build: upgrade to latest bazel 7.3.2

.aspect/bazelrc/convenience.bazelrc

@@ -3,7 +3,7 @@
 build --keep_going
 
 # Output test errors to stderr so users don't have to `cat` or open test failure log files when test
-# fail. This makes the log noiser in exchange for reducing the time-to-feedback on test failures for
+# fail. This makes the log noisier in exchange for reducing the time-to-feedback on test failures for
 # users.
 # Docs: https://bazel.build/docs/user-manual#test-output
 test --test_output=errors

.aspect/bazelrc/correctness.bazelrc

@@ -24,7 +24,7 @@ test --test_verbose_timeout_warnings
 # Allow the Bazel server to check directory sources for changes. Ensures that the Bazel server
 # notices when a directory changes, if you have a directory listed in the srcs of some target.
 # Recommended when using
-# [copy_directory](https://github.com/aspect-build/bazel-lib/blob/main/docs/copy_directory.md) and
+# [copy_directory](https://github.com/bazel-contrib/bazel-lib/blob/main/docs/copy_directory.md) and
 # [rules_js](https://github.com/aspect-build/rules_js) since npm package are source directories
 # inputs to copy_directory actions.
 # Docs: https://bazel.build/reference/command-line-reference#flag--host_jvm_args
@@ -68,7 +68,7 @@ build --incompatible_default_to_explicit_init_py
 common --incompatible_disallow_empty_glob
 
 # Always download coverage files for tests from the remote cache. By default, coverage files are not
-# downloaded on test result cahce hits when --remote_download_minimal is enabled, making it impossible
+# downloaded on test result cache hits when --remote_download_minimal is enabled, making it impossible
 # to generate a full coverage report.
 # Docs: https://bazel.build/reference/command-line-reference#flag--experimental_fetch_all_coverage_outputs
 # detching remote cache results

.aspect/bazelrc/performance.bazelrc

@@ -1,9 +1,3 @@
-# Don't apply `--noremote_upload_local_results` and `--noremote_accept_cached` to the disk cache.
-# If you have both `--noremote_upload_local_results` and `--disk_cache`, then this fixes a bug where
-# Bazel doesn't write to the local disk cache as it treats as a remote cache.
-# Docs: https://bazel.build/reference/command-line-reference#flag--incompatible_remote_results_ignore_disk
-build --incompatible_remote_results_ignore_disk
-
 # Directories used by sandboxed non-worker execution may be reused to avoid unnecessary setup costs.
 # Save time on Sandbox creation and deletion when many of the same kind of action run during the
 # build.
@@ -18,3 +12,16 @@ build --experimental_reuse_sandbox_directories
 # author.
 # Docs: https://bazel.build/reference/command-line-reference#flag--legacy_external_runfiles
 build --nolegacy_external_runfiles
+
+# Avoid creating a runfiles tree for binaries or tests until it is needed.
+# Docs: https://bazel.build/reference/command-line-reference#flag--build_runfile_links
+# See https://github.com/bazelbuild/bazel/issues/6627
+#
+# This may break local workflows that `build` a binary target, then run the resulting program
+# outside of `bazel run`. In those cases, the script will need to call
+# `bazel build --build_runfile_links //my/binary:target` and then execute the resulting program.
+build --nobuild_runfile_links
+
+# Needed prior to Bazel 8; see
+# https://github.com/bazelbuild/bazel/issues/20577
+coverage --build_runfile_links

.bazelversion

@@ -1 +1 @@
-7.1.1
+7.3.2

.github/workflows/bazel6.bazelrc

@@ -20,8 +20,16 @@ build --noexperimental_action_cache_store_output_metadata
 # when local debugging.
 # Docs: https://github.com/bazelbuild/bazel/blob/1af61b21df99edc2fc66939cdf14449c2661f873/src/main/java/com/google/devtools/build/lib/pkgcache/PackageOptions.java#L185
 # NB: This flag is in bazel6.bazelrc as when used in Bazel 7 is has been observed to break
-# "build without the bytes" --remote_download_outputs=toplevel. See https://github.com/aspect-build/bazel-lib/pull/711
+# "build without the bytes" --remote_download_outputs=toplevel. See https://github.com/bazel-contrib/bazel-lib/pull/711
 # for more info.
 build --noexperimental_check_output_files
 fetch --noexperimental_check_output_files
 query --noexperimental_check_output_files
+
+# Don't apply `--noremote_upload_local_results` and `--noremote_accept_cached` to the disk cache.
+# If you have both `--noremote_upload_local_results` and `--disk_cache`, then this fixes a bug where
+# Bazel doesn't write to the local disk cache as it treats as a remote cache.
+# Docs: https://bazel.build/reference/command-line-reference#flag--incompatible_remote_results_ignore_disk
+# NB: This flag is in bazel6.bazelrc because it became a no-op in Bazel 7 and has been removed
+# in Bazel 8.
+build --incompatible_remote_results_ignore_disk

.github/workflows/bazel7.bazelrc

@@ -1,8 +1,12 @@
 # Speed up all builds by not checking if external repository files have been modified.
 # Docs: https://github.com/bazelbuild/bazel/blob/1af61b21df99edc2fc66939cdf14449c2661f873/src/main/java/com/google/devtools/build/lib/bazel/repository/RepositoryOptions.java#L244
-build --noexperimental_check_external_repository_files
-fetch --noexperimental_check_external_repository_files
-query --noexperimental_check_external_repository_files
+common --noexperimental_check_external_repository_files
+
+# Don't report when the root module's lower bound for a dependency happens to be less than the resolved version.
+# This is expected and should NOT prompt an engineer to update our lower bound to match.
+# WARNING: For repository 'aspect_bazel_lib', the root module requires module version [email protected],
+# but got [email protected] in the resolved dependency graph.
+common --check_direct_dependencies=off
 
 # Directories used by sandboxed non-worker execution may be reused to avoid unnecessary setup costs.
 # Save time on Sandbox creation and deletion when many of the same kind of action run during the

.github/workflows/ci.yaml

@@ -107,10 +107,14 @@ jobs:
             - name: Mount bazel caches
               uses: actions/cache@v4
               with:
+                  # Cache the --dist_cache and --repository_cache directories (see ci.bazelrc)
+                  # and the default bazel output (https://bazel.build/remote/output-directories#layout)
+                  # and bazelisk cache.
                   path: |
                       ~/.cache/bazel-disk-cache
                       ~/.cache/bazel-repository-cache
-                      ~/.cache/xdg-cache
+                      ~/.cache/bazel
+                      ~/.cache/bazelisk
                   key: >-
                       bazel-cache-${{ matrix.bazel-version.version }}-${{ matrix.bzlmod }}-${{ matrix.os }}-${{ matrix.folder }}-
                       ${{ hashFiles('.bazelrc', '.bazelversion', '.bazeliskrc', '**/BUILD', '**/BUILD.bazel', '**/*.bzl', 'WORKSPACE', 'WORKSPACE.bazel', 'WORKSPACE.bzlmod', 'MODULE.bazel', '**/*.js', '!e2e') }}-
@@ -152,20 +156,9 @@ jobs:
                     --build_tag_filters=-skip-on-bazel${{ matrix.bazel-version.major }},-skip-on-bzlmod-${{ matrix.bzlmod }} \
                     --enable_bzlmod=${{ matrix.bzlmod }} \
                     //...
-              env:
-                  XDG_CACHE_HOME: ~/.cache/xdg-cache # bazelisk will download bazel to here
 
-    test-worker:
+    bats-tests:
         runs-on: ubuntu-latest
-        needs:
-            - matrix-prep
-        strategy:
-            fail-fast: false
-            matrix:
-                bazel-version: ${{ fromJSON(needs.matrix-prep.outputs.bazel-version) }}
-                exclude:
-                    - bazel-version:
-                          major: 6
         steps:
             - uses: actions/checkout@v4
 

.github/workflows/release.yml

@@ -17,15 +17,17 @@ jobs:
             - name: Mount bazel caches
               uses: actions/cache@v4
               with:
+                  # Cache the --dist_cache and --repository_cache directories (see ci.bazelrc)
+                  # and the default bazel output (https://bazel.build/remote/output-directories#layout)
+                  # and bazelisk cache.
                   path: |
-                      "~/.cache/bazel"
-                      "~/.cache/bazel-repo"
+                      ~/.cache/bazel-disk-cache
+                      ~/.cache/bazel-repository-cache
+                      ~/.cache/bazel
+                      ~/.cache/bazelisk
                   key: bazel-cache-${{ hashFiles('**/BUILD.bazel', '**/*.bzl', 'WORKSPACE') }}
                   restore-keys: bazel-cache-
             - name: bazel test //...
-              env:
-                  # Bazelisk will download bazel to here
-                  XDG_CACHE_HOME: ~/.cache/bazel-repo
               run: bazel --bazelrc=.github/workflows/ci.bazelrc --bazelrc=.bazelrc test //...
             - name: Prepare release
               run: .github/workflows/release_prep.sh ${{ env.GITHUB_REF_NAME }} > release_notes.txt

MODULE.bazel

@@ -7,7 +7,7 @@ module(
 )
 
 # Lower-bounds (minimum) versions for direct runtime dependencies
-bazel_dep(name = "aspect_bazel_lib", version = "2.7.7")
+bazel_dep(name = "aspect_bazel_lib", version = "2.9.3")
 bazel_dep(name = "aspect_rules_js", version = "2.0.0")
 bazel_dep(name = "bazel_skylib", version = "1.5.0")
 bazel_dep(name = "platforms", version = "0.0.5")