bazel-registry: expose prebuilt protoc binaries in bzlmod repos

[Copilot]

In bzlmod mode, protobuf's @prebuilt_protoc.* repos don't expose the downloaded binary as a target. Downstream consumers fall back to compiling protoc from source, breaking builds that intentionally disable compilation (e.g., via --THIS_CC_TOOLCHAIN_IS_BROKEN).

Changes

Patch bazel/private/prebuilt_protoc_toolchain.bzl to generate BUILD targets in prebuilt repos:

filegroup(
    name = "protoc",
    srcs = ["bin/protoc"],  # or bin/protoc.exe on Windows
)

proto_toolchain(
    name = "prebuilt_protoc_toolchain",
    proto_compiler = ":protoc",
)

• filegroup produces single-file output (required by proto rules)
• proto_toolchain references the filegroup for compilation

Patch main BUILD.bazel:

• Add platform config_settings (linux-x86_64, osx-aarch_64, win64, etc.)
• Rename cc_binary(name = "protoc") → compiled_protoc
• Add protoc alias with select() routing to prebuilt binaries by platform

Additional patches:

• Add label_flag(name = "zlib") for downstream configuration
• Add -Wno-deprecated-declarations to default COPTS
• Update io BUILD to use //:zlib label_flag

When --@com_google_protobuf//bazel/toolchains:prefer_prebuilt_protoc is set, Bazel routes to prebuilt binaries instead of compiling.

Original prompt

Problem

In PR #3660, we're shifting protobuf to the bazel-registry. The current patch includes:

alias(
    name = "protoc",
    actual = select({
        ":linux-aarch_64": "@prebuilt_protoc.linux_aarch_64//:protoc",
        ":linux-x86_64": "@prebuilt_protoc.linux_x86_64//:protoc",
        ...
    }),
    visibility = ["//visibility:public"],
)

This works in WORKSPACE mode because envoy can create those repos. But in bzlmod, the @prebuilt_protoc.* repos created by protobuf's module extension are not visible to downstream consumers, so bazel run @protobuf//:protoc fails.

Solution

The prebuilt protoc repos are created by bazel/private/oss/toolchains/prebuilt/protoc_toolchain.bzl which generates a BUILD.bazel that only exposes a proto_toolchain target, not the binary itself.

Update the envoy.patch in bazel-registry/modules/protobuf/33.4.envoy/patches/ to also patch protoc_toolchain.bzl to expose the protoc binary.

Changes Required

1. Add to patches/envoy.patch a patch for bazel/private/oss/toolchains/prebuilt/protoc_toolchain.bzl

The generated BUILD.bazel currently looks like:

proto_toolchain(
    name = "prebuilt_protoc_toolchain", 
    proto_compiler = "bin/protoc",
)

Patch it to also include:

exports_files(["bin/protoc"])

alias(
    name = "protoc",
    actual = "bin/protoc",
)

For Windows, use bin/protoc.exe instead.

The patch should modify the rctx.file("BUILD.bazel", ...) call to add these targets.

2. Update source.json

After modifying the patch, recalculate the SHA256 hash for envoy.patch and update source.json.

Reference

• Current protoc_toolchain.bzl: https://github.com/protocolbuffers/protobuf/blob/main/bazel/private/oss/toolchains/prebuilt/protoc_toolchain.bzl
• PR #42907 in envoy for previous attempt: [WIP] bazel/protobuf: Remove precompiled protoc workaround/patch envoy#42907

This pull request was created from Copilot chat.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.