Migrate build system from WORKSPACE to bzlmod

.bazelrc

@@ -1,6 +1,6 @@
 startup --host_jvm_args=-Xmx3g
 
-common --noenable_bzlmod
+common --enable_bzlmod
 common --incompatible_default_to_explicit_init_py
 run --color=yes
 

BZLMOD_MIGRATION.md

@@ -0,0 +1,113 @@
+# Bzlmod Migration
+
+This repository has been migrated from WORKSPACE-based Bazel to use Bzlmod (MODULE.bazel).
+
+## Overview
+
+Bzlmod is Bazel's modern dependency management system that provides better version resolution,
+dependency isolation, and reproducibility compared to the legacy WORKSPACE approach.
+
+## What Changed
+
+### Files Added
+- **MODULE.bazel**: Main bzlmod configuration file that declares dependencies and their versions
+- **WORKSPACE.bzlmod**: Supplements MODULE.bazel for dependencies that need WORKSPACE mode (envoy, envoy_archive, bootstrap)
+
+### Files Removed
+- **WORKSPACE**: Legacy dependency configuration (removed entirely as nothing depends on this repo)
+- **archive.bzl**: Moved to WORKSPACE.bzlmod
+- **toolchains.bzl**: Toolchain setup now in MODULE.bazel
+- **packages.bzl**: Package setup now in MODULE.bazel
+- **deps.bzl**: Replaced by WORKSPACE.bzlmod approach
+
+### Files Modified
+- **.bazelrc**: Changed `--noenable_bzlmod` to `--enable_bzlmod`
+- **versions.bzl**: Still used for version tracking but now consumed by deps.bzl
+
+## Dependencies
+
+### Standard Bzlmod Dependencies
+
+These are declared with `bazel_dep()` in MODULE.bazel:
+- `aspect_bazel_lib` - Bazel library with utilities
+- `bazel_skylib` - Bazel standard library
+- `rules_pkg` - Package rules for creating archives
+- `rules_python` - Python rules and toolchain
+
+### Archive Override
+
+These use `archive_override` since they're not in BCR yet but have MODULE.bazel:
+
+- `envoy_toolshed` - Website building macros and utilities
+- `envoy` - For documentation building. Applies patch to remove `local_path_override` directives. Envoy's MODULE.bazel declares its own dependencies (zstd, zlib, toolchains_llvm, etc.) which are resolved from BCR.
+
+### WORKSPACE.bzlmod Dependencies
+
+These use WORKSPACE.bzlmod because they don't have MODULE.bazel or need custom BUILD files:
+
+- **envoy_archive**: Has no MODULE.bazel
+- **com_github_twbs_bootstrap**: Needs a custom BUILD file
+
+## Pure Bzlmod Approach with archive_override
+
+This migration uses a pure bzlmod approach for all dependencies with MODULE.bazel:
+
+- **MODULE.bazel**: Handles all bzlmod dependencies (rules, toolchains, toolshed, envoy)
+- **WORKSPACE.bzlmod**: Only for repositories without MODULE.bazel (envoy_archive, bootstrap)
+
+### Loading envoy as a bzlmod Dependency
+
+Envoy is loaded using `archive_override` in MODULE.bazel, not via `http_archive` in WORKSPACE.bzlmod. This is crucial because:
+
+1. **MODULE.bazel is processed**: When loaded via `archive_override`, envoy's MODULE.bazel is processed as part of the bzlmod dependency graph
+2. **Envoy declares its own dependencies**: Envoy's MODULE.bazel declares dependencies like zstd, zlib, toolchains_llvm, etc., which are resolved from the Bazel Central Registry
+3. **Proper extension usage**: Extensions like `toolchains_llvm` work correctly because envoy is a proper bzlmod module in the dependency graph
+4. **Avoids hybrid issues**: No need to manually declare envoy's dependencies in our MODULE.bazel
+
+### Patching envoy's MODULE.bazel
+
+Envoy's MODULE.bazel contains `local_path_override` directives for envoy_api, envoy_build_config, and envoy_mobile. These directives reference local paths within the envoy repository (like `path = "api"`) which don't exist when envoy is used as an external dependency.
+
+We apply a patch that removes these `local_path_override` directives while keeping the rest of MODULE.bazel intact. This allows envoy to work properly in pure bzlmod mode with its dependencies properly declared and resolved.
+
+## Python Setup
+
+Python toolchain and pip dependencies are configured using bzlmod extensions:
+
+```python
+python = use_extension("@rules_python//python/extensions:python.bzl", "python")
+python.toolchain(python_version = "3.10", is_default = True)
+
+pip = use_extension("@rules_python//python/extensions:pip.bzl", "pip")
+pip.parse(hub_name = "website_pip3", python_version = "3.10", requirements_lock = "//site:requirements.txt")
+```
+
+## Version Management
+
+The `versions.bzl` file continues to be the source of truth for dependency versions. The `deps.bzl`
+module extension reads from this file to load dependencies. This maintains compatibility with
+existing version update scripts.
+
+## Transitive Dependencies
+
+With bzlmod, transitive dependencies are automatically discovered and resolved. For example:
+- `zstd` comes transitively from `envoy`
+- Other common dependencies come from `envoy_toolshed`
+
+## Benefits
+
+1. **Simpler dependency management**: No need for complex WORKSPACE macros
+2. **Better version resolution**: Bazel handles version conflicts automatically
+3. **Faster builds**: Improved caching and dependency resolution
+4. **Future-proof**: WORKSPACE is being deprecated in favor of bzlmod
+5. **End-of-line repo**: Since nothing builds from this repo, we can use bzlmod without worrying about downstream consumers
+
+## Building
+
+The build process remains the same:
+
+```bash
+bazel build //site
+```
+
+The only difference is that `--enable_bzlmod` is now set in .bazelrc by default.

MODULE.bazel

@@ -0,0 +1,59 @@
+module(
+    name = "envoy-website",
+    version = "0.0.0",
+)
+
+# Core Bazel rule sets - these come transitively from envoy_toolshed but we declare
+# them explicitly for clarity
+bazel_dep(name = "aspect_bazel_lib", version = "2.22.0")
+bazel_dep(name = "bazel_skylib", version = "1.8.1")
+bazel_dep(name = "rules_pkg", version = "1.0.1")
+bazel_dep(name = "rules_python", version = "1.6.0")
+
+# envoy_toolshed provides website building macros and utilities
+# Not in BCR yet, so we use archive_override
+bazel_dep(name = "envoy_toolshed", version = "0.3.15")
+archive_override(
+    module_name = "envoy_toolshed",
+    urls = ["https://github.com/envoyproxy/toolshed/archive/refs/tags/bazel-v0.3.15.tar.gz"],
+    strip_prefix = "toolshed-bazel-v0.3.15/bazel",
+    integrity = "sha256-kx4r36cRfb/2at8z85cSzRbQ6y27VIc5tb8sb/AtMlo=",
+)
+
+# envoy - for documentation building
+# Not in BCR yet, so we use git_override
+# Note: We can't use archive_override with patches, so using git_override instead
+bazel_dep(name = "envoy", version = "1.37.0-dev")
+git_override(
+    module_name = "envoy",
+    remote = "https://github.com/envoyproxy/envoy",
+    commit = "41b468c9b193c88ded4d94789c4793f02be5f758",
+    patches = ["//bazel/patches:envoy_fix_module_bazel.patch"],
+)
+
+# Note: envoy_archive and bootstrap are still loaded via WORKSPACE.bzlmod
+# - envoy_archive has no MODULE.bazel
+# - bootstrap needs a custom BUILD file
+
+# Setup jq toolchain from aspect_bazel_lib
+bazel_lib_toolchains = use_extension("@aspect_bazel_lib//lib:extensions.bzl", "toolchains")
+bazel_lib_toolchains.jq(version = "1.7")
+use_repo(bazel_lib_toolchains, "jq", "jq_toolchains")
+
+# Python toolchain setup
+PYTHON_VERSION = "3.10"
+
+python = use_extension("@rules_python//python/extensions:python.bzl", "python")
+python.toolchain(
+    python_version = PYTHON_VERSION,
+    is_default = True,
+)
+
+# Pip dependencies for website building
+pip = use_extension("@rules_python//python/extensions:pip.bzl", "pip")
+pip.parse(
+    hub_name = "website_pip3",
+    python_version = PYTHON_VERSION,
+    requirements_lock = "//site:requirements.txt",
+)
+use_repo(pip, "website_pip3")

WORKSPACE.bzlmod

@@ -0,0 +1,25 @@
+# WORKSPACE.bzlmod
+# This file supplements MODULE.bazel for dependencies that cannot be expressed in pure bzlmod.
+# In bzlmod mode, both MODULE.bazel and WORKSPACE.bzlmod are processed.
+
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+load("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository")
+load("//:versions.bzl", "VERSIONS")
+
+# Bootstrap CSS framework - needs custom BUILD file
+bootstrap = VERSIONS["com_github_twbs_bootstrap"]
+http_archive(
+    name = "com_github_twbs_bootstrap",
+    urls = [url.format(repo = bootstrap["repo"], version = bootstrap["version"]) for url in bootstrap["urls"]],
+    sha256 = bootstrap["sha256"],
+    strip_prefix = bootstrap["strip_prefix"].format(version = bootstrap["version"]),
+    build_file = "@envoy-website//bazel:bootstrap.BUILD",
+)
+
+# envoy_archive - contains versioned documentation
+envoy_archive = VERSIONS["envoy_archive"]
+git_repository(
+    name = "envoy_archive",
+    remote = "https://github.com/{repo}".format(repo = envoy_archive["repo"]),
+    commit = envoy_archive["version"],
+)

bazel/patches/BUILD

@@ -0,0 +1,3 @@
+exports_files([
+    "envoy_fix_module_bazel.patch",
+])

bazel/patches/envoy_fix_module_bazel.patch

@@ -0,0 +1,31 @@
+--- a/MODULE.bazel
++++ b/MODULE.bazel
+@@ -4,9 +4,6 @@ module(
+ )
+
+ bazel_dep(name = "aspect_bazel_lib", version = "2.21.2")
+-bazel_dep(name = "envoy_api", version = "1.37.0-dev")
+-bazel_dep(name = "envoy_build_config", version = "1.37.0-dev")
+-bazel_dep(name = "envoy_mobile", version = "1.37.0-dev")
+ bazel_dep(name = "gperftools", version = "2.17.2")
+ bazel_dep(name = "numactl", version = "2.0.19")
+ bazel_dep(name = "platforms", version = "1.0.0")
+@@ -15,15 +12,3 @@ bazel_dep(name = "rules_rust", version = "0.67.0")
+ bazel_dep(name = "rules_shell", version = "0.6.1")
+ bazel_dep(name = "zlib", version = "1.3.1.bcr.7")
+ bazel_dep(name = "zstd", version = "1.5.7")
+-
+-local_path_override(
+-    module_name = "envoy_api",
+-    path = "api",
+-)
+-
+-local_path_override(
+-    module_name = "envoy_build_config",
+-    path = "mobile/envoy_build_config",
+-)
+-
+-local_path_override(
+-    module_name = "envoy_mobile",
+-    path = "mobile",
+-)