Upgrade to Bazel 7.7.1 with modern clang-tidy integration and bzlmod-ready dependencies

[mmorel-35]

Major Changes

Bazel Upgrade

• Bazel: 6.5.0 → 7.7.1

Linting System Modernization

• Replaced: bazel_clang_tidy with aspect_rules_lint v1.12.0
• Added: tools/lint/ directory with BUILD and linters.bzl for hermetic clang-tidy configuration
• Updated: .bazelrc to use new linter aspect (//tools/lint:linters.bzl%clang_tidy)

Bzlmod Preparation (from native-bind and platforms branches)

• Removed native.bind(): All native.bind() calls removed from bazel/repositories.bzl. BUILD file now references dependencies directly using canonical labels (e.g., @v8//:wee8 instead of //external:wee8)
• Updated platforms: 0.0.10 → 1.0.0 (bzlmod compatible)

Dependency Updates

• rules_foreign_cc: 0.15.1 → 0.7.1 (stable version compatible with Bazel 7)
• rules_python: 0.34.0 (stable, no wheel extraction issues)
• rules_rust: 0.42.1 (Bazel 7 compatible with patch)
• rules_cc: 0.0.9 (compatible with rules_rust 0.42.1)
• bazel_features: 1.21.0 (stable)
• protobuf: 3.17.3 (stable)
• rules_fuzzing: 0.5.2 (stable version)
• platforms: 0.0.10 → 1.0.0 (bzlmod ready)
• proxy-wasm-cpp-sdk: 7465dee8 (latest WORKSPACE-compatible version)
• Python version: 3.9 (stable)

New Dependencies for Modern Linting

• aspect_rules_lint: v1.12.0 (modern clang-tidy integration for Bazel 7)
• bazel_lib: v3.0.1 (required by aspect_rules_lint)
• aspect_bazel_lib: v3.0.1 (alias for aspect_rules_js compatibility)
• aspect_rules_js: v2.1.2 (required by aspect_rules_lint)

WORKSPACE Configuration

Standard load order maintained:

proxy_wasm_cpp_host_repositories()
proxy_wasm_cpp_host_dependencies()
setup_bazel_features()

Infrastructure Changes

• Created tools/lint/BUILD with hermetic clang-tidy binary configuration
• Created tools/lint/linters.bzl with clang_tidy aspect configuration
• Fixed V8 shallow_since syntax for Bazel 7 compatibility (removed timezone)
• Updated .bazelrc clang-tidy configuration to use aspect_rules_lint
• Removed all native.bind() calls and updated BUILD file to use canonical dependency labels
• Updated rules_rust patch for Bazel 7 compatibility

Build Validation

✅ Bazel Upgrade: Successfully upgraded to 7.7.1

✅ Linting Infrastructure: Modern aspect_rules_lint integration configured

✅ Main Library Build: bazel build --config clang-tidy //:lib completes successfully

✅ C++ Tests: Build successfully with clang-tidy

✅ Bzlmod Preparation: native.bind() removed, direct dependency references working

⚠️ Known Limitation: wasm_rust_binary targets (test data) encounter whitelist_function_transition errors with rules_rust 0.42.1 on Bazel 7. This is a known compatibility issue that would require rules_rust 0.67.0+, which in turn requires rules_cc 0.2.x that creates dependency cycles in WORKSPACE mode. Upgrading to rules_rust 0.67.0+ requires migrating to bzlmod (MODULE.bazel). The issue only affects test data generation and does not impact the main library or clang-tidy functionality.

Fixes #466 Fixes #467 Fixes #468

[leonm1]

Hi @mmorel-35, do you mind if I push a few commits onto your branch? I think I might be able to resolve some of the build issues.

[mmorel-35]

Take all you need. I won’t be able to do anything in the next weeks . Feel free to proceed .

[leonm1]

Great work getting everything but the macos CI running! This is a huge improvement to the dependency management of proxy-wasm.

I will look into the llvm-ar issue affecting V8 on macos CI.

We may be able to fix the s390x CI by reverting the change I made to use python 3.11.

[mmorel-35]

S390x still uses ghcr.io/proxy-wasm/build-tools:ubuntu-22.04-bazel-6.5.0, If you know how to build and publish ghcr.io/proxy-wasm/build-tools:ubuntu-22.04-bazel-7.7.1 that would probably solve it.

Concerning MacOs, I switched config to the hermetic-llvm-macos, I don't know If that's related or not maybe I missed a spot or something

[leonm1]

I think we are running into https://github.com/bazel-contrib/toolchains_llvm/issues/238. Updating toolchains_llvm should help.

[mmorel-35]

Feel free to take care of this if you have the bandwidth for it