May 2023 Summaries

Integrating projects into a Bazel monorepo involves a careful, step-by-step process to ensure seamless merging and maintain developer workflow parity. The process begins with ensuring that both the monorepo and the other repository are similarly structured and governed, allowing for smooth incorporation into the monorepo's Bazel workspace. Communication with developers is crucial, as open pull requests in the other repository should be completed before the migration to avoid complications. A key step involves preserving the git history of the other repository by using a git plugin to rewrite its history into a subdirectory format, followed by merging it into the monorepo with a merge commit. During this process, it is essential to prevent divergence by temporarily halting new commits in the other repository and adjusting branch protection settings if necessary. Once the merge is complete, developers need to be reoriented to work within the monorepo's trunk-based development environment, and CI/CD workflows should be configured to leverage Bazel's capabilities, despite its initial setup complexities. The ultimate goal is to integrate the repositories effectively without disrupting existing workflows or losing critical historical data.

Google has announced the general availability of version 1.0 of rules_oci, an open-sourced Bazel plugin designed to simplify and secure the building of container images, marking a significant improvement over its predecessor, rules_docker. Developed in collaboration with Aspect and the Rules Authors Special Interest Group, rules_oci is now the recommended ruleset for Docker/OCI, supporting the Open Container Initiative standard. It offers enhanced features like native support for multi-architecture images, code signing to verify image integrity, and the ability to work without a pre-installed Docker daemon, making it more maintainable and adaptable to diverse container runtimes and image formats. The plugin improves supply chain security through minimal base images and aligns with Bazel's Trust-on-First-Use principle, benefiting projects like Google's Distroless base images by providing a Software Bill of Materials and eliminating race conditions in image signing processes. With resources available from Aspect for migration and support, this release invites current users of rules_docker and new adopters to transition to rules_oci, contributing to its development and ensuring its continued evolution as an open-source project.