Migrate from WORKSPACE to MODULE.bazel.

This represents a pretty significant amount of work to move away from the old
and deprecated `WORKSPACE` way of managing Bazel external dependencies, to using
`MODULE.bazel` aka Bzlmod.

At this point, I have `bazel build //...` and `bazel test //...` up and running
smoothly. The only thing I am aware of that doesn't work is `bazel run
@hedron_compile_commands//:refresh_all`, but it seems that the issue I am
running into is getting fixed
[soon](hedronvision/bazel-compile-commands-extractor#262).

In the process of doing this I did a few things to get the migration over the
line.

**Migrated from `rules_docker` to `rules_oci`.** The former is more or less
deprecated and there's no Bazel module for it in BCR. There is a module for
`rules_oci` though, which seems to be the spiritual successor to `rules_docker`.
They do mostly the same things, although in different ways.

**Bumped version of most dependencies.** The main reason for doing so was to get
on versions of dependencies that likely had much better support for Bzlmod.

**Struggled a lot to get the dependencies on the Docker Go libraries working**,
and ended up refactoring my old version of `dockertest` in favor of one based on
`github.com/ory/dockertest/v3` which I know from professional experience works
perfectly fine and doesn't require me to do some of the lower-level Docker stuff
myself.

**Removed a bunch of the existing Docker-related stuff**, since I couldn't be
bothered to fix it and will likely not be using it in the near future anyway.

**Removed the `./bazel` script**, and chose to just rely on Bazelisk being
installed on the system instead.

Probably more things I'm forgetting, but they're probably not that important if
I can't think of them right now.

Author: saser

.bazelversion

@@ -1 +1 @@
-6.2.0
+8.3.1

BUILD.bazel

@@ -1,4 +1,4 @@
-load("@bazel_gazelle//:def.bzl", "gazelle")
+load("@gazelle//:def.bzl", "gazelle")
 
 # gazelle:exclude _tools
 # gazelle:exclude external

HOWTO.md

@@ -8,15 +8,14 @@ Requirements:
 *   `make`.
 *   `tar`.
 *   `unzip`.
+*   `bazel` (ideally `bazelisk` installed as `bazel`).
 
-This repository uses [`bazelisk`](https://github.com/bazelbuild/bazelisk) to install and run Bazel. In other words, you don't need to install it yourself. `bazelisk` is invoked via a script called `bazel` in the root of the repository.
-
-To run Bazel for building and testing
+To run Bazel for building and testing:
 
 ```shell
 # Assuming the root of the repository is the working directory.
-$ ./bazel build //...
-$ ./bazel test //...
+$ bazel build //...
+$ bazel test //...
 ```
 
 ## Updating Go dependencies
@@ -28,7 +27,7 @@ $ go get -u -t ./...             # updates direct dependencies
 $ go get -u -t -tags=tools ./... # updates direct tool dependencies, see tools.go in the root of the repository
 $ go mod tidy                    # clean up go.mod and go.sum
 $ make generate                  # regenerate code
-$ make fix                       # update repositories.bzl, BUILD files, etc
+$ make fix                       # update MODULE.bazel, BUILD files, etc
 $ make fix                       # possibly needed due to non-hermetic code formatters
 ```
 

MODULE.bazel

@@ -0,0 +1,114 @@
+module(
+    name = "code",
+    version = "0.1.0",
+)
+
+# -- bazel_dep definitions -- #
+
+bazel_dep(name = "gazelle", version = "0.45.0")
+bazel_dep(name = "rules_cc", version = "0.2.3")
+bazel_dep(name = "rules_go", version = "0.57.0")
+bazel_dep(name = "toolchains_llvm", version = "1.5.0")
+bazel_dep(name = "rules_oci", version = "2.2.6")
+
+# NOTE from the Bzlmod migration:
+# For the dependencies below, a higher version was used compared to what was in
+# WORKSPACE. The reason is that the WORKSPACE versions were often arbitrary
+# commit hashes and I couldn't be arsed to do overrides, and figured that these
+# dependencies had stable enough APIs that I can probably live with a later
+# version too.
+bazel_dep(name = "abseil-cpp", version = "20250814.0")
+bazel_dep(name = "google_benchmark", version = "1.9.4")
+bazel_dep(name = "googletest", version = "1.17.0")
+bazel_dep(name = "re2", version = "2025-08-12")
+
+bazel_dep(name = "hedron_compile_commands")
+git_override(
+    module_name = "hedron_compile_commands",
+    commit = "abb61a688167623088f8768cc9264798df6a9d10",
+    remote = "https://github.com/hedronvision/bazel-compile-commands-extractor.git",
+)
+
+# For some completely incomprehensible reason, there appears to be a dependency version problem in the combination of
+# - the `github.com/docker/docker` Go module
+# - the `re2` Bazel module
+# - the `rules_cc` Bazel module
+# - the `abseil-cpp` Bazel module
+# that causes build errors for me. They look like this:
+#
+#     $ bazel build //...
+#     ERROR: /home/saser/.cache/bazel/_bazel_saser/06ad534583e887506ca6aa175f8ed7b5/external/abseil-cpp+/absl/utility/BUILD.bazel: no such target '@@abseil-cpp+//absl/utility:if_constexpr': target 'if_constexpr' not declared in package 'absl/utility' defined by /home/saser/.cache/bazel/_bazel_saser/06ad534583e887506ca6aa175f8ed7b5/external/abseil-cpp+/absl/utility/BUILD.bazel
+#     ERROR: /home/saser/.cache/bazel/_bazel_saser/06ad534583e887506ca6aa175f8ed7b5/external/protobuf+/src/google/protobuf/BUILD.bazel:483:11: no such target '@@abseil-cpp+//absl/utility:if_constexpr': target 'if_constexpr' not declared in package 'absl/utility' defined by /home/saser/.cache/bazel/_bazel_saser/06ad534583e887506ca6aa175f8ed7b5/external/abseil-cpp+/absl/utility/BUILD.bazel and referenced by '@@protobuf+//src/google/protobuf:protobuf_lite'
+#     ERROR: Analysis of target '//docker/dockertest:dockertest' failed; build aborted: Analysis failed
+#     INFO: Elapsed time: 0.734s, Critical Path: 0.00s
+#     INFO: 1 process: 1 internal.
+#     ERROR: Build did NOT complete successfully
+#
+# And somehow, bumping the version of Protobuf (it resolves to 29.0 otherwise)
+# fixes this problem. I don't know why, but I'm keeping it here until further
+# notice. I might start relying on it anyway to run `protoc`, who knows.
+bazel_dep(name = "protobuf", version = "32.0")
+
+# NOTE: there was a dependency on bazel_skylib but I dropped it because I
+# couldn't find any references to it in this repo... can't remember why I added
+# it either, maybe to fix some transitive dependency?
+
+# -- use_repo_rule statements -- #
+
+# -- repo definitions -- #
+
+llvm = use_extension("@toolchains_llvm//toolchain/extensions:llvm.bzl", "llvm")
+llvm.toolchain(
+    llvm_version = "15.0.6",
+)
+use_repo(llvm, "llvm_toolchain")
+
+register_toolchains("@llvm_toolchain//:all")
+
+go_sdk = use_extension("@rules_go//go:extensions.bzl", "go_sdk")
+go_sdk.from_file(go_mod = "//:go.mod")
+
+go_deps = use_extension("@gazelle//:extensions.bzl", "go_deps")
+go_deps.from_file(go_mod = "//:go.mod")
+
+# See the README file located next to the patch file for an explanation of what
+# it does.
+go_deps.module_override(
+    patch_strip = 1,
+    patches = ["//patches/com_github_docker_cli:01-fix-broken-embeds.patch"],
+    path = "github.com/docker/cli",
+)
+
+# All *direct* Go dependencies of the module have to be listed explicitly.
+use_repo(go_deps, "cc_mvdan_gofumpt", "com_github_bazelbuild_buildtools", "com_github_cenkalti_backoff_v4", "com_github_google_go_cmp", "com_github_google_uuid", "com_github_jackc_pgerrcode", "com_github_jackc_pgx_v5", "com_github_jonboulle_clockwork", "com_github_masterminds_squirrel", "com_github_ory_dockertest_v3", "com_github_stretchr_testify", "io_k8s_klog_v2", "org_golang_google_grpc", "org_golang_google_grpc_cmd_protoc_gen_go_grpc", "org_golang_google_protobuf")
+
+oci = use_extension("@rules_oci//oci:extensions.bzl", "oci")
+oci.pull(
+    name = "distroless_base",
+    digest = "sha256:d605e138bb398428779e5ab490a6bbeeabfd2551bd919578b1044718e5c30798",
+    image = "gcr.io/distroless/base",
+    platforms = ["linux/amd64"],
+)
+oci.pull(
+    name = "hello_world",
+    digest = "sha256:a0dfb02aac212703bfcb339d77d47ec32c8706ff250850ecc0e19c8737b18567",
+    image = "hello-world",
+    platforms = ["linux/amd64"],
+)
+oci.pull(
+    name = "nginx",
+    # 'latest' as of 2025-09-13.
+    digest = "sha256:d5f28ef21aabddd098f3dbc21fe5b7a7d7a184720bc07da0b6c9b9820e97f25e",
+    image = "nginx",
+    platforms = ["linux/amd64"],
+)
+oci.pull(
+    name = "postgres",
+    # 'latest' as of 2025-09-13.
+    digest = "sha256:feff5b24fedd610975a1f5e743c51a4b360437f4dc3a11acf740dcd708f413f6",
+    image = "postgres",
+    platforms = ["linux/amd64"],
+)
+
+# For each oci.pull call, repeat the "name" here to expose them as dependencies.
+use_repo(oci, "distroless_base", "distroless_base_linux_amd64", "hello_world", "hello_world_linux_amd64", "nginx", "nginx_linux_amd64", "postgres", "postgres_linux_amd64")