feat(tools): share package definitions across feature setup and Bazel

.github/renovate.json5

@@ -81,30 +81,6 @@
       "datasourceTemplate": "github-releases",
       "depNameTemplate": "astral-sh/uv",
       "versioningTemplate": "semver"
-    },
-    {
-      "customType": "regex",
-      "fileMatch": [
-        "versions\\.yaml$"
-      ],
-      "matchStrings": [
-        "apm:\\n\\s+version:\\s+(?<currentValue>\\d+\\.\\d+\\.\\d+)"
-      ],
-      "datasourceTemplate": "github-releases",
-      "depNameTemplate": "microsoft/apm",
-      "versioningTemplate": "semver"
-    },
-    {
-      "customType": "regex",
-      "fileMatch": [
-        "versions\\.yaml$"
-      ],
-      "matchStrings": [
-        "opencode:\\n\\s+version:\\s+(?<currentValue>\\d+\\.\\d+\\.\\d+)"
-      ],
-      "datasourceTemplate": "github-releases",
-      "depNameTemplate": "anomalyco/opencode",
-      "versioningTemplate": "semver"
     }
   ],
   "enabledManagers": [

.pre-commit-config.yaml

@@ -72,8 +72,8 @@ repos:
         entry: python3 tools/internal/sync_readme.py
         language: system
         pass_filenames: false
-        # Watch the shared reader as well as both catalog formats.
-        files: ^tools/(README\.md|internal/(catalog\.py|sync_readme\.py|devcontainer/install\.py)|lockfiles/(.*\.lock\.json|python_tools\.bzl))$
+        # Watch the shared reader, package definitions and native lockfiles.
+        files: ^tools/(README\.md|providers\.json|internal/(catalog\.py|sync_readme\.py|devcontainer/install\.py)|lockfiles/.*\.lock\.json)$
   - repo: https://github.com/eclipse-score/tooling
     rev: 31ff8eee214e4e97ef8f5cb46e443273515b63ec
     hooks:

MODULE.bazel

@@ -19,6 +19,16 @@ bazel_dep(name = "rules_multitool", version = "1.11.1")
 # Bazel versions.
 bazel_dep(name = "rules_shell", version = "0.4.1")
 
+# Python packages live beside the other provider definitions in JSON. Convert
+# that data to a loadable Starlark value in Bazel's cache, without a second
+# maintained package list or a host Python dependency.
+catalog_repository = use_repo_rule("//tools:catalog_repository.bzl", "catalog_repository")
+
+catalog_repository(
+    name = "score_tool_catalog",
+    definitions = "//tools:providers.json",
+)
+
 multitool = use_extension("@rules_multitool//multitool:extension.bzl", "multitool")
 multitool.hub(lockfile = "//tools:lockfiles/actionlint.lock.json")
 multitool.hub(lockfile = "//tools:lockfiles/apm.lock.json")

REUSE.toml

@@ -27,6 +27,7 @@ SPDX-License-Identifier = "Apache-2.0"
 path = ["resources/reopen_in_container.png",
         "resources/devcontainer_success.png",
         "tools/lockfiles/*.lock.json",
+        "tools/providers.json",
         "MODULE.bazel.lock",
         ".bazelversion",
         ]

src/s-core-devcontainer/.devcontainer/bazel-feature/install.sh

@@ -29,7 +29,7 @@ rm -f "${COPY_TARGET}/devcontainer-features.env" "${COPY_TARGET}/devcontainer-fe
 DEBIAN_FRONTEND=noninteractive
 
 # Read tool versions + metadata into environment variables
-. /usr/local/share/score-tools/internal/devcontainer/load_feature_versions.sh /devcontainer/features/bazel/versions.yaml
+eval "$(/usr/local/share/score-tools/internal/devcontainer/install.py shell-metadata)"
 
 ARCHITECTURE=$(dpkg --print-architecture)
 

src/s-core-devcontainer/.devcontainer/bazel-feature/tests/test_default.sh

@@ -16,20 +16,17 @@
 set -euo pipefail
 
 # Read tool versions + metadata into environment variables
-. /usr/local/share/score-tools/internal/devcontainer/load_feature_versions.sh /devcontainer/features/bazel/versions.yaml
+eval "$(/usr/local/share/score-tools/internal/devcontainer/install.py shell-metadata)"
 
-bazelisk_lockfile_version="$(/usr/local/share/score-tools/internal/devcontainer/install.py version bazelisk)"
-buildifier_lockfile_version="$(/usr/local/share/score-tools/internal/devcontainer/install.py version buildifier)"
-starpls_lockfile_version="$(/usr/local/share/score-tools/internal/devcontainer/install.py version starpls)"
 # Bazel-related tools
 ## This is the bazel version preinstalled in the devcontainer.
 ## A solid test would disable the network interface first to prevent a different version from being downloaded,
 ## but that requires CAP_NET_ADMIN, which is not yet added.
 export USE_BAZEL_VERSION=${bazel_version}
-check "validate bazelisk is working and has the correct version" bash -c "bazelisk version | grep '${bazelisk_lockfile_version}'"
+check "validate bazelisk is working and has the correct version" bash -c "bazelisk version | grep '${bazelisk_version}'"
 check "validate bazel is working and has the correct version" bash -c "bazel version | grep '${bazel_version}'"
 unset USE_BAZEL_VERSION
 
-check "validate buildifier is working and has the correct version" bash -c "buildifier --version | grep '${buildifier_lockfile_version}'"
-check "validate starpls is working and has the correct version" bash -c "starpls version | grep '${starpls_lockfile_version}'"
+check "validate buildifier is working and has the correct version" bash -c "buildifier --version | grep '${buildifier_version}'"
+check "validate starpls is working and has the correct version" bash -c "starpls version | grep '${starpls_version}'"
 check "validate bazel-compile-commands is working and has the correct version" bash -c "bazel-compile-commands --version 2>&1 | grep '${bazel_compile_commands_version}'"

src/s-core-devcontainer/.devcontainer/s-core-local/install.sh

@@ -31,10 +31,9 @@ rm -f "${COPY_TARGET}/devcontainer-features.env" "${COPY_TARGET}/devcontainer-fe
 DEBIAN_FRONTEND=noninteractive
 
 # Read tool versions + metadata into environment variables
-. /usr/local/share/score-tools/internal/devcontainer/load_feature_versions.sh /devcontainer/features/s-core-local/versions.yaml
+eval "$(/usr/local/share/score-tools/internal/devcontainer/install.py shell-metadata)"
 
 ARCHITECTURE=$(dpkg --print-architecture)
-KERNEL=$(uname -s)
 
 apt-get update
 
@@ -76,7 +75,7 @@ apt-get install -y gh
 
 # OpenJDK 21, via APT
 # Set JAVA_HOME environment variable system-wide, since some tools rely on it (e.g., Bazel's rules_java)
-apt-get install -y ca-certificates-java openjdk-21-jdk-headless="${openjdk_21_version}*"
+apt-get install -y ca-certificates-java openjdk-21-jdk-headless="${openjdk_version}*"
 JAVA_HOME="$(dirname $(dirname $(realpath $(command -v javac))))"
 export JAVA_HOME
 echo -e "JAVA_HOME=${JAVA_HOME}\nexport JAVA_HOME" > /etc/profile.d/java_home.sh
@@ -101,7 +100,7 @@ apt-get install -y pkg-config="${pkg_config_version}*" libcairo2-dev="${libcairo
 # additional developer tools
 apt-get install -y gdb="${gdb_version}*"
 
-apt-get install -y valgrind="1:${valgrind_version}*"
+apt-get install -y valgrind="${valgrind_version}*"
 
 apt-get install -y ripgrep="${ripgrep_version}*"
 
@@ -114,13 +113,8 @@ if [ "${ARCHITECTURE}" = "amd64" ]; then
     VARIANT=linux64
     SHA256SUM="${codeql_amd64_sha256}"
 elif [ "${ARCHITECTURE}" = "arm64" ]; then
-    if [ "${KERNEL}" = "Darwin" ]; then
-        VARIANT=osx64
-        SHA256SUM="${codeql_arm64_sha256}"
-    else
-        echo "CodeQl unsupported architecture/os: ${ARCHITECTURE} on ${KERNEL}, skipping installation"
-        VARIANT=noinstall
-    fi
+    echo "CodeQL has no selected Linux ARM64 bundle; skipping installation"
+    VARIANT=noinstall
 else
     echo "Unsupported architecture: ${ARCHITECTURE} for CodeQL"
     exit 1

src/s-core-devcontainer/.devcontainer/s-core-local/tests/test_default.sh

@@ -16,30 +16,17 @@
 set -euo pipefail
 
 ARCHITECTURE=$(dpkg --print-architecture)
-KERNEL=$(uname -s)
 
 # Read tool versions + metadata into environment variables
-. /usr/local/share/score-tools/internal/devcontainer/load_feature_versions.sh /devcontainer/features/s-core-local/versions.yaml
+eval "$(/usr/local/share/score-tools/internal/devcontainer/install.py shell-metadata)"
 
-shellcheck_lockfile_version="$(/usr/local/share/score-tools/internal/devcontainer/install.py version shellcheck)"
-ruff_lockfile_version="$(/usr/local/share/score-tools/internal/devcontainer/install.py version ruff)"
-actionlint_lockfile_version="$(/usr/local/share/score-tools/internal/devcontainer/install.py version actionlint)"
-yamlfmt_lockfile_version="$(/usr/local/share/score-tools/internal/devcontainer/install.py version yamlfmt)"
-uv_lockfile_version="$(/usr/local/share/score-tools/internal/devcontainer/install.py version uv)"
-uvx_lockfile_version="$(/usr/local/share/score-tools/internal/devcontainer/install.py version uvx)"
-apm_lockfile_version="$(/usr/local/share/score-tools/internal/devcontainer/install.py version apm)"
-opencode_lockfile_version="$(/usr/local/share/score-tools/internal/devcontainer/install.py version opencode)"
-
-# The shared catalog is the assertion source, so installation metadata and the
-# executable exposed on PATH are checked against the same release.
-pre_commit_catalog_version="$(/usr/local/share/score-tools/internal/devcontainer/install.py version pre-commit)"
 
 # Verify the system-wide uv installation exposes the catalogued release to the
 # non-root user running feature tests.
-check "validate pre-commit is working and has the correct version" bash -c "pre-commit --version | grep '${pre_commit_catalog_version}'"
+check "validate pre-commit is working and has the correct version" bash -c "pre-commit --version | grep '${pre_commit_version}'"
 
 # Common tooling
-check "validate shellcheck is working and has the correct version" bash -c "shellcheck --version | grep '${shellcheck_lockfile_version}'"
+check "validate shellcheck is working and has the correct version" bash -c "shellcheck --version | grep '${shellcheck_version}'"
 
 # For an unknown reason, dot -V reports on Ubuntu Noble a version 2.43.0, while the package has a different version.
 # Hence, we have to work around that.
@@ -66,27 +53,27 @@ check "validate pytest is working" bash -c "pytest --version"
 check "validate pylint is working" bash -c "pylint --version"
 
 # OpenJDK
-check "validate java is working and has the correct version" bash -c "java -version 2>&1 | grep '${openjdk_21_version}'"
+check "validate java is working and has the correct version" bash -c "java -version 2>&1 | grep '${openjdk_version}'"
 check "validate JAVA_HOME is set correctly" bash -c "echo ${JAVA_HOME} | xargs readlink -f | grep \"java-21-openjdk\""
 
 # ruff
-check "validate ruff is working and has the correct version" bash -c "ruff --version | grep '${ruff_lockfile_version}'"
+check "validate ruff is working and has the correct version" bash -c "ruff --version | grep '${ruff_version}'"
 
 # actionlint
-check "validate actionlint is working and has the correct version" bash -c "actionlint --version | grep '${actionlint_lockfile_version}'"
+check "validate actionlint is working and has the correct version" bash -c "actionlint --version | grep '${actionlint_version}'"
 
 # yamlfmt
-check "validate yamlfmt is working and has the correct version" bash -c "yamlfmt --version | grep '${yamlfmt_lockfile_version}'"
+check "validate yamlfmt is working and has the correct version" bash -c "yamlfmt --version | grep '${yamlfmt_version}'"
 
 # apm
-check "validate apm is working and has the correct version" bash -c "apm --version | grep '${apm_lockfile_version}'"
+check "validate apm is working and has the correct version" bash -c "apm --version | grep '${apm_version}'"
 
 # opencode
-check "validate opencode is working and has the correct version" bash -c "opencode --version | grep '${opencode_lockfile_version}'"
+check "validate opencode is working and has the correct version" bash -c "opencode --version | grep '${opencode_version}'"
 
 # uv
-check "validate uv is working and has the correct version" bash -c "uv --version | grep '${uv_lockfile_version}'"
-check "validate uvx is working and has the correct version" bash -c "uvx --version | grep '${uvx_lockfile_version}'"
+check "validate uv is working and has the correct version" bash -c "uv --version | grep '${uv_version}'"
+check "validate uvx is working and has the correct version" bash -c "uvx --version | grep '${uvx_version}'"
 
 # pycairo build from source (requires pkg-config and libcairo2-dev)
 check "validate pycairo can be built and installed from source" bash -c "pip install --break-system-packages pycairo==1.29.0"
@@ -95,17 +82,19 @@ check "validate pycairo can be built and installed from source" bash -c "pip ins
 check "validate gdb is working and has the correct version" bash -c "gdb --version | grep '${gdb_version}'"
 check "validate pkg-config is working and has the correct version" bash -c "pkg-config --version | grep '${pkg_config_version}'"
 check "validate gh is working and has the correct version" bash -c "gh --version | grep '${gh_version}'"
-check "validate valgrind is working and has the correct version" bash -c "valgrind --version | grep '${valgrind_version}'"
+# Debian epochs (e.g. 1:3.22.0) are APT metadata, not executable versions.
+# ${value#*:} removes that prefix for this comparison.
+check "validate valgrind is working and has the correct version" bash -c "valgrind --version | grep '${valgrind_version#*:}'"
 check "validate ripgrep is working and has the correct version" bash -c "rg --version | grep '${ripgrep_version}'"
-if [ "${ARCHITECTURE}" = "amd64" ] || { [ "${ARCHITECTURE}" = "arm64" ] && [ "${KERNEL}" = "Darwin" ]; }; then
+if [ "${ARCHITECTURE}" = "amd64" ]; then
     check "validate codeql is working and has the correct version" bash -c "codeql --version | grep '${codeql_version}'"
     check "validate CODEQL_HOME is set correctly" bash -c "echo ${CODEQL_HOME} | grep \"/usr/local/codeql\""
 fi
 
 # lcov
 check "validate lcov is working and has the correct version" bash -c "lcov --version | grep '${lcov_version}'"
 
-# Qemu target-related tools
-check "validate qemu-system-aarch64 is working and has the correct version" bash -c "qemu-system-aarch64 --version | grep '${qemu_system_version}'"
-check "validate qemu-system-x86_64 is working and has the correct version" bash -c "qemu-system-x86_64 --version | grep '${qemu_system_version}'"
+# Qemu target-related tools (strip the Debian epoch here too)
+check "validate qemu-system-aarch64 is working and has the correct version" bash -c "qemu-system-aarch64 --version | grep '${qemu_system_version#*:}'"
+check "validate qemu-system-x86_64 is working and has the correct version" bash -c "qemu-system-x86_64 --version | grep '${qemu_system_version#*:}'"
 check "validate sshpass is working and has the correct version" bash -c "sshpass -V | grep '${sshpass_version}'"

tools/BUILD.bazel

@@ -13,17 +13,13 @@
 
 load("@rules_shell//shell:sh_test.bzl", "sh_test")
 load(":multitool.bzl", "multitool_aliases")
-load(":python_tool.bzl", "python_tool")
+load(":python_tool.bzl", "python_tools")
 
 package(default_visibility = ["//visibility:public"])
 
-# Native lockfiles are consumed by rules_multitool; the Starlark catalog is
-# loaded directly by python_tool.bzl. Export both because they are public
-# metadata shipped with the score_devcontainer module.
-exports_files(glob([
-    "lockfiles/*.bzl",
-    "lockfiles/*.lock.json",
-]))
+# Native lockfiles are read by rules_multitool. The shared provider definitions
+# also feed Bazel's generated Python package data; all remain module metadata.
+exports_files(glob(["lockfiles/*.lock.json"]) + ["providers.json"])
 
 multitool_aliases("actionlint")
 
@@ -49,18 +45,24 @@ multitool_aliases("opencode")
 
 # Python distributions are resolved through pinned uvx because they do not
 # provide the platform-specific release binaries consumed by rules_multitool.
-python_tool("pre-commit")
+# Export every catalogued Python command. environments.json chooses which of
+# these are installed in each container; it does not restrict the module API.
+python_tools()
 
 # This contract test keeps Bazel's shell launcher and the container installer
 # aligned with their shared catalog.
 sh_test(
     name = "python_tool_runner_test",
     srcs = ["tests/python_tool_runner_test.sh"],
+    # Compare the generated analysis-time catalog with the JSON used by the
+    # installer. rootpath resolves the generated file inside test runfiles.
+    args = ["$(rootpath @score_tool_catalog//:python_tools.bzl)"],
     data = [
         "internal/catalog.py",
         "internal/devcontainer/install.py",
         "internal/run_python_tool.sh",
-        "lockfiles/python_tools.bzl",
+        "providers.json",
+        "@score_tool_catalog//:python_tools.bzl",
     ],
 )
 

tools/README.md

@@ -41,10 +41,12 @@ host-side Bazel invocation may require network access to download the binary.
 | --- | --- | --- |
 | `actionlint` | `1.7.7` | Check GitHub Actions workflow files |
 | `apm` | `0.35.0` | Manage APM packages |
+| `basedpyright` | `1.35.0` | Type check Python and provide its language server |
 | `bazelisk` | `1.27.0` | Run the Bazel version selected by a repository |
 | `buildifier` | `8.2.1` | Format and lint Bazel files |
 | `opencode` | `2.2.3` | Run the OpenCode CLI |
 | `pre-commit` | `4.7.0` | Run repository pre-commit hooks |
+| `pytest` | `9.0.2` | Run Python tests |
 | `ruff` | `0.11.13` | Check and format Python code |
 | `shellcheck` | `0.10.0` | Check shell scripts |
 | `starpls` | `0.1.22` | Provide language-server support for Starlark |