feat(package-manager): Add initial support for Bazel

This is based on oss-review-toolkit#264.

Signed-off-by: Haiko Schol <hs@haikoschol.com>

Dockerfile

@@ -564,3 +564,12 @@ ENV PATH=$PATH:$HASKELL_HOME/bin
 COPY --from=haskell /opt/haskell /opt/haskell
 
 RUN syft /opt/haskell -o spdx-json --file /usr/share/doc/ort/ort-haskell.spdx.json
+
+# Bazel WIP
+
+RUN DEBIAN_FRONTEND=noninteractive sudo apt install -y apt-transport-https && \
+    curl -fsSL https://bazel.build/bazel-release.pub.gpg | gpg --dearmor >bazel-archive-keyring.gpg && \
+    sudo mv bazel-archive-keyring.gpg /usr/share/keyrings && \
+    echo "deb [arch=amd64 signed-by=/usr/share/keyrings/bazel-archive-keyring.gpg] https://storage.googleapis.com/bazel-apt stable jdk1.8" | sudo tee /etc/apt/sources.list.d/bazel.list && \
+    sudo apt update && sudo apt install bazel && \
+    sudo rm -rf /var/lib/apt/lists/*

clients/bazel-module-registry/src/funTest/kotlin/BazelModuleRegistryServiceFunTest.kt

@@ -26,7 +26,7 @@ import io.kotest.matchers.shouldBe
 
 import org.ossreviewtoolkit.model.HashAlgorithm
 
-class BazelModuleRegistryServiceTest : WordSpec({
+class BazelModuleRegistryServiceFunTest : WordSpec({
     val service = BazelModuleRegistryService.create()
     val repoUrl = "https://github.com/google/glog"
 
@@ -45,7 +45,7 @@ class BazelModuleRegistryServiceTest : WordSpec({
         "return non-empty remote artifact info" {
             val sourceInfo = service.getModuleSourceInfo("glog", "0.5.0")
 
-            sourceInfo.remoteArtifact().url shouldBe "${repoUrl}/archive/refs/tags/v0.5.0.tar.gz"
+            sourceInfo.remoteArtifact().url shouldBe "$repoUrl/archive/refs/tags/v0.5.0.tar.gz"
             sourceInfo.remoteArtifact().hash.algorithm shouldBe HashAlgorithm.SHA256
         }
     }

clients/bazel-module-registry/src/main/kotlin/BazelModuleRegistryService.kt

@@ -35,16 +35,16 @@ import kotlinx.serialization.json.JsonNamingStrategy
 import okhttp3.MediaType.Companion.toMediaType
 import okhttp3.OkHttpClient
 
-import retrofit2.Retrofit
-import retrofit2.http.GET
-import retrofit2.http.Path
-
 import org.ossreviewtoolkit.model.Hash
 import org.ossreviewtoolkit.model.HashAlgorithm
 import org.ossreviewtoolkit.model.RemoteArtifact
 import org.ossreviewtoolkit.model.VcsInfo
 import org.ossreviewtoolkit.model.VcsType
 
+import retrofit2.Retrofit
+import retrofit2.http.GET
+import retrofit2.http.Path
+
 @Serializer(URI::class)
 object URISerializer : KSerializer<URI> {
     override fun serialize(encoder: Encoder, value: URI) = encoder.encodeString(value.toString())
@@ -74,10 +74,7 @@ interface BazelModuleRegistryService {
          * Create a Bazel Module Registry service instance for communicating with a server running at the given [url],
          * defaulting to the Bazel Central Registry, optionally with a pre-built OkHttp [client].
          */
-        fun create(
-            url: String = DEFAULT_URL,
-            client: OkHttpClient? = null
-        ): BazelModuleRegistryService {
+        fun create(url: String = DEFAULT_URL, client: OkHttpClient? = null): BazelModuleRegistryService {
             val bmrClient = client ?: OkHttpClient()
 
             val contentType = "application/json".toMediaType()
@@ -98,7 +95,7 @@ interface BazelModuleRegistryService {
         val repository: List<String>? = null,
         val versions: List<String>,
         // The key in the map is the version, the value the reason for yanking it.
-        val yankedVersions: Map<String, String>,
+        val yankedVersions: Map<String, String>
     ) {
         fun vcsInfo(): VcsInfo {
             if (repository.isNullOrEmpty()) {
@@ -110,7 +107,7 @@ interface BazelModuleRegistryService {
             // exists. Otherwise it's just the repo URL.
             val url = if (repo.startsWith("github:")) {
                 val path = repo.substringAfter("github:")
-                "https://github.com/${path}"
+                "https://github.com/$path"
             } else {
                 repo
             }
@@ -119,7 +116,7 @@ interface BazelModuleRegistryService {
                 type = VcsType.GIT,
                 url = url,
                 revision = "",
-                path = "",
+                path = ""
             )
         }
     }
@@ -136,7 +133,7 @@ interface BazelModuleRegistryService {
         val patchStrip: Int? = null,
         val patches: Map<String, String>? = null,
         val stripPrefix: String? = null,
-        @Serializable(URISerializer::class) val url: URI,
+        @Serializable(URISerializer::class) val url: URI
     ) {
         fun remoteArtifact() = RemoteArtifact(url = url.toString(), hash = hash())
 
@@ -148,7 +145,7 @@ interface BazelModuleRegistryService {
 
             return Hash(
                 value = digest,
-                algorithm = HashAlgorithm.fromString(algo),
+                algorithm = HashAlgorithm.fromString(algo)
             )
         }
     }

plugins/package-managers/bazel/build.gradle.kts

@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2024 The ORT Project Authors (see <https://github.com/oss-review-toolkit/ort/blob/main/NOTICE>)
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ * License-Filename: LICENSE
+ */
+
+import org.jetbrains.kotlin.gradle.tasks.KotlinCompile
+
+plugins {
+    // Apply precompiled plugins.
+    id("ort-library-conventions")
+
+    // Apply third-party plugins.
+    alias(libs.plugins.kotlinSerialization)
+}
+
+dependencies {
+    api(projects.analyzer)
+    api(projects.model)
+    api(projects.utils.commonUtils) {
+        because("This is a CommandLineTool.")
+    }
+
+    api(libs.semver4j) {
+        because("This is a CommandLineTool.")
+    }
+
+    implementation(projects.downloader)
+    implementation(projects.clients.bazelModuleRegistryClient)
+    implementation(projects.utils.ortUtils)
+    implementation(projects.utils.spdxUtils)
+
+    implementation(libs.bundles.kotlinxSerialization)
+    implementation(libs.kotlinx.coroutines)
+
+    funTestImplementation(testFixtures(projects.analyzer))
+}
+
+tasks.withType<KotlinCompile>().configureEach {
+    val customCompilerArgs = listOf(
+        "-opt-in=kotlinx.serialization.ExperimentalSerializationApi"
+    )
+
+    compilerOptions {
+        freeCompilerArgs.addAll(customCompilerArgs)
+    }
+}

plugins/package-managers/bazel/src/funTest/assets/fixtures/MODULE.bazel

@@ -0,0 +1,5 @@
+module(name="bazel-test-module", version="0.42.23", compatibility_level=0)
+
+bazel_dep(name = "glog", version = "0.5.0", repo_name = "com_github_google_glog")
+bazel_dep(name = "googletest", version = "1.14.0", repo_name = "com_google_googletest", dev_dependency = True)
+