rules_github
Bazel repository rules for GitHub-release-based content. Common substrate for rules_mdbook, rules_bun, rules_postgres, et al.
| Latest | 0.1.2 |
|---|---|
| Versions | 3 |
| Category | Bazel rules |
| Compat level | 1 |
| Maintainers | Matt Marshall |
| Registry | https://registry.tbzl.dev/modules/rules_github/ |
| Source | github.com/tomato-bazel/rules_github |
bazel_dep(name = "rules_github", version = "0.1.2")
View source & releases on GitHub ↗
Bazel repository rules for fetching content from GitHub releases — the
common substrate underneath fastverk’s rules_mdbook, rules_bun,
rules_postgres, and anything else that pulls a sha-pinned prebuilt
binary or source tarball from a GitHub release.
Two repository rules:
github_binary_repository— fetch a per-platform binary release asset (releases/download/<tag>/<asset>URL shape; mdbook, bun, ripgrep, jq, …).github_source_repository— fetch a source tarball from a tag (archive/refs/tags/<tag>.tar.gzURL shape; libpg_query and anything else that doesn’t ship prebuilt assets but you want to build from source under Bazel).
See docs/repositories.md for the full attribute reference.
Install
Add the registry to your .bazelrc:
common --registry=https://registry.fastverk.com/
common --registry=https://bcr.bazel.build/
In your MODULE.bazel:
bazel_dep(name = "rules_github", version = "0.1.0")
Quick start
Per-platform binary (mdbook-style)
load("@rules_github//github:repositories.bzl", "github_binary_repository")
def _bun_ext_impl(_ctx):
github_binary_repository(
name = "bun",
repo = "oven-sh/bun",
version = "1.3.14",
tag_format = "bun-v{version}",
asset_template = "bun-{platform}.zip",
strip_prefix_template = "bun-{platform}",
platform_aliases = {
"darwin_aarch64": "darwin-aarch64",
"darwin_x86_64": "darwin-x64",
"linux_aarch64": "linux-aarch64",
"linux_x86_64": "linux-x64",
},
platform_shas = {
"darwin_aarch64": "d8b96221828ad6f97ac7ac0ab7e95872341af763001e8803e8267652c2652620",
"linux_x86_64": "951ee2aee855f08595aeec6225226a298d3fea83a3dcd6465c09cbccdf7e848f",
# …
},
build_file_content = """
package(default_visibility = ["//visibility:public"])
exports_files(["bun"])
""",
)
bun_ext = module_extension(implementation = _bun_ext_impl)
Canonical platform identifiers are darwin_aarch64, darwin_x86_64, linux_x86_64, linux_aarch64, windows_x86_64. platform_aliases maps these to whatever the upstream release naming uses (aarch64-apple-darwin for Rust-target convention, darwin-aarch64 for Bun, …).
Source tarball (libpg_query-style)
load("@rules_github//github:repositories.bzl", "github_source_repository")
github_source_repository(
name = "libpg_query",
repo = "pganalyze/libpg_query",
version = "17-6.2.2",
tag_format = "{version}", # libpg_query tags don't have a `v` prefix
sha256 = "e68962c18dbf5890821511be6c5c42261170bf8bfd51a82ea9176069f3d0df8b",
build_file_content = """
load("@rules_cc//cc:defs.bzl", "cc_library")
# … cc_library wiring …
""",
)
strip_prefix_template defaults to <repo-basename>-<version>, matching GitHub’s auto-generated source tarball layout. Override only if upstream’s tag-to-tarball-prefix mapping is non-standard.
What’s deliberately NOT here
- Toolchain rules. Each downstream
rules_*(rules_mdbook, rules_bun, …) defines its ownToolchainInfoprovider with project-specific fields. Wrapping the binary as a toolchain stays in the consumer’s BUILD overlay. - Generic-HTTP fetching. Non-GitHub URLs (e.g.,
ftp.postgresql.org/pub/source/postgresql-17.6.tar.bz2for the full PG source) need a different URL template. A siblinghttp_archive_repositorycould be added later; today, use Bazel’s built-inhttp_archivedirectly.
Compatibility
- Bazel: 7.4+, bzlmod required.
- Platforms: detection covers darwin × {aarch64, x86_64}, linux × {x86_64, aarch64}, windows × x86_64. Other platforms surface as an explicit
fail()— extendgithub/private/platforms.bzlif needed.
Contributing
Reference docs are stardoc-generated. After editing rule docstrings:
bazel run //docs:update
CI gates this via bazel test //docs/... + buildifier lint.
License
MIT.
Rules & providers#
Generated with Stardoc from the module's .bzl sources.
from docs/repositories.md
Two repository rules for GitHub-release-based content.
-
github_binary_repository— fetch a per-platform binary release asset (thereleases/download/<tag>/<asset>URL shape used by most CLI projects: mdbook, bun, ripgrep, jq, …). -
github_source_repository— fetch a source tarball from a tag (thearchive/refs/tags/<tag>.tar.gzURL shape, used when a project doesn’t publish prebuilt release assets — e.g., libpg_query — or when you want to build the source yourself).
Both rules:
- Construct the release tag from a template (
v{version},bun-v{version},{version}, etc.). - Verify integrity via sha256.
- Write the consumer-supplied BUILD overlay (inline or label).
Consumers that need a Bazel toolchain wrapping the downloaded binary
declare it inside build_file_content — rules_github deliberately
doesn’t ship its own toolchain rule because toolchain providers vary
per-tool (each downstream rules_* repo has its own
ToolToolchainInfo provider shape).
github_binary_repository
load("@rules_github//github:repositories.bzl", "github_binary_repository")
github_binary_repository(name, allow_unverified, asset_template, build_file, build_file_content,
platform, platform_aliases, platform_shas, repo, strip_prefix_template,
tag_format, version)
Fetch a per-platform binary release asset from a GitHub release.
ATTRIBUTES
| Name | Description | Type | Mandatory | Default |
|---|---|---|---|---|
| name | A unique name for this repository. | Name | required | |
| allow_unverified | If True, missing sha256 for the host platform downgrades to a warning + unverified download. Useful for bumping to a new version before computing pins. | Boolean | optional | False |
| asset_template | Asset filename pattern. {version} + {platform} substituted. The platform substitution uses the alias from platform_aliases for the detected host. | String | required | |
| build_file | BUILD.bazel content as a label. Alternative to build_file_content. | Label | optional | None |
| build_file_content | Inline BUILD.bazel content for the generated repo. Either this OR build_file must be set. | String | optional | "" |
| platform | Override host-platform detection. Empty = auto-detect. | String | optional | "" |
| platform_aliases | Canonical-platform → project-specific-platform mapping. Canonical keys: darwin_aarch64, darwin_x86_64, linux_x86_64, linux_aarch64, windows_x86_64. Project values follow whatever the upstream release uses (aarch64-apple-darwin, darwin-aarch64, etc.). Missing key = canonical name used verbatim. | Dictionary: String -> String | optional | {} |
| platform_shas | Canonical-platform → sha256 hex. Lookup keys match platform_aliases. Missing entry for the host platform fails the build unless allow_unverified = True. | Dictionary: String -> String | optional | {} |
| repo | GitHub repo as owner/name (e.g. oven-sh/bun). | String | required | |
| strip_prefix_template | Optional strip-prefix pattern with {version} + {platform} substitution. Defaults to empty (binary at archive root). | String | optional | "" |
| tag_format | Release tag pattern. {version} is substituted. Examples: v{version} (default; mdbook, most tools), bun-v{version} (bun), {version} (libpg_query: 17-6.2.2 IS the tag). | String | optional | "v{version}" |
| version | Upstream version string (no leading v, no tag prefix). | String | required |
github_source_repository
load("@rules_github//github:repositories.bzl", "github_source_repository")
github_source_repository(name, allow_unverified, build_file, build_file_content, repo, sha256,
strip_prefix_template, tag_format, version)
Fetch a source tarball from a GitHub release tag.
ATTRIBUTES
| Name | Description | Type | Mandatory | Default |
|---|---|---|---|---|
| name | A unique name for this repository. | Name | required | |
| allow_unverified | Skip sha256 requirement; downgrade missing sha to warning. | Boolean | optional | False |
| build_file | BUILD.bazel content as a label. | Label | optional | None |
| build_file_content | Inline BUILD.bazel content. Either this OR build_file must be set. | String | optional | "" |
| repo | GitHub repo as owner/name. | String | required | |
| sha256 | sha256 of the auto-generated source tarball. Required unless allow_unverified = True. | String | optional | "" |
| strip_prefix_template | Override strip-prefix pattern. Default: <repo-basename>-{version} (matches GitHub’s auto-tarball convention). | String | optional | "" |
| tag_format | Release tag pattern. Same semantics as github_binary_repository. | String | optional | "v{version}" |
| version | Upstream version string. | String | required |
Conformance#
No gate findings. 8 contested atoms. See how gating works or the full report.
Contested atoms
Third-party modules where this module resolves a different version than others do. Not a violation of anything this module did — it is the actionable form of a registry-level convergence finding, and the sentence a maintainer can act on.
| Atom | Resolved here | Elsewhere |
|---|---|---|
apple_support | 1.24.2 | 2.2.0 ×1 |
bazel_skylib | 1.8.2 | 1.9.0 ×2 |
nlohmann_json | 3.6.1 | 3.12.0.bcr.1 ×1 |
protobuf | 33.4 | 34.0.bcr.1 ×2 |
rules_jvm_external | 6.7 | 6.8 ×4 |
rules_python | 1.7.0 | 2.0.1 ×1 |
rules_swift | 3.1.2 | 3.6.1 ×1 |
upb | 0.0.0-20220923-a547704 | 0.0.0-20230516-61a97ef ×1 |
Dependencies#
Depends on
Used by (5 in the registry)
Versions#
3 published versions, newest first. Each resolves to an immutable, integrity-checked archive.
| Version | Integrity (sha256) | Source archive |
|---|---|---|
0.1.2 latest | D4ETRrFeQ6p4xAHm… | tag archive ↗ |
0.1.1 | snzsRW6ro/YUbcAS… | tag archive ↗ |
0.1.0 | U0zYSoQclbXfAXrA… | tag archive ↗ |
Changelog#
All notable changes to rules_github. The format is loosely Keep a Changelog — version headers mirror the published bazel-registry entries.
0.1.2 — commit-pinned sources + bzlmod extension
github_source_repositorygains acommitattr: fetcharchive/<sha>.tar.gzfor repos without release tags (e.g. research repos likeHowieHwong/MetaTool).versionandcommitare mutually exclusive; exactly one is required.strip_prefix_templatenow also substitutes{commit}.- New
//github:extensions.bzlmodule extension (github) withgithub.source/github.binarytag classes, so the repository rules are usable directly fromMODULE.bazelunder bzlmod without a hand-rolled consumer extension.
0.1.1 — public bzl_library targets
- Mark
bzl_librarytargets as public so downstream stardoc builds in consumer repos (rules_bun, rules_postgres, …) can depend on them.
0.1.0 — initial release
- First cut of shared Bazel repository rules for fetching content from
GitHub releases:
github_binary_repository(per-platform release asset URLs) andgithub_source_repository(tag tarball URLs). Acts as the common substrate beneath fastverk’s otherrules_*modules.