rules_ocx

Bazel module extension that provisions pinned CLI tools, such as jq or shellcheck, as runnable targets through the OCX package manager.

MODULE.bazel

bazel_dep(name = "rules_ocx", version = "0.5.0")

ocx = use_extension("@rules_ocx//ocx:extensions.bzl", "ocx")

# Provision the workspace toolchain from ocx.toml and ocx.lock.
ocx.project(
    name = "tools",
    ocx_toml = "//:ocx.toml",
    ocx_lock = "//:ocx.lock",
)

use_repo(ocx, "tools")

Every executable a package declares becomes a target such as @tools//:shellcheck.

Start the tutorial to run shellcheck in a Bazel test without installing it.

Pick a goal

• Share one toolchain between Bazel and developers: one ocx.toml and ocx.lock for both
• Fail CI on a stale lock: freeze packages and patches
• Build behind a corporate mirror: mirrors, proxy CAs and anonymous read
• Use per-platform tools with transitions: build for a platform other than the host
• Keep tool bytes out of remote-cached actions: lazy provisioning with bins

Understand and look up

• How rules_ocx works: why it shells out to ocx and what is shared
• Trust and config: policy, managed config and patches
• Environment variables: which ones reach the repository rules
• Rules and macros: ocx_package_repo, ocx_project_repo and the rest of defs.bzl
• Module extension: project, package, download and policy tags

Source, issues and examples live in the GitHub repository.