseil-cpp
+build --cxxopt=-std=c++17
+build --host_cxxopt=-std=c++17
+
+# Ensure that the MODULE.bazel.lock file is complete and committed.
+# This is an important security measure: it ensures that developers on the
+# same rule set download dependencies at the same versions with the same bits.
+# This setting does not affect modules that depend on this module.
+#
+# When updating dependencies, use --lockfile_mode=refresh, for example:
+#     bazel mod tidy --lockfile_mode=refresh
+#
+# When testing different versions of Bazel, use --lockfile_mode=update or
+# --lockfile_mode=off. The lock file format changes over time, and different
+# versions of Bazel may expect different syntax. Bazel also implicitly requires
+# some modules, and different versions have different dependencies, which
+# also affects the contents of the lock file.
+common --lockfile_mode=off
+
+# This directory is configured in GitHub actions to be persisted between runs.
+# We do not enable the repository cache to cache downloaded external artifacts
+# as these are generally faster to download again than to fetch them from the
+# GitHub actions cache.
+common:ci --disk_cache=~/.cache/bazel
+
+common --@protobuf//bazel/toolchains:prefer_prebuilt_protoc
+
+# Load any settings specific to the current user.
+# .bazelrc.user should appear in .gitignore so that settings are not shared with team members
+# This needs to be last statement in this
+# config, as the user configuration should be able to overwrite flags from this file.
+# See https://docs.bazel.build/versions/master/best-practices.html#bazelrc
+# (Note that we use .bazelrc.user so the file appears next to .bazelrc in directory listing,
+# rather than user.bazelrc as suggested in the Bazel docs)
+try-import %workspace%/.bazelrc.user

.bazelversion

@@ -1 +1 @@
-4.0.0
+7.6.0

.bcr/metadata.template.json

@@ -0,0 +1,20 @@
+{
+    "homepage": "https://github.com/adobe/rules_gitops",
+    "maintainers": [
+        {
+            "name": "Nick Schaap",
+            "email": "schaap@adobe.com",
+            "github": "nickschaap",
+            "github_user_id": 4684894
+        },
+        {
+            "name": "Konstantin Zadorozhny",
+            "email": "zadorozh@adobe.com",
+            "github": "kzadorozhny",
+            "github_user_id": 1616702
+        }
+    ],
+    "repository": ["github:adobe/rules_gitops"],
+    "versions": [],
+    "yanked_versions": {}
+}

.bcr/presubmit.yml

@@ -0,0 +1,14 @@
+bcr_test_module:
+    module_path: '.'
+    matrix:
+        bazel: ['7.x', '8.x', '9.x']
+        platform: ['debian10', 'macos', 'ubuntu2004']
+    tasks:
+        run_tests:
+            name: 'Run test module'
+            bazel: ${{ bazel }}
+            platform: ${{ platform }}
+            test_flags:
+                - "--test_tag_filters=-skip-bazel-ci"
+            test_targets:
+                - '//...'

.bcr/source.template.json

@@ -0,0 +1,6 @@
+{
+    "integrity": "**leave this alone**",
+    "strip_prefix": "{REPO}-{VERSION}",
+    "docs_url": "https://github.com/{OWNER}/{REPO}/releases/download/{TAG}/{REPO}-{TAG}.docs.tar.gz",
+    "url": "https://github.com/{OWNER}/{REPO}/releases/download/{TAG}/{REPO}-{TAG}.tar.gz"
+}

.gitattributes

@@ -0,0 +1,8 @@
+#################################
+# Configuration for 'git archive'
+# See https://git-scm.com/docs/git-archive#ATTRIBUTES
+
+# Don't include examples in the distribution artifact, to reduce size.
+# You may want to add additional exclusions for folders or files that users don't need.
+examples export-ignore
+tests export-ignore

.github/ISSUE_TEMPLATE.md

@@ -25,19 +25,6 @@
 
 > Replace this line with your answer.
 
-### Snippet of the `WORKSPACE` file that includes rules_gitops rules.
-
-> Replace this line with your answer.
-
-###  Have you found anything relevant by searching the web?
-
-> Replace these lines with your answer.
->
-> Places to look:
-> - StackOverflow: http://stackoverflow.com/questions/tagged/bazel
-> - GitHub issues: https://github.com/bazelbuild/bazel/issues
-> - Slack: https://bazelbuild.slack.com
-
 ### Any other information, logs, or outputs that you want to share?
 
 > Replace these lines with your answer.

.github/workflows/ci.yaml

@@ -3,25 +3,27 @@ name: CI
 on:
   push:
     branches:
-      - master
+      - main
       - feature/*
   pull_request:
-    branches: [master]
+    branches: [main]
 
 jobs:
   build:
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-24.04
     strategy:
       matrix:
         bazel-version:
-          - 3.7.1
-          - 4.0.0
+          - 7.6.0
+          - 8.5.0
+          - 9.0.0
     env:
       USE_BAZEL_VERSION: ${{ matrix.bazel-version }}
     steps:
-      - uses: actions/checkout@v2
+      - name: Checkout
+        uses: actions/checkout@v3
       - name: Mount Bazel cache
-        uses: actions/cache@v1
+        uses: actions/cache@v4
         with:
           path: ~/.cache/bazel
           key: bazel-${{ matrix.bazel-version }}-${{ github.sha }}
@@ -32,51 +34,18 @@ jobs:
         run: |
           TOOLS_DIR="${HOME}/.cache/tools"
           mkdir -p "${TOOLS_DIR}/bin/"
-          curl -Ls -o "${TOOLS_DIR}/bin/bazel" "https://github.com/bazelbuild/bazelisk/releases/download/v1.3.0/bazelisk-linux-amd64"
+          curl -Ls -o "${TOOLS_DIR}/bin/bazel" "https://github.com/bazelbuild/bazelisk/releases/download/v1.14.0/bazelisk-linux-amd64"
           chmod +x "${TOOLS_DIR}/bin/bazel"
-          curl -Ls -o "${TOOLS_DIR}/bin/buildifier" "https://github.com/bazelbuild/buildtools/releases/download/0.29.0/buildifier"
-          chmod +x "${TOOLS_DIR}/bin/buildifier"
-          curl -Ls -o "${TOOLS_DIR}/bin/kind" "https://github.com/kubernetes-sigs/kind/releases/download/v0.11.1/kind-linux-amd64"
-          chmod +x "${TOOLS_DIR}/bin/kind"
           echo "${TOOLS_DIR}/bin" >> $GITHUB_PATH
-      - name: Setup kind cluster
-        run: |
-          ./create_kind_cluster.sh
-      - name: Build
-        run: |
-          bazel build //...
-      - name: Check
-        # run downloaded version of buildifier to reduce uncached build times
-        # see: bazel run //:buildifier-check
-        run: |
-          find . -type f \(\
-            -name '*.bzl' \
-            -o -name '*.sky' \
-            -o -name BUILD \
-            -o -name BUILD.bazel \
-            -o -name WORKSPACE \
-            -o -name WORKSPACE.bazel \
-          \) | xargs buildifier \
-            -mode=check \
-            -lint=warn \
-            --warnings=-module-docstring,-function-docstring,-function-docstring-header,-function-docstring-args,-function-docstring-return,-print \
-          || {
-            buildifier_exit_code=$?
-            echo "Error: failed buildifier checks. Please run \"bazel run //:buildifier-fix\" and commit the changes."
-            exit $buildifier_exit_code
-          }
       - name: Test
         run: |
-          bazel test //...
-      - name: Build examples
-        run: |
-          cd examples
-          bazel build //...
-      - name: Test examples
+          bazel --output_base=~/.bazel/ test //... --config=ci
+      - name: Build helloworld
         run: |
-          cd examples
-          bazel test //...
-      - name: E2E
+          cd examples/helloworld
+          bazel --output_base=~/.bazel/ build //...
+      - name: Build legacy docker
+        if: matrix.bazel-version == '7.6.0'
         run: |
-          cd examples
-          ./e2e-test.sh
+          cd examples/legacy_docker
+          bazel --output_base=~/.bazel/ build //...

.github/workflows/conventional-commits.yaml

@@ -0,0 +1,21 @@
+# This helps the tag.yaml action to automatically create new releases
+#
+# tag.yaml requires all commits to follow the conventional commit pattern so that it can
+# automatically derive the next release version based on the commit history
+
+name: Verify PR title/description
+on:
+  pull_request_target:
+    types:
+      - opened
+      - edited
+      - synchronize
+permissions:
+  pull-requests: read
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: amannn/action-semantic-pull-request@v5
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/publish.yaml

@@ -0,0 +1,35 @@
+# Publish new releases to Bazel Central Registry.
+name: Publish to BCR
+on:
+  # Run the publish workflow after a successful release
+  # Will be triggered from the release.yaml workflow
+  workflow_call:
+    inputs:
+      tag_name:
+        required: true
+        type: string
+    secrets:
+      publish_token:
+        required: true
+  # In case of problems, let release engineers retry by manually dispatching
+  # the workflow from the GitHub UI
+  workflow_dispatch:
+    inputs:
+      tag_name:
+        description: git tag being released
+        required: true
+        type: string
+jobs:
+  publish:
+    uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@v1.0.0
+    with:
+      tag_name: ${{ inputs.tag_name }}
+      # GitHub repository which is a fork of the upstream where the Pull Request will be opened.
+      registry_fork: adobe/bazel-central-registry
+    permissions:
+      attestations: write
+      contents: write
+      id-token: write
+    secrets:
+      # Necessary to push to the BCR fork, and to open a pull request against a registry
+      publish_token: ${{ secrets.publish_token || secrets.BCR_PUBLISH_TOKEN }}

.github/workflows/release.yml

@@ -0,0 +1,34 @@
+# Cut a release whenever a new tag is pushed to the repo.
+name: Release
+on:
+  # Can be triggered from the tag.yaml workflow
+  workflow_call:
+    inputs:
+      tag_name:
+        required: true
+        type: string
+    secrets:
+      publish_token:
+        required: true
+  # Or, developers can manually push a tag from their clone
+  push:
+    tags:
+      - "v*.*.*"
+permissions:
+  id-token: write
+  attestations: write
+  contents: write
+jobs:
+  release:
+    uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@v7.2.2
+    with:
+      release_files: rules_gitops-*.tar.gz
+      prerelease: false
+      tag_name: ${{ inputs.tag_name || github.ref_name }}
+  publish:
+    needs: release
+    uses: ./.github/workflows/publish.yaml
+    with:
+      tag_name: ${{ inputs.tag_name || github.ref_name }}
+    secrets:
+      publish_token: ${{ secrets.publish_token || secrets.BCR_PUBLISH_TOKEN }}