Bump Bazel to v7.7.1

.bazelrc

@@ -57,11 +57,9 @@ build:clang-tsan --copt -fsanitize=thread
 build:clang-tsan --linkopt -fsanitize=thread
 build:clang-tsan --test_env=TSAN_OPTIONS=suppressions=bazel/tsan_suppressions.txt
 
-# Use Clang-Tidy tool.
-build:clang-tidy --config=clang
-build:clang-tidy --aspects @bazel_clang_tidy//clang_tidy:clang_tidy.bzl%clang_tidy_aspect
-build:clang-tidy --@bazel_clang_tidy//:clang_tidy_config=@proxy_wasm_cpp_host//:clang_tidy_config
-build:clang-tidy --output_groups=report
+# Use Clang-Tidy tool with hermetic LLVM toolchain via aspect_rules_lint.
+build:clang-tidy --aspects //tools/lint:linters.bzl%clang_tidy
+build:clang-tidy --output_groups=rules_lint_report
 
 # Use GCC compiler.
 build:gcc --action_env=BAZEL_COMPILER=gcc

.bazelversion

@@ -1 +1 @@
-6.5.0
+7.7.1

WORKSPACE

@@ -8,6 +8,11 @@ load("@proxy_wasm_cpp_host//bazel:dependencies.bzl", "proxy_wasm_cpp_host_depend
 
 proxy_wasm_cpp_host_dependencies()
 
+# Setup bazel_features internal repos (required for aspect_rules_lint)
+load("@proxy_wasm_cpp_host//bazel:setup_features.bzl", "setup_bazel_features")
+
+setup_bazel_features()
+
 load("@proxy_wasm_cpp_host//bazel:dependencies_python.bzl", "proxy_wasm_cpp_host_dependencies_python")
 
 proxy_wasm_cpp_host_dependencies_python()

bazel/dependencies.bzl

@@ -12,6 +12,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+load("@aspect_rules_lint//format:repositories.bzl", "rules_lint_dependencies")
+load("@bazel_lib//lib:repositories.bzl", "bazel_lib_dependencies", "bazel_lib_register_toolchains")
 load("@com_google_protobuf//:protobuf_deps.bzl", "protobuf_deps")
 load("@envoy_toolshed//sysroot:sysroot.bzl", "setup_sysroots")
 load("@proxy_wasm_cpp_host//bazel/cargo/wasmsign/remote:crates.bzl", wasmsign_crate_repositories = "crate_repositories")
@@ -54,6 +56,11 @@ def proxy_wasm_cpp_host_dependencies():
     )
     crate_universe_dependencies(bootstrap = True)
 
+    # Aspect dependencies for clang-tidy integration
+    rules_lint_dependencies()
+    bazel_lib_dependencies()
+    bazel_lib_register_toolchains()
+
     setup_sysroots()
     bazel_toolchain_dependencies()
     llvm_toolchain(

bazel/repositories.bzl

@@ -48,14 +48,42 @@ def proxy_wasm_cpp_host_repositories():
         urls = ["https://github.com/bazelbuild/rules_cc/releases/download/0.0.9/rules_cc-0.0.9.tar.gz"],
     )
 
+    # aspect_rules_lint v1.12.0 for modern clang-tidy integration
     maybe(
         http_archive,
-        name = "bazel_clang_tidy",
-        sha256 = "6ed23cbff9423a30ef10becf57210a26d54fe198a211f4037d931c06f843c023",
-        strip_prefix = "bazel_clang_tidy-c2fe98cfec0430e78bff4169e9ca0a43123e4c99",
-        url = "https://github.com/erenon/bazel_clang_tidy/archive/c2fe98cfec0430e78bff4169e9ca0a43123e4c99.tar.gz",
-        patches = ["@proxy_wasm_cpp_host//bazel/external:bazel_clang_tidy.patch"],
-        patch_args = ["-p1"],
+        name = "aspect_rules_lint",
+        sha256 = "a8a63bd071a39bd5be1f99d9f258eac674673c98505f9fc5b4c76587f67278cd",
+        strip_prefix = "rules_lint-1.12.0",
+        url = "https://github.com/aspect-build/rules_lint/releases/download/v1.12.0/rules_lint-v1.12.0.tar.gz",
+    )
+
+    # bazel_lib v3.0.1 required by aspect_rules_lint v1.12.0
+    maybe(
+        http_archive,
+        name = "bazel_lib",
+        sha256 = "8b074b1a2731d29f6b95defdca95297354dc424492caf7019cf6b9f36afba54f",
+        strip_prefix = "bazel-lib-3.0.1",
+        url = "https://github.com/bazel-contrib/bazel-lib/releases/download/v3.0.1/bazel-lib-v3.0.1.tar.gz",
+    )
+
+    # aspect_bazel_lib alias for aspect_rules_js v2.1.2 compatibility
+    # aspect_rules_js expects @aspect_bazel_lib while aspect_rules_lint expects @bazel_lib
+    # Both repos reference the same bazel-lib v3.0.1 release to maintain consistency
+    maybe(
+        http_archive,
+        name = "aspect_bazel_lib",
+        sha256 = "8b074b1a2731d29f6b95defdca95297354dc424492caf7019cf6b9f36afba54f",
+        strip_prefix = "bazel-lib-3.0.1",
+        url = "https://github.com/bazel-contrib/bazel-lib/releases/download/v3.0.1/bazel-lib-v3.0.1.tar.gz",
+    )
+
+    # aspect_rules_js is required by aspect_rules_lint
+    maybe(
+        http_archive,
+        name = "aspect_rules_js",
+        sha256 = "fbc34d815a0cc52183a1a26732fc0329e26774a51abbe0f26fc9fd2dab6133b4",
+        strip_prefix = "rules_js-2.1.2",
+        url = "https://github.com/aspect-build/rules_js/releases/download/v2.1.2/rules_js-v2.1.2.tar.gz",
     )
 
     maybe(
@@ -180,7 +208,7 @@ def proxy_wasm_cpp_host_repositories():
         # 13.8.258.26
         commit = "de9d0f8b56ae61896e4d2ac577fc589efb14f87d",
         remote = "https://chromium.googlesource.com/v8/v8",
-        shallow_since = "1752074621 -0400",
+        shallow_since = "1752074621",
         patches = [
             "@proxy_wasm_cpp_host//bazel/external:v8.patch",
         ],

bazel/setup_features.bzl

@@ -0,0 +1,21 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Setup bazel_features internal repositories."""
+
+load("@bazel_features//private:repos.bzl", "bazel_features_repos")
+
+def setup_bazel_features():
+    """Initialize bazel_features internal repos (needed for WORKSPACE compat)."""
+    bazel_features_repos()

bazel/wasm.bzl

@@ -64,7 +64,7 @@ def _wasm_attrs(transition):
         "binary": attr.label(mandatory = True, cfg = transition),
         "signing_key": attr.label_list(allow_files = True),
         "_wasmsign_tool": attr.label(default = "//bazel/cargo/wasmsign/remote:wasmsign__wasmsign", executable = True, cfg = "exec"),
-        "_whitelist_function_transition": attr.label(default = "@bazel_tools//tools/whitelists/function_transition_whitelist"),
+        "_allowlist_function_transition": attr.label(default = "@bazel_tools//tools/allowlists/function_transition_allowlist"),
     }
 
 wasm_rust_binary_rule = rule(

tools/lint/BUILD

@@ -0,0 +1,30 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+load("@bazel_skylib//rules:native_binary.bzl", "native_binary")
+
+# Make hermetic clang-tidy available as a binary for aspect_rules_lint
+native_binary(
+    name = "clang_tidy",
+    src = select(
+        {
+            "@bazel_tools//src/conditions:linux_x86_64": "@llvm_toolchain_llvm//:bin/clang-tidy",
+            "@bazel_tools//src/conditions:linux_aarch64": "@llvm_toolchain_llvm//:bin/clang-tidy",
+            "@bazel_tools//src/conditions:darwin_x86_64": "@llvm_toolchain_llvm//:bin/clang-tidy",
+            "@bazel_tools//src/conditions:darwin_arm64": "@llvm_toolchain_llvm//:bin/clang-tidy",
+        },
+    ),
+    out = "clang_tidy",
+    visibility = ["//visibility:public"],
+)

tools/lint/linters.bzl

@@ -0,0 +1,23 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Linter configurations for the project."""
+
+load("@aspect_rules_lint//lint:clang_tidy.bzl", "lint_clang_tidy_aspect")
+
+# Configure clang-tidy to use the hermetic LLVM toolchain
+clang_tidy = lint_clang_tidy_aspect(
+    binary = "@@//tools/lint:clang_tidy",
+    configs = ["@@//:.clang-tidy"],
+)