chore(deps): update dependency rules_oci to v2 #131

renovate · 2025-12-11T05:14:18Z

Note: This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
rules_oci	bazel_dep	major	`1.7.4` -> `2.2.7`

Release Notes

bazel-contrib/rules_oci (rules_oci)

`v2.2.7`

Using bzlmod with Bazel 6 or later:

Add common --enable_bzlmod to .bazelrc.
Add to your MODULE.bazel file:

bazel_dep(name = "rules_oci", version = "2.2.7")

# For testing, we also recommend https://registry.bazel.build/modules/container_structure_test

oci = use_extension("@&#8203;rules_oci//oci:extensions.bzl", "oci")

# Declare external images you need to pull, for example: 
oci.pull(
    name = "distroless_base",
    # 'latest' is not reproducible, but it's convenient.
    # During the build we print a WARNING message that includes recommended 'digest' and 'platforms'
    # values which you can use here in place of 'tag' to pin for reproducibility.
    tag = "latest",
    image = "gcr.io/distroless/base",
    platforms = ["linux/amd64"],
)

# For each oci.pull call, repeat the "name" here to expose them as dependencies.
use_repo(oci, "distroless_base")

Using WORKSPACE:

load("@&#8203;bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

http_archive(
    name = "rules_oci",
    sha256 = "b8db7ab889d501db33313620b2c8040dbb07e95c26a0fefe06004b35baf80e08",
    strip_prefix = "rules_oci-2.2.7",
    url = "https://github.com/bazel-contrib/rules_oci/releases/download/v2.2.7/rules_oci-v2.2.7.tar.gz",
)

load("@&#8203;rules_oci//oci:dependencies.bzl", "rules_oci_dependencies")

rules_oci_dependencies()

load("@&#8203;rules_oci//oci:repositories.bzl", "oci_register_toolchains")

oci_register_toolchains(name = "oci")

# You can pull your base images using oci_pull like this:
load("@&#8203;rules_oci//oci:pull.bzl", "oci_pull")

oci_pull(
    name = "distroless_base",
    digest = "sha256:ccaef5ee2f1850270d453fdf700a5392534f8d1a8ca2acda391fbb6a06b81c86",
    image = "gcr.io/distroless/base",
    platforms = [
        "linux/amd64",
        "linux/arm64",
    ],
)

What's Changed

fix(publish): pick up secret when passed from caller workflow by @alexeagle in #793
refactor: upgrade tools pattern to direnv by @alexeagle in #807
Add missing dependency to //cosign:defs by @smertnik3sh in #810
chore(docs): stop recommending pkg_tar by @alexeagle in #808
docs(multiarch): add README to multiarch example by @calmette54 in #806
chore: move migration guide from aspect docsite. by @alexeagle in #813
chore(ci): setup aspect workflows by @alexeagle in #814
fix: correct bzl_library targets by @alexeagle in #812
Fix static content example by @fwalch in #818
feat(oci.pull): support registry and repository attributes by @abhinav in #828
feat(oci): make repository attribute optional in oci_push (#822) by @arubegonsan in #823
feat(cosign): make repository attribute optional in cosign rules by @arubegonsan in #824
oci_load: allow loader to be a target label by @dmivankov in #820
style: fix typo in authn.bzl www_authh -> www_auth by @zachburg in #830
fix: Allow credsStore and credHelpers to fail in some cases by @srdo-humio in #817
fix: don't use version 0.0.0 by @alexeagle in #834
fix: don't use version 0.0.0 by @alexeagle in #833
fix: Handle non-legacy external runfiles layout in oci_load by @sfc-gh-dbieliaiev in #838
docs: mention rules_buildx by @thesayyn in #843
chore: Upgrade cosign to latest 2.x version by @honnix in #848
build: Update bazel_skylib dependency by @jaqx0r in #829
fix: update the complete example to use oci_load instead of oci_tarball by @oxmo456 in #849
fix: Use rlocation for runfiles in push script by @contagnas in #804
docs: Update README.md for rules_img by @alexeagle in #862
Suppress regctl stderr in image.sh by @cjm-dd in #863
Remove check for repository attribute to allow passing it as flag by @mering in #859
Fix token overwritten by empty access_token field (fixes #801) by @WnP in #856
support nerdctl (containerd) by @peakschris in #851
fix: deduplicate blobs when downloading by @thesayyn in #871

New Contributors

@smertnik3sh made their first contribution in #810
@calmette54 made their first contribution in #806
@fwalch made their first contribution in #818
@abhinav made their first contribution in #828
@arubegonsan made their first contribution in #823
@zachburg made their first contribution in #830
@srdo-humio made their first contribution in #817
@sfc-gh-dbieliaiev made their first contribution in #838
@jaqx0r made their first contribution in #829
@oxmo456 made their first contribution in #849
@contagnas made their first contribution in #804
@cjm-dd made their first contribution in #863
@WnP made their first contribution in #856
@peakschris made their first contribution in #851

Full Changelog: bazel-contrib/rules_oci@v2.2.6...v2.2.7

`v2.2.6`

Using bzlmod with Bazel 6 or later:

Add common --enable_bzlmod to .bazelrc.
Add to your MODULE.bazel file:

bazel_dep(name = "rules_oci", version = "2.2.6")

# For testing, we also recommend https://registry.bazel.build/modules/container_structure_test

oci = use_extension("@&#8203;rules_oci//oci:extensions.bzl", "oci")

# Declare external images you need to pull, for example: 
oci.pull(
    name = "distroless_base",
    # 'latest' is not reproducible, but it's convenient.
    # During the build we print a WARNING message that includes recommended 'digest' and 'platforms'
    # values which you can use here in place of 'tag' to pin for reproducibility.
    tag = "latest",
    image = "gcr.io/distroless/base",
    platforms = ["linux/amd64"],
)

# For each oci.pull call, repeat the "name" here to expose them as dependencies.
use_repo(oci, "distroless_base")

Using WORKSPACE:

load("@&#8203;bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

http_archive(
    name = "rules_oci",
    sha256 = "5994ec0e8df92c319ef5da5e1f9b514628ceb8fc5824b4234f2fe635abb8cc2e",
    strip_prefix = "rules_oci-2.2.6",
    url = "https://github.com/bazel-contrib/rules_oci/releases/download/v2.2.6/rules_oci-v2.2.6.tar.gz",
)

load("@&#8203;rules_oci//oci:dependencies.bzl", "rules_oci_dependencies")

rules_oci_dependencies()

load("@&#8203;rules_oci//oci:repositories.bzl", "oci_register_toolchains")

oci_register_toolchains(name = "oci")

# You can pull your base images using oci_pull like this:
load("@&#8203;rules_oci//oci:pull.bzl", "oci_pull")

oci_pull(
    name = "distroless_base",
    digest = "sha256:ccaef5ee2f1850270d453fdf700a5392534f8d1a8ca2acda391fbb6a06b81c86",
    image = "gcr.io/distroless/base",
    platforms = [
        "linux/amd64",
        "linux/arm64",
    ],
)

What's Changed

refactor: publish better buildx api by @thesayyn in #788
example: use docker tarball as base image by @thesayyn in #789
image_index.sh.tpl: use "dirname" from COREUTILS by @dmivankov in #790
chore: use new Publish-to-BCR by @alexeagle in #792

New Contributors

@dmivankov made their first contribution in #790

Full Changelog: bazel-contrib/rules_oci@v2.2.5...v2.2.6

`v2.2.5`

Using bzlmod with Bazel 6 or later:

Add common --enable_bzlmod to .bazelrc.
Add to your MODULE.bazel file:

bazel_dep(name = "rules_oci", version = "2.2.5")

# For testing, we also recommend https://registry.bazel.build/modules/container_structure_test

oci = use_extension("@&#8203;rules_oci//oci:extensions.bzl", "oci")

# Declare external images you need to pull, for example: 
oci.pull(
    name = "distroless_base",
    # 'latest' is not reproducible, but it's convenient.
    # During the build we print a WARNING message that includes recommended 'digest' and 'platforms'
    # values which you can use here in place of 'tag' to pin for reproducibility.
    tag = "latest",
    image = "gcr.io/distroless/base",
    platforms = ["linux/amd64"],
)

# For each oci.pull call, repeat the "name" here to expose them as dependencies.
use_repo(oci, "distroless_base")

Using WORKSPACE:

load("@&#8203;bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

http_archive(
    name = "rules_oci",
    sha256 = "361c417e8c95cd7c3d8b5cf4b202e76bac8d41532131534ff8e6fa43aa161142",
    strip_prefix = "rules_oci-2.2.5",
    url = "https://github.com/bazel-contrib/rules_oci/releases/download/v2.2.5/rules_oci-v2.2.5.tar.gz",
)

load("@&#8203;rules_oci//oci:dependencies.bzl", "rules_oci_dependencies")

rules_oci_dependencies()

load("@&#8203;rules_oci//oci:repositories.bzl", "oci_register_toolchains")

oci_register_toolchains(name = "oci")

# You can pull your base images using oci_pull like this:
load("@&#8203;rules_oci//oci:pull.bzl", "oci_pull")

oci_pull(
    name = "distroless_base",
    digest = "sha256:ccaef5ee2f1850270d453fdf700a5392534f8d1a8ca2acda391fbb6a06b81c86",
    image = "gcr.io/distroless/base",
    platforms = [
        "linux/amd64",
        "linux/arm64",
    ],
)

Full Changelog: bazel-contrib/rules_oci@v2.2.4...v2.2.5

`v2.2.3`

Using bzlmod with Bazel 6 or later:

Add common --enable_bzlmod to .bazelrc.
Add to your MODULE.bazel file:

bazel_dep(name = "rules_oci", version = "2.2.3")

# For testing, we also recommend https://registry.bazel.build/modules/container_structure_test

oci = use_extension("@&#8203;rules_oci//oci:extensions.bzl", "oci")

# Declare external images you need to pull, for example: 
oci.pull(
    name = "distroless_base",
    # 'latest' is not reproducible, but it's convenient.
    # During the build we print a WARNING message that includes recommended 'digest' and 'platforms'
    # values which you can use here in place of 'tag' to pin for reproducibility.
    tag = "latest",
    image = "gcr.io/distroless/base",
    platforms = ["linux/amd64"],
)

# For each oci.pull call, repeat the "name" here to expose them as dependencies.
use_repo(oci, "distroless_base")

Using WORKSPACE:

load("@&#8203;bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

http_archive(
    name = "rules_oci",
    sha256 = "1e7759852e8cad966ca793412d292f1d4af5831940fb2cb573f1890ad1e9641e",
    strip_prefix = "rules_oci-2.2.3",
    url = "https://github.com/bazel-contrib/rules_oci/releases/download/v2.2.3/rules_oci-v2.2.3.tar.gz",
)

load("@&#8203;rules_oci//oci:dependencies.bzl", "rules_oci_dependencies")

rules_oci_dependencies()

load("@&#8203;rules_oci//oci:repositories.bzl", "oci_register_toolchains")

oci_register_toolchains(name = "oci")

# You can pull your base images using oci_pull like this:
load("@&#8203;rules_oci//oci:pull.bzl", "oci_pull")

oci_pull(
    name = "distroless_base",
    digest = "sha256:ccaef5ee2f1850270d453fdf700a5392534f8d1a8ca2acda391fbb6a06b81c86",
    image = "gcr.io/distroless/base",
    platforms = [
        "linux/amd64",
        "linux/arm64",
    ],
)

What's Changed

Add --use --bootstrap to dockerfile builder example by @vinnybod in #775
authn: allow builtin credential handling to fail conditionally by @malt3 in #778

Full Changelog: bazel-contrib/rules_oci@v2.2.2...v2.2.3

`v2.2.2`

Using bzlmod with Bazel 6 or later:

Add common --enable_bzlmod to .bazelrc.
Add to your MODULE.bazel file:

bazel_dep(name = "rules_oci", version = "2.2.2")

# For testing, we also recommend https://registry.bazel.build/modules/container_structure_test

oci = use_extension("@&#8203;rules_oci//oci:extensions.bzl", "oci")

# Declare external images you need to pull, for example: 
oci.pull(
    name = "distroless_base",
    # 'latest' is not reproducible, but it's convenient.
    # During the build we print a WARNING message that includes recommended 'digest' and 'platforms'
    # values which you can use here in place of 'tag' to pin for reproducibility.
    tag = "latest",
    image = "gcr.io/distroless/base",
    platforms = ["linux/amd64"],
)

# For each oci.pull call, repeat the "name" here to expose them as dependencies.
use_repo(oci, "distroless_base")

Using WORKSPACE:

load("@&#8203;bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

http_archive(
    name = "rules_oci",
    sha256 = "8676144f96dd63294333906b26dea2388f61cadaf1dea59a225e7dbc52cc72fa",
    strip_prefix = "rules_oci-2.2.2",
    url = "https://github.com/bazel-contrib/rules_oci/releases/download/v2.2.2/rules_oci-v2.2.2.tar.gz",
)

load("@&#8203;rules_oci//oci:dependencies.bzl", "rules_oci_dependencies")

rules_oci_dependencies()

load("@&#8203;rules_oci//oci:repositories.bzl", "oci_register_toolchains")

oci_register_toolchains(name = "oci")

# You can pull your base images using oci_pull like this:
load("@&#8203;rules_oci//oci:pull.bzl", "oci_pull")

oci_pull(
    name = "distroless_base",
    digest = "sha256:ccaef5ee2f1850270d453fdf700a5392534f8d1a8ca2acda391fbb6a06b81c86",
    image = "gcr.io/distroless/base",
    platforms = [
        "linux/amd64",
        "linux/arm64",
    ],
)

What's Changed

refactor: remove workspace by @alexeagle in #767
fix: drop embedded config data from manifest image by @plobsing in #774

Full Changelog: bazel-contrib/rules_oci@v2.2.1...v2.2.2

`v2.2.1`

Using bzlmod with Bazel 6 or later:

Add common --enable_bzlmod to .bazelrc.
Add to your MODULE.bazel file:

bazel_dep(name = "rules_oci", version = "2.2.1")

# For testing, we also recommend https://registry.bazel.build/modules/container_structure_test

oci = use_extension("@&#8203;rules_oci//oci:extensions.bzl", "oci")

# Declare external images you need to pull, for example: 
oci.pull(
    name = "distroless_base",
    # 'latest' is not reproducible, but it's convenient.
    # During the build we print a WARNING message that includes recommended 'digest' and 'platforms'
    # values which you can use here in place of 'tag' to pin for reproducibility.
    tag = "latest",
    image = "gcr.io/distroless/base",
    platforms = ["linux/amd64"],
)

# For each oci.pull call, repeat the "name" here to expose them as dependencies.
use_repo(oci, "distroless_base")

Using WORKSPACE:

load("@&#8203;bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

http_archive(
    name = "rules_oci",
    sha256 = "cfea16076ebbec1faea494882ab97d94b1a62d6bcd5aceabad8f95ea0d0a1361",
    strip_prefix = "rules_oci-2.2.1",
    url = "https://github.com/bazel-contrib/rules_oci/releases/download/v2.2.1/rules_oci-v2.2.1.tar.gz",
)

load("@&#8203;rules_oci//oci:dependencies.bzl", "rules_oci_dependencies")

rules_oci_dependencies()

load("@&#8203;rules_oci//oci:repositories.bzl", "oci_register_toolchains")

oci_register_toolchains(name = "oci")

# You can pull your base images using oci_pull like this:
load("@&#8203;rules_oci//oci:pull.bzl", "oci_pull")

oci_pull(
    name = "distroless_base",
    digest = "sha256:ccaef5ee2f1850270d453fdf700a5392534f8d1a8ca2acda391fbb6a06b81c86",
    image = "gcr.io/distroless/base",
    platforms = [
        "linux/amd64",
        "linux/arm64",
    ],
)

What's Changed

Fix compatibilty with symbolic macros by @dzbarsky in #759
Handle not-logged-in public repos with credsStore by @fahhem in #731

New Contributors

@dzbarsky made their first contribution in #759
@fahhem made their first contribution in #731

Full Changelog: bazel-contrib/rules_oci@v2.2.0...v2.2.1

`v2.2.0`

Using bzlmod with Bazel 6 or later:

Add common --enable_bzlmod to .bazelrc.
Add to your MODULE.bazel file:

bazel_dep(name = "rules_oci", version = "2.2.0")

# For testing, we also recommend https://registry.bazel.build/modules/container_structure_test

oci = use_extension("@&#8203;rules_oci//oci:extensions.bzl", "oci")

# Declare external images you need to pull, for example: 
oci.pull(
    name = "distroless_base",
    # 'latest' is not reproducible, but it's convenient.
    # During the build we print a WARNING message that includes recommended 'digest' and 'platforms'
    # values which you can use here in place of 'tag' to pin for reproducibility.
    tag = "latest",
    image = "gcr.io/distroless/base",
    platforms = ["linux/amd64"],
)

# For each oci.pull call, repeat the "name" here to expose them as dependencies.
use_repo(oci, "distroless_base")

Using WORKSPACE:

load("@&#8203;bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

http_archive(
    name = "rules_oci",
    sha256 = "1bd16e455278d523f01326e0c3964cd64d7840a7e99cdd6e2617e59f698f3504",
    strip_prefix = "rules_oci-2.2.0",
    url = "https://github.com/bazel-contrib/rules_oci/releases/download/v2.2.0/rules_oci-v2.2.0.tar.gz",
)

load("@&#8203;rules_oci//oci:dependencies.bzl", "rules_oci_dependencies")

rules_oci_dependencies()

load("@&#8203;rules_oci//oci:repositories.bzl", "oci_register_toolchains")

oci_register_toolchains(name = "oci")

# You can pull your base images using oci_pull like this:
load("@&#8203;rules_oci//oci:pull.bzl", "oci_pull")

oci_pull(
    name = "distroless_base",
    digest = "sha256:ccaef5ee2f1850270d453fdf700a5392534f8d1a8ca2acda391fbb6a06b81c86",
    image = "gcr.io/distroless/base",
    platforms = [
        "linux/amd64",
        "linux/arm64",
    ],
)

What's Changed

use compression in examples by @pdeva in #718
Add a plus sign to the output_groups option by @lexspoon in #707
refactor: remote_tags unnecessarily restrictive by @thesayyn in #726
Update scala.md: oci_tarball was renamed by @alexeagle in #728
doc: cover the inline-specified variants of arguments to oci_image by @plobsing in #705
fix: pass global args to all crane invocations by @ahans in #709
Introduce new attribute on oci_image for created datetime by @hanneskaeufler in #724
Fix macOS CI after #724 by @hanneskaeufler in #730
feat: Possible to skip cosign toolchains registration by @honnix in #733
chore: upgrade regctl by @alexeagle in #744
chore(cd): automate release tagging by @alexeagle in #745
chore(ci): disable two failing tests by @alexeagle in #747
chore: fix tag name when called by workflow by @alexeagle in #749
feat: Transition oci_image_index into a macro with additional [name].digest target by @mislavmandaricaxilis in #742

New Contributors

@pdeva made their first contribution in #718
@lexspoon made their first contribution in #707
@ahans made their first contribution in #709
@hanneskaeufler made their first contribution in #724
@honnix made their first contribution in #733
@mislavmandaricaxilis made their first contribution in #742

Full Changelog: bazel-contrib/rules_oci@v2.0.1...v2.2.0

`v2.0.1`

Using bzlmod with Bazel 6 or later:

Add common --enable_bzlmod to .bazelrc.
Add to your MODULE.bazel file:

bazel_dep(name = "rules_oci", version = "2.0.1")

# For testing, we also recommend https://registry.bazel.build/modules/container_structure_test

oci = use_extension("@&#8203;rules_oci//oci:extensions.bzl", "oci")

# Declare external images you need to pull, for example: 
oci.pull(
    name = "distroless_base",
    # 'latest' is not reproducible, but it's convenient.
    # During the build we print a WARNING message that includes recommended 'digest' and 'platforms'
    # values which you can use here in place of 'tag' to pin for reproducibility.
    tag = "latest",
    image = "gcr.io/distroless/base",
    platforms = ["linux/amd64"],
)

# For each oci.pull call, repeat the "name" here to expose them as dependencies.
use_repo(oci, "distroless_base")

Using WORKSPACE:

load("@&#8203;bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

http_archive(
    name = "rules_oci",
    sha256 = "acbf8f40e062f707f8754e914dcb0013803c6e5e3679d3e05b571a9f5c7e0b43",
    strip_prefix = "rules_oci-2.0.1",
    url = "https://github.com/bazel-contrib/rules_oci/releases/download/v2.0.1/rules_oci-v2.0.1.tar.gz",
)

load("@&#8203;rules_oci//oci:dependencies.bzl", "rules_oci_dependencies")

rules_oci_dependencies()

load("@&#8203;rules_oci//oci:repositories.bzl", "oci_register_toolchains")

oci_register_toolchains(name = "oci")

# You can pull your base images using oci_pull like this:
load("@&#8203;rules_oci//oci:pull.bzl", "oci_pull")

oci_pull(
    name = "distroless_base",
    digest = "sha256:ccaef5ee2f1850270d453fdf700a5392534f8d1a8ca2acda391fbb6a06b81c86",
    image = "gcr.io/distroless/base",
    platforms = [
        "linux/amd64",
        "linux/arm64",
    ],
)

What's Changed

fix: declare and register regctl toolchains only for compatible platforms by @lbcjbb in #692
doc: mention containerd requirement by @thesayyn in #694
chore: bump to stardoc 0.6.2 by @gregmagolan in #719

Full Changelog: bazel-contrib/rules_oci@v2.0.0...v2.0.1

`v2.0.0`

BREAKING CHANGES

Uncompressed archives in the tars attribute is no longer compressed when creating the image, this might make images bigger compared to 1.x. Use pkg_tar#extension or tar#compress attribute to compress the layers beforehand.

# For pkg_tar
pkg_tar(
  extension = "tar.gz"
)

# For tar
tar(
   compress = "gzip"
)

Digests of images created 1.x rules_oci will not match 2.x rules_oci, as we are no longer use crane tool to create the images. However, images should stay the same semantically. You can use diffoci to make sure they are the same semantically!
Default output of oci_tarball is no longer a tarball, use a filegroup target to get the tarball. See #548
oci_tarball is renamed to oci_load to better reflect it's purpose.
Bazel 5 is no longer supported, and is not tested by the CI, we will not be accepting fixes for it.
Delimiter for cmd and entrypoint changed from , to \n. See: #663

SIGNIFICANT CHANGES

OCIImage action no longer spins an ephemeral registry instance to mutate images locally, making it slightly faster. See design document
oci_image now supports zstd compression
Now oci_pull fetches blobs in parallel on Bazel >= 7.1

API Removals

oci_pull no longer has a config_path attribute, use config attribute instead. It was deprecated in 1.x.

Using bzlmod with Bazel 6 or later:

Add common --enable_bzlmod to .bazelrc.
Add to your MODULE.bazel file:

bazel_dep(name = "rules_oci", version = "2.0.0")

# For testing, we also recommend https://registry.bazel.build/modules/container_structure_test

oci = use_extension("@&#8203;rules_oci//oci:extensions.bzl", "oci")

# Declare external images you need to pull, for example: 
oci.pull(
    name = "distroless_base",
    # 'latest' is not reproducible, but it's convenient.
    # During the build we print a WARNING message that includes recommended 'digest' and 'platforms'
    # values which you can use here in place of 'tag' to pin for reproducibility.
    tag = "latest",
    image = "gcr.io/distroless/base",
    platforms = ["linux/amd64"],
)

# For each oci.pull call, repeat the "name" here to expose them as dependencies.
use_repo(oci, "distroless_base")

Using WORKSPACE:

load("@&#8203;bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

http_archive(
    name = "rules_oci",
    sha256 = "d007e6c96eb62c88397b68f329e4ca56e0cfe31204a2c54b0cb17819f89f83c8",
    strip_prefix = "rules_oci-2.0.0",
    url = "https://github.com/bazel-contrib/rules_oci/releases/download/v2.0.0/rules_oci-v2.0.0.tar.gz",
)

load("@&#8203;rules_oci//oci:dependencies.bzl", "rules_oci_dependencies")

rules_oci_dependencies()

load("@&#8203;rules_oci//oci:repositories.bzl", "oci_register_toolchains")

oci_register_toolchains(name = "oci")

# You can pull your base images using oci_pull like this:
load("@&#8203;rules_oci//oci:pull.bzl", "oci_pull")

oci_pull(
    name = "distroless_base",
    digest = "sha256:ccaef5ee2f1850270d453fdf700a5392534f8d1a8ca2acda391fbb6a06b81c86",
    image = "gcr.io/distroless/base",
    platforms = [
        "linux/amd64",
        "linux/arm64",
    ],
)

What's Changed

docs: simplify use of expand_template by @alexeagle in #534
chore: upgrade rules_go and gazelle by @thesayyn in #541
ci: only test with bazel 6, 7 by @thesayyn in #533
Add a minimal c++ example in doc by @rygx in #516
[docs] Add missing name to push examples by @ptxmac in #513
feat: add nvcr.io to _WWW_AUTH by @nobu-k in #511
fix: Add quay back to authn config by @ankit-agarwal1999 in #543
docs: recommend rules_distroless by @thesayyn in #546
refactor: remove yq dependency by @thesayyn in #386
refactor: use hermetic tar by @alexeagle in #385
Add toolchain param to the affected actions by @kotlaja in #341
Pass headers to Bazel downloader where available by @mortenmj in #528
feat: don't produce big tar file as default output of oci_tarball by @alexeagle in #548
refactor: remove registry references by @thesayyn in #551
chore: update deps and bazel by @thesayyn in #553
refactor: registryless oci_image by @thesayyn in #550
feat: implement out-of-band descriptor calculation by @thesayyn in #558
feat: implement tars symlinks by @thesayyn in #559
feat: support symlinking blobs from base by @thesayyn in #560
fix: make oci_image fully hermetic by @thesayyn in #569
fix: canonicalize missing components by @thesayyn in #567
fix: duplicate tar copying by @thesayyn in #576
Add jq as dependency required for oci_push by @mering in #589
example: add dockerfile build by @thesayyn in #570
refactor: remove curl fallback by @thesayyn in #568
Use non-blocking download to get image blobs, on Bazel >=7.1.0 by @mortenmj in #601
fix: add tars into action inputs by @thesayyn in #599
chore: disable dockerfile example by @thesayyn in #605
fix: return correct extension metadata by @thesayyn in #611
chore: add --check_direct_dependencies to .bazelrc by @gregmagolan in #615
fix: make oci_tarball work with disjoint output root by @thesayyn in #614
Copy files using coreutils cp by @plobsing in #595
Fix jq: error (at <stdin>:16): Cannot use null (null) as object key error on empty line in labels file by @bozaro in #606
fix: env vars containing = by @thesayyn in #616
test: add pinning test by @thesayyn in #618
chore: cleanup repo and remove some dev deps by @thesayyn in #620
fix: make oci_tarball work with genrule by @thesayyn in #621
fix: Ignore empty annotations in the jq query by @DolceTriade in #625
test: add oci_tarball test for sh_test by @thesayyn in #624
feat: add support for settings volumes by @gzm0 in #632
refactor: rename oci_tarball to oci_load by @alexeagle in #636
fix: accumulate image manifests in oci_image_index by @seh in #633
tarball uses hermetic coreutils by @rickvanprim in #635
fix: propagate transitive inputs by @thesayyn in #646
fix: support external oci_image targets by @thesayyn in #622
fix: reset cmd when entrypoint is set by @thesayyn in #656
fix: set created property for scratch base by @thesayyn in #655
Mention ociupdate in the README by @mark-thm in #660
fix: add history entries for tars attribute by @thesayyn in #654
fix typo in load.sh.tpl by @kopp in #657
test: add test for setting entrypoint to [] by @thesayyn in #662
fix: comma in entrypoint and cmd by @thesayyn in #663
fix: ensures confugure_buildx rule runs when bazel server restarts by @kvet in #670
chore: remove deprecated config_path attribute by @thesayyn in #666
Fix for gnu xargs and send --verbose to other commands by @vinnybod in #672
fix: include examples by @thesayyn in #682
chore(docs): mention rules_multirun by @alexeagle in #681
refactor: mention url rewriter in oci_pull errors by @thesayyn in #675
Allow bazel_tags in bzlmod extension (fixes #686) by @samsternatretool in #687
Add Blzmod example to pull.md by @jjmaestro in #671
refactor: remove mtree as the default output by @thesayyn in #676

New Contributors

@rygx made their first contribution in #516
@ptxmac made their first contribution in #513
@nobu-k made their first contribution in #511
@ankit-agarwal1999 made their first contribution in #543
@kotlaja made their first contribution in #341
@mering made their first contribution in #589
@plobsing made their first contribution in #595
@bozaro made their first contribution in #606
@DolceTriade made their first contribution in #625
@seh made their first contribution in #633
@rickvanprim made their first contribution in #635
@kopp made their first contribution in #657
@kvet made their first contribution in #670
@vinnybod made their first contribution in #672
@samsternatretool made their first contribution in #687
@jjmaestro made their first contribution in #671

Full Changelog: bazel-contrib/rules_oci@v1.7.5...v2.0.0

`v1.8.0`

Using bzlmod with Bazel 6 or later:

Add common --enable_bzlmod to .bazelrc.
Add to your MODULE.bazel file:

bazel_dep(name = "rules_oci", version = "1.8.0")

# For testing, we also recommend https://registry.bazel.build/modules/container_structure_test

oci = use_extension("@&#8203;rules_oci//oci:extensions.bzl", "oci")

# Declare external images you need to pull, for example: 
oci.pull(
    name = "distroless_base",
    # 'latest' is not reproducible, but it's convenient.
    # During the build we print a WARNING message that includes recommended 'digest' and 'platforms'
    # values which you can use here in place of 'tag' to pin for reproducibility.
    tag = "latest",
    image = "gcr.io/distroless/base",
    platforms = ["linux/amd64"],
)

# For each oci.pull call, repeat the "name" here to expose them as dependencies.
use_repo(oci, "distroless_base")

Using WORKSPACE:

load("@&#8203;bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

http_archive(
    name = "rules_oci",
    sha256 = "46ce9edcff4d3d7b3a550774b82396c0fa619cc9ce9da00c1b09a08b45ea5a14",
    strip_prefix = "rules_oci-1.8.0",
    url = "https://github.com/bazel-contrib/rules_oci/releases/download/v1.8.0/rules_oci-v1.8.0.tar.gz",
)

load("@&#8203;rules_oci//oci:dependencies.bzl", "rules_oci_dependencies")

rules_oci_dependencies()

load("@&#8203;rules_oci//oci:repositories.bzl", "LATEST_CRANE_VERSION", "oci_register_toolchains")

oci_register_toolchains(
    name = "oci",
    crane_version = LATEST_CRANE_VERSION,
    # Uncommenting the zot toolchain will cause it to be used instead of crane for some tasks.
    # Note that it does not support docker-format images.
    # zot_version = LATEST_ZOT_VERSION,
)

# You can pull your base images using oci_pull like this:
load("@&#8203;rules_oci//oci:pull.bzl", "oci_pull")

oci_pull(
    name = "distroless_base",
    digest = "sha256:ccaef5ee2f1850270d453fdf700a5392534f8d1a8ca2acda391fbb6a06b81c86",
    image = "gcr.io/distroless/base",
    platforms = [
        "linux/amd64",
        "linux/arm64",
    ],
)

What's Changed

--unwrapScalar for yq cmd by @kczulko in #594
Use a transition to resolve the correct versions of crane and yq by @EdSchouten in #590
Add import_tags attribute to oci_pull by @steve-261370 in #573
fix: Support global credsStore in docker config by @msiebuhr in #602
Document how to use rules_oci with scala by @lukaszwawrzyk in #630
feat(oci_pull): expose the digest as a file by @aignas in #542
feat: provide affordance for OCIImage actions to reserve more resources by @alexeagle in #650

New Contributors

@EdSchouten made their first contribution in #590
@steve-261370 made their first contribution in #573
@msiebuhr made their first contribution in #602
@lukaszwawrzyk made their first contribution in #630
@aignas made their first contribution in #542

Full Changelog: bazel-contrib/rules_oci@v1.7.6...v1.8.0

`v1.7.6`

Using bzlmod with Bazel 6 or later:

Add common --enable_bzlmod to .bazelrc.
Add to your MODULE.bazel file:

bazel_dep(name = "rules_oci", version = "1.7.6")

# For testing, we also recommend https://registry.bazel.build/modules/container_structure_test

oci = use_extension("@&#8203;rules_oci//oci:extensions.bzl", "oci")

# Declare external images you need to pull, for example: 
oci.pull(
    name = "distroless_base",
    # 'latest' is not reproducible, but it's convenient.
    # During the build we print a WARNING message that includes recommended 'digest' and 'platforms'
    # values which you can use here in place of 'tag' to pin for reproducibility.
    tag = "latest",
    image = "gcr.io/distroless/base",
    platforms = ["linux/amd64"],
)

# For each oci.pull call, repeat the "name" here to expose them as dependencies.
use_repo(oci, "distroless_base")

Using WORKSPACE:

load("@&#8203;bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

http_archive(
    name = "rules_oci",
    sha256 = "647f4c6fd092dc7a86a7f79892d4b1b7f1de288bdb4829ca38f74fd430fcd2fe",
    strip_prefix = "rules_oci-1.7.6",
    url = "https://github.com/bazel-contrib/rules_oci/releases/download/v1.7.6/rules_oci-v1.7.6.tar.gz",
)

load("@&#8203;rules_oci//oci:dependencies.bzl", "rules_oci_dependencies")

rules_oci_dependencies()

load("@&#8203;rules_oci//oci:repositories.bzl", "LATEST_CRANE_VERSION", "oci_register_toolchains")

oci_register_toolchains(
    name = "oci",
    crane_version = LATEST_CRANE_VERSION,
    # Uncommenting the zot toolchain will cause it to be used instead of crane for some tasks.
    # Note that it does not support docker-format images.
    # zot_version = LATEST_ZOT_VERSION,
)

# You can pull your base images using oci_pull like this:
load("@&#8203;rules_oci//oci:pull.bzl", "oci_pull")

oci_pull(
    name = "distroless_base",
    digest = "sha256:ccaef5ee2f1850270d453fdf700a5392534f8d1a8ca2acda391fbb6a06b81c86",
    image = "gcr.io/distroless/base",
    platforms = [
        "linux/amd64",
        "linux/arm64",
    ],
)

What's Changed

docs: simplify use of expand_template by @alexeagle in #534
chore: upgrade rules_go and gazelle by @thesayyn in #541
ci: only test with bazel 6, 7 by @thesayyn in #533
Add a minimal c++ example in doc by @rygx in #516
[docs] Add missing name to push examples by @ptxmac in #513
feat: add nvcr.io to _WWW_AUTH by @nobu-k in #511
fix: Add quay back to authn config by @ankit-agarwal1999 in #543
docs: recommend rules_distroless by [@thes

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

aspect-workflows · 2025-12-11T05:27:26Z

Test (Bazel 7.x) (Test)

⚠️ Buildkite build #99 failed.

Test (Bazel 8.x) (Test)

⚠️ Buildkite build #99 failed.

Test (Bazel 6.x) (Test)

e2e/smoke

All tests were cache hits

1 test (100.0%) was fully cached saving 37ms.

Test (Bazel 7.x) (Test)

e2e/smoke

Buildkite build #99 is running...

Test (Bazel 8.x) (Test)

e2e/smoke

All tests were cache hits

1 test (100.0%) was fully cached saving 63ms.

chore(deps): update dependency rules_oci to v2

74e684f

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

chore(deps): update dependency rules_oci to v2 #131

chore(deps): update dependency rules_oci to v2 #131

Uh oh!

renovate bot commented Dec 11, 2025

Uh oh!

aspect-workflows bot commented Dec 11, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

chore(deps): update dependency rules_oci to v2 #131

Are you sure you want to change the base?

chore(deps): update dependency rules_oci to v2 #131

Uh oh!

Conversation

renovate bot commented Dec 11, 2025

Release Notes

Using bzlmod with Bazel 6 or later:

Using WORKSPACE:

What's Changed

New Contributors

Using bzlmod with Bazel 6 or later:

Using WORKSPACE:

What's Changed

New Contributors

Using bzlmod with Bazel 6 or later:

Using WORKSPACE:

Using bzlmod with Bazel 6 or later:

Using WORKSPACE:

What's Changed

Using bzlmod with Bazel 6 or later:

Using WORKSPACE:

What's Changed

Using bzlmod with Bazel 6 or later:

Using WORKSPACE:

What's Changed

New Contributors

Using bzlmod with Bazel 6 or later:

Using WORKSPACE:

What's Changed

New Contributors

Using bzlmod with Bazel 6 or later:

Using WORKSPACE:

What's Changed

BREAKING CHANGES

SIGNIFICANT CHANGES

API Removals

Using bzlmod with Bazel 6 or later:

Using WORKSPACE:

What's Changed

New Contributors

Using bzlmod with Bazel 6 or later:

Using WORKSPACE:

What's Changed

New Contributors

Using bzlmod with Bazel 6 or later:

Using WORKSPACE:

What's Changed

Configuration

Uh oh!

aspect-workflows bot commented Dec 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

e2e/smoke

e2e/smoke

e2e/smoke

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

aspect-workflows bot commented Dec 11, 2025 •

edited

Loading