Skip to content

Add a lint warning for external repository references and usage canonical repository names#1386

Merged
vladmos merged 1 commit intobazelbuild:mainfrom
nickschaap:schaap/external-repos
Aug 26, 2025
Merged

Add a lint warning for external repository references and usage canonical repository names#1386
vladmos merged 1 commit intobazelbuild:mainfrom
nickschaap:schaap/external-repos

Conversation

@nickschaap
Copy link
Contributor

In Bzlmod, the usage of canonical repository names should be avoided as it is not a public API makes BUILD files less portable. Developers also should never hardcode paths inside external repos.

@google-cla
Copy link

google-cla bot commented Aug 25, 2025

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

Copy link
Member

@vladmos vladmos left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

@vladmos vladmos merged commit 4006b54 into bazelbuild:main Aug 26, 2025
2 checks passed
copybara-service bot pushed a commit to bazelbuild/rules_java that referenced this pull request Jan 30, 2026
@Silic0nS0ldier
Copy link
Contributor

With the release of buildtools 8.5.1 this is now in the wild. These new lints have caught have caught several problems but they've also hit several false positives.

  • The /external/ string check includes comment strings. While these can include examples of /external/ (e.g. describing file system layout) they can not affect build behaviour and should be excluded from linting.
    def foo():
        """
        ...
            File("bazel-out/k8-fastbuild/bin/external/rules_pycross++lock_repos+pypi/_lock/[email protected]"),
                                            ^^^^^^^^^^
        ...
        """
  • As above, but for @@ in comment strings.
  • Not all /external/ substrings refer to the external directory (used by external repositories and may be removed in favour of a sibling layout in the future). For example, a go_library target under a directory called external ends up with an importpath attribute that trips this up.
  • The latter is also technically true for @@, although the sequence is rare enough to not be a problem in practise.

Comment strings should be ignored, though I'm not sure how false positives in other places can be avoided (it may well be impossible).

Comment on lines +284 to +287
if strings.Contains(stringExpr.Value, "@@") {
findings = append(findings,
makeLinterFinding(stringExpr, `String contains "@@" which indicates a canonical repository name reference that should be avoided.`))
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This warns on @@// which is the explicitly supported way to refer to the main repo from an external repo without having to use a name for the main repo.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants