Upgrade to Bazel 7.7.1 with modern clang-tidy integration and bzlmod-ready dependencies

.bazelrc

@@ -58,10 +58,8 @@ build:clang-tsan --linkopt -fsanitize=thread
 build:clang-tsan --test_env=TSAN_OPTIONS=suppressions=bazel/tsan_suppressions.txt
 
 # Use Clang-Tidy tool.
-build:clang-tidy --config=clang
-build:clang-tidy --aspects @bazel_clang_tidy//clang_tidy:clang_tidy.bzl%clang_tidy_aspect
-build:clang-tidy --@bazel_clang_tidy//:clang_tidy_config=@proxy_wasm_cpp_host//:clang_tidy_config
-build:clang-tidy --output_groups=report
+build:clang-tidy --aspects //tools/lint:linters.bzl%clang_tidy
+build:clang-tidy --output_groups=rules_lint_report
 
 # Use GCC compiler.
 build:gcc --action_env=BAZEL_COMPILER=gcc

.bazelversion

@@ -1 +1 @@
-6.5.0
+7.7.1

.github/workflows/test.yml

@@ -194,7 +194,7 @@ jobs:
         - name: 'V8 on macOS/x86_64'
           engine: 'v8'
           repo: 'v8'
-          os: macos-13
+          os: macos-15
           arch: x86_64
           action: test
           flags: --config=hermetic-llvm-macos
@@ -209,7 +209,7 @@ jobs:
         - name: 'WAMR interp on macOS/x86_64'
           engine: 'wamr-interp'
           repo: 'com_github_bytecodealliance_wasm_micro_runtime'
-          os: macos-13
+          os: macos-15
           arch: x86_64
           action: test
         - name: 'WAMR jit on Linux/x86_64'
@@ -224,7 +224,7 @@ jobs:
         - name: 'WAMR jit on macOS/x86_64'
           engine: 'wamr-jit'
           repo: 'com_github_bytecodealliance_wasm_micro_runtime'
-          os: macos-13
+          os: macos-15
           arch: x86_64
           action: test
           cache: true
@@ -238,7 +238,7 @@ jobs:
         - name: 'WasmEdge on macOS/x86_64'
           engine: 'wasmedge'
           repo: 'com_github_wasmedge_wasmedge'
-          os: macos-13
+          os: macos-15
           arch: x86_64
           action: test
         - name: 'Wasmtime on Linux/x86_64'
@@ -275,7 +275,7 @@ jobs:
         - name: 'Wasmtime on macOS/x86_64'
           engine: 'wasmtime'
           repo: 'com_github_bytecodealliance_wasmtime'
-          os: macos-13
+          os: macos-15
           arch: x86_64
           action: test
 

BUILD

@@ -133,7 +133,7 @@ cc_library(
     ],
     deps = [
         ":wasm_vm_headers",
-        "//external:wee8",
+        "@v8//:wee8",
     ],
 )
 
@@ -151,7 +151,7 @@ cc_library(
     ],
     deps = [
         ":wasm_vm_headers",
-        "//external:wamr",
+        "@com_github_bytecodealliance_wasm_micro_runtime//:wamr_lib",
     ],
 )
 
@@ -178,7 +178,7 @@ cc_library(
     }),
     deps = [
         ":wasm_vm_headers",
-        "//external:wasmedge",
+        "@com_github_wasmedge_wasmedge//:wasmedge_lib",
     ],
 )
 
@@ -217,7 +217,7 @@ cc_library(
     }),
     deps = [
         ":wasm_vm_headers",
-        "//external:wasmtime",
+        "@com_github_bytecodealliance_wasmtime//:wasmtime_lib",
     ],
 )
 
@@ -276,7 +276,7 @@ cc_library(
     }),
     deps = [
         ":wasm_vm_headers",
-        "//external:prefixed_wasmtime",
+        "@com_github_bytecodealliance_wasmtime//:prefixed_wasmtime_lib",
     ],
 )
 

WORKSPACE

@@ -8,6 +8,11 @@ load("@proxy_wasm_cpp_host//bazel:dependencies.bzl", "proxy_wasm_cpp_host_depend
 
 proxy_wasm_cpp_host_dependencies()
 
+# Setup bazel_features internal repos (required for aspect_rules_lint)
+load("@proxy_wasm_cpp_host//bazel:setup_features.bzl", "setup_bazel_features")
+
+setup_bazel_features()
+
 load("@proxy_wasm_cpp_host//bazel:dependencies_python.bzl", "proxy_wasm_cpp_host_dependencies_python")
 
 proxy_wasm_cpp_host_dependencies_python()

bazel/dependencies.bzl

@@ -12,6 +12,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+load("@aspect_rules_lint//format:repositories.bzl", "rules_lint_dependencies")
+load("@bazel_lib//lib:repositories.bzl", "bazel_lib_dependencies", "bazel_lib_register_toolchains")
 load("@com_google_protobuf//:protobuf_deps.bzl", "protobuf_deps")
 load("@envoy_toolshed//sysroot:sysroot.bzl", "setup_sysroots")
 load("@proxy_wasm_cpp_host//bazel/cargo/wasmsign/remote:crates.bzl", wasmsign_crate_repositories = "crate_repositories")
@@ -25,6 +27,11 @@ load("@toolchains_llvm//toolchain:rules.bzl", "llvm_toolchain")
 def proxy_wasm_cpp_host_dependencies():
     # Bazel extensions.
 
+    rules_lint_dependencies()
+
+    bazel_lib_dependencies()
+    bazel_lib_register_toolchains()
+
     py_repositories()
     python_register_toolchains(
         name = "python_3_9",
@@ -41,7 +48,7 @@ def proxy_wasm_cpp_host_dependencies():
             "wasm32-unknown-unknown",
             "wasm32-wasi",  # TODO: Change to wasm32-wasip1 once https://github.com/bazelbuild/rules_rust/issues/2782 is fixed
         ],
-        version = "1.77.2",
+        versions = ["1.77.2"],
     )
     rust_repository_set(
         name = "rust_linux_s390x",
@@ -50,7 +57,7 @@ def proxy_wasm_cpp_host_dependencies():
             "wasm32-unknown-unknown",
             "wasm32-wasi",
         ],
-        version = "1.77.2",
+        versions = ["1.77.2"],
     )
     crate_universe_dependencies(bootstrap = True)
 

bazel/repositories.bzl

@@ -19,15 +19,23 @@ load("@bazel_tools//tools/build_defs/repo:utils.bzl", "maybe")
 def proxy_wasm_cpp_host_repositories():
     # Bazel extensions.
 
+    maybe(
+        http_archive,
+        name = "bazel_features",
+        sha256 = "af3d4fb1cf4f25942cb4a933b1ad93a0ea9fe9ee70c2af7f369fb72a67c266e5",
+        strip_prefix = "bazel_features-1.21.0",
+        urls = ["https://github.com/bazel-contrib/bazel_features/releases/download/v1.21.0/bazel_features-v1.21.0.tar.gz"],
+    )
+
     # Update platforms for crate_universe. Can remove when we update Bazel version.
     maybe(
         http_archive,
         name = "platforms",
         urls = [
-            "https://mirror.bazel.build/github.com/bazelbuild/platforms/releases/download/0.0.10/platforms-0.0.10.tar.gz",
-            "https://github.com/bazelbuild/platforms/releases/download/0.0.10/platforms-0.0.10.tar.gz",
+            "https://mirror.bazel.build/github.com/bazelbuild/platforms/releases/download/1.0.0/platforms-1.0.0.tar.gz",
+            "https://github.com/bazelbuild/platforms/releases/download/1.0.0/platforms-1.0.0.tar.gz",
         ],
-        sha256 = "218efe8ee736d26a3572663b374a253c012b716d8af0c07e842e82f238a0a7ee",
+        sha256 = "3384eb1c30762704fbe38e440204e114154086c8fc8a8c2e3e28441028c019a8",
     )
 
     maybe(
@@ -48,14 +56,42 @@ def proxy_wasm_cpp_host_repositories():
         urls = ["https://github.com/bazelbuild/rules_cc/releases/download/0.0.9/rules_cc-0.0.9.tar.gz"],
     )
 
+    # aspect_rules_lint v1.12.0 for modern clang-tidy integration
     maybe(
         http_archive,
-        name = "bazel_clang_tidy",
-        sha256 = "6ed23cbff9423a30ef10becf57210a26d54fe198a211f4037d931c06f843c023",
-        strip_prefix = "bazel_clang_tidy-c2fe98cfec0430e78bff4169e9ca0a43123e4c99",
-        url = "https://github.com/erenon/bazel_clang_tidy/archive/c2fe98cfec0430e78bff4169e9ca0a43123e4c99.tar.gz",
-        patches = ["@proxy_wasm_cpp_host//bazel/external:bazel_clang_tidy.patch"],
-        patch_args = ["-p1"],
+        name = "aspect_rules_lint",
+        sha256 = "a8a63bd071a39bd5be1f99d9f258eac674673c98505f9fc5b4c76587f67278cd",
+        strip_prefix = "rules_lint-1.12.0",
+        url = "https://github.com/aspect-build/rules_lint/releases/download/v1.12.0/rules_lint-v1.12.0.tar.gz",
+    )
+
+    # bazel_lib v3.0.1 required by aspect_rules_lint v1.12.0
+    maybe(
+        http_archive,
+        name = "bazel_lib",
+        sha256 = "8b074b1a2731d29f6b95defdca95297354dc424492caf7019cf6b9f36afba54f",
+        strip_prefix = "bazel-lib-3.0.1",
+        url = "https://github.com/bazel-contrib/bazel-lib/releases/download/v3.0.1/bazel-lib-v3.0.1.tar.gz",
+    )
+
+    # aspect_bazel_lib alias for aspect_rules_js v2.1.2 compatibility
+    # aspect_rules_js expects @aspect_bazel_lib while aspect_rules_lint expects @bazel_lib
+    # Both repos reference the same bazel-lib v3.0.1 release to maintain consistency
+    maybe(
+        http_archive,
+        name = "aspect_bazel_lib",
+        sha256 = "8b074b1a2731d29f6b95defdca95297354dc424492caf7019cf6b9f36afba54f",
+        strip_prefix = "bazel-lib-3.0.1",
+        url = "https://github.com/bazel-contrib/bazel-lib/releases/download/v3.0.1/bazel-lib-v3.0.1.tar.gz",
+    )
+
+    # aspect_rules_js is required by aspect_rules_lint
+    maybe(
+        http_archive,
+        name = "aspect_rules_js",
+        sha256 = "fbc34d815a0cc52183a1a26732fc0329e26774a51abbe0f26fc9fd2dab6133b4",
+        strip_prefix = "rules_js-2.1.2",
+        url = "https://github.com/aspect-build/rules_js/releases/download/v2.1.2/rules_js-v2.1.2.tar.gz",
     )
 
     maybe(
@@ -98,8 +134,6 @@ def proxy_wasm_cpp_host_repositories():
         url = "https://github.com/bazelbuild/rules_python/releases/download/0.34.0/rules_python-0.34.0.tar.gz",
     )
 
-    # Keep at 0.42 one because https://github.com/bazelbuild/rules_rust/issues/2665
-    # manifests at 0.43
     maybe(
         http_archive,
         name = "rules_rust",
@@ -180,7 +214,7 @@ def proxy_wasm_cpp_host_repositories():
         # 13.8.258.26
         commit = "de9d0f8b56ae61896e4d2ac577fc589efb14f87d",
         remote = "https://chromium.googlesource.com/v8/v8",
-        shallow_since = "1752074621 -0400",
+        shallow_since = "1752074621 -0700",
         patches = [
             "@proxy_wasm_cpp_host//bazel/external:v8.patch",
         ],
@@ -257,11 +291,6 @@ def proxy_wasm_cpp_host_repositories():
         build_file = "@proxy_wasm_cpp_host//bazel/external:intel_ittapi.BUILD",
     )
 
-    native.bind(
-        name = "wee8",
-        actual = "@v8//:wee8",
-    )
-
     # WAMR with dependencies.
 
     maybe(
@@ -274,11 +303,6 @@ def proxy_wasm_cpp_host_repositories():
         url = "https://github.com/bytecodealliance/wasm-micro-runtime/archive/refs/tags/WAMR-2.4.1.zip",
     )
 
-    native.bind(
-        name = "wamr",
-        actual = "@com_github_bytecodealliance_wasm_micro_runtime//:wamr_lib",
-    )
-
     maybe(
         http_archive,
         name = "llvm-15_0_7",
@@ -299,11 +323,6 @@ def proxy_wasm_cpp_host_repositories():
         url = "https://github.com/WasmEdge/WasmEdge/archive/refs/tags/proxy-wasm/0.13.1.tar.gz",
     )
 
-    native.bind(
-        name = "wasmedge",
-        actual = "@com_github_wasmedge_wasmedge//:wasmedge_lib",
-    )
-
     # Wasmtime with dependencies.
 
     maybe(
@@ -314,13 +333,3 @@ def proxy_wasm_cpp_host_repositories():
         strip_prefix = "wasmtime-24.0.0",
         url = "https://github.com/bytecodealliance/wasmtime/archive/v24.0.0.tar.gz",
     )
-
-    native.bind(
-        name = "wasmtime",
-        actual = "@com_github_bytecodealliance_wasmtime//:wasmtime_lib",
-    )
-
-    native.bind(
-        name = "prefixed_wasmtime",
-        actual = "@com_github_bytecodealliance_wasmtime//:prefixed_wasmtime_lib",
-    )

bazel/setup_features.bzl

@@ -0,0 +1,21 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Setup bazel_features internal repositories."""
+
+load("@bazel_features//private:repos.bzl", "bazel_features_repos")
+
+def setup_bazel_features():
+    """Initialize bazel_features internal repos (needed for WORKSPACE compat)."""
+    bazel_features_repos()

tools/lint/BUILD

@@ -0,0 +1,30 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+load("@bazel_skylib//rules:native_binary.bzl", "native_binary")
+
+# Make hermetic clang-tidy available as a binary for aspect_rules_lint
+native_binary(
+    name = "clang_tidy",
+    src = select(
+        {
+            "@bazel_tools//src/conditions:linux_x86_64": "@llvm_toolchain_llvm//:bin/clang-tidy",
+            "@bazel_tools//src/conditions:linux_aarch64": "@llvm_toolchain_llvm//:bin/clang-tidy",
+            "@bazel_tools//src/conditions:darwin_x86_64": "@llvm_toolchain_llvm//:bin/clang-tidy",
+            "@bazel_tools//src/conditions:darwin_arm64": "@llvm_toolchain_llvm//:bin/clang-tidy",
+        },
+    ),
+    out = "clang_tidy",
+    visibility = ["//visibility:public"],
+)

tools/lint/linters.bzl

@@ -0,0 +1,23 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Linter configurations for the project."""
+
+load("@aspect_rules_lint//lint:clang_tidy.bzl", "lint_clang_tidy_aspect")
+
+# Configure clang-tidy to use the hermetic LLVM toolchain
+clang_tidy = lint_clang_tidy_aspect(
+    binary = "@@//tools/lint:clang_tidy",
+    configs = ["@@//:.clang-tidy"],
+)