ci: only test with bazel 6, 7

.bazelrc

@@ -6,6 +6,9 @@ build --incompatible_strict_action_env
 build --nolegacy_external_runfiles
 test --test_env=DOCKER_HOST
 
+# Disable bzlmod lockfile
+common --lockfile_mode=off
+
 # TODO(2.0): enable once we drop support for Bazel 5.
 # common --credential_helper=public.ecr.aws=%workspace%/examples/credential_helper/auth.sh
 

.github/workflows/ci.yaml

@@ -22,12 +22,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - id: bazel_6
+      - id: bazel_7
         run: echo "bazelversion=$(head -n 1 .bazelversion)" >> $GITHUB_OUTPUT
-      - id: bazel_5
-        run: echo "bazelversion=5.4.0" >> $GITHUB_OUTPUT
+      - id: bazel_6
+        run: echo "bazelversion=6.4.0" >> $GITHUB_OUTPUT
     outputs:
-      # Will look like ["<version from .bazelversion>", "5.4.0"]
+      # Will look like ["<version from .bazelversion>", "6.4.0"]
       bazelversions: ${{ toJSON(steps.*.outputs.bazelversion) }}
 
   matrix-prep-os:
@@ -78,13 +78,10 @@ jobs:
           - os: macos-latest
             folder: e2e/pull
           - os: macos-latest
-            bazelversion: 5.4.0
+            bazelversion: 6.4.0
           # e2e/pull is bzlmod only but it has test for both cases.
           - folder: e2e/pull
             bzlmodEnabled: false
-          # Don't test bzlmod with Bazel 5 (not supported)
-          - bazelversion: 5.4.0
-            bzlmodEnabled: true
           # TODO: fix
           - folder: e2e/custom_registry
             bzlmodEnabled: true

.gitignore

@@ -1,3 +1,4 @@
 bazel-*
 .bazelrc.user
-.DS_Store
+.DS_Store
+MODULE.bazel.lock

MODULE.bazel

@@ -6,8 +6,7 @@ module(
     compatibility_level = 1,
 )
 
-# Minimum 1.36.0 to include https://github.com/aspect-build/bazel-lib/pull/594
-bazel_dep(name = "aspect_bazel_lib", version = "1.36.0")
+bazel_dep(name = "aspect_bazel_lib", version = "1.42.1")
 bazel_dep(name = "bazel_skylib", version = "1.4.1")
 bazel_dep(name = "platforms", version = "0.0.5")
 
@@ -17,6 +16,14 @@ use_repo(oci, "oci_crane_registry_toolchains", "oci_crane_toolchains")
 
 register_toolchains("@oci_crane_toolchains//:all", "@oci_crane_registry_toolchains//:all")
 
+# Dev dependencies
+bazel_lib = use_extension("@aspect_bazel_lib//lib:extensions.bzl", "toolchains", dev_dependency = True)
+bazel_lib.jq()
+use_repo(bazel_lib, "jq_toolchains")
+
+bazel_dep(name = "rules_go", version = "0.46.0", dev_dependency = True, repo_name = "io_bazel_rules_go")
 bazel_dep(name = "rules_pkg", version = "0.7.0", dev_dependency = True)
 bazel_dep(name = "gazelle", version = "0.35.0", dev_dependency = True, repo_name = "bazel_gazelle")
 bazel_dep(name = "bazel_skylib_gazelle_plugin", version = "1.4.1", dev_dependency = True)
+
+bazel_dep(name = "container_structure_test", version = "1.16.0")

WORKSPACE

@@ -17,12 +17,11 @@ load("//oci:dependencies.bzl", "rules_oci_dependencies")
 
 rules_oci_dependencies()
 
-load("//oci:repositories.bzl", "LATEST_CRANE_VERSION", "LATEST_ZOT_VERSION", "oci_register_toolchains")
+load("//oci:repositories.bzl", "LATEST_CRANE_VERSION", "oci_register_toolchains")
 
 oci_register_toolchains(
     name = "oci",
     crane_version = LATEST_CRANE_VERSION,
-    zot_version = LATEST_ZOT_VERSION,
 )
 
 ## Setup bazel-lib

WORKSPACE.bzlmod

@@ -0,0 +1,21 @@
+new_local_repository(
+    name = "empty_image",  # for sign_external test
+    build_file = "//examples/sign_external:BUILD.template",
+    path = "examples/sign_external/workspace",
+)
+
+new_local_repository(
+    name = "example_sbom",  # for attest_external test
+    build_file = "//examples/attest_external:BUILD.template",
+    path = "examples/attest_external/workspace",
+)
+
+# Fetching various images
+load(":fetch.bzl", "fetch_images")
+
+fetch_images()
+
+### Setup rules_oci cosign
+load("//cosign:repositories.bzl", "cosign_register_toolchains")
+
+cosign_register_toolchains(name = "oci_cosign")

e2e/custom_registry/MODULE.bazel

@@ -0,0 +1,40 @@
+module(
+    name = "custom_registry",
+    version = "0.0.0",
+    compatibility_level = 1,
+)
+
+bazel_dep(name = "rules_oci", version = "0.0.0", dev_dependency = True)
+bazel_dep(name = "aspect_bazel_lib", version = "1.42.1", dev_dependency = True)
+bazel_dep(name = "rules_go", version = "0.46.0", dev_dependency = True, repo_name = "io_bazel_rules_go")
+bazel_dep(name = "gazelle", version = "0.29.0", dev_dependency = True)
+
+bazel_dep(name = "container_structure_test", version = "1.16.0")
+
+register_toolchains("//registry:registry_toolchain")
+
+local_path_override(
+    module_name = "rules_oci",
+    path = "../..",
+)
+
+go_deps = use_extension("@gazelle//:extensions.bzl", "go_deps")
+go_deps.from_file(go_mod = "//:go.mod")
+use_repo(
+    go_deps,
+    "com_github_google_go_containerregistry",
+)
+
+oci = use_extension("@rules_oci//oci:extensions.bzl", "oci")
+oci.pull(
+    name = "debian",
+    image = "https://index.docker.io/library/debian",
+    platforms = [
+        "linux/arm64/v8",
+        "linux/amd64",
+    ],
+    # Don't make a debian_unpinned repo and print a warning about the tag
+    reproducible = False,
+    tag = "latest",
+)
+use_repo(oci, "debian")