[omerlh]

What was broken

bazel build //src:image.tar — the target both the release workflow and yarn pretest depend on — cannot complete on current main. Same class of breakages as osskit/dafka-producer#40 (merged). This unblocks osskit/dafka-consumer#117 (and transitively the DLQ max.request.size raise): #117's CI dies in pretest before any of its code compiles.

1. rules_docker's prebuilt Go binaries are gone (the hard blocker)

container_repositories() declares http_file targets pointing at a Google Cloud Storage bucket that no longer serves anonymous reads. Every one of them 403s:

https://storage.googleapis.com/rules_docker/aad94363e63d31d574cf701df484b3e8b868a96a/puller-darwin-amd64  -> 403
https://storage.googleapis.com/rules_docker/aad94363e63d31d574cf701df484b3e8b868a96a/puller-linux-amd64   -> 403

Reproduced on #117 CI (actions/runs/30901027620) and on untouched main:

WARNING: Download from https://storage.googleapis.com/rules_docker/.../puller-darwin-amd64
         failed: class java.io.IOException GET returned 403 Forbidden
ERROR: WORKSPACE:77:23: fetching http_file rule //external:go_puller_darwin
ERROR: Analysis of target '//src:image.tar' failed; build aborted

rules_docker was archived by Google; re-pinning is not an option.

2. Base image / JDK path

openjdk:18 404s on Docker Hub (deprecated Official Image; Linux tags removed). This repo already pulled eclipse-temurin:18 via rules_docker, with a container_image symlink /usr/bin/java → /opt/java/openjdk/bin/java so java_image's entrypoint worked. Migrating to rules_oci digest-pins eclipse-temurin:18-jdk at sha256:1b8a5c3f... (JDK 18.0.2.1+1, same digest as the 18 / 18-jdk tags today) and drops the symlink — the entrypoint is java -cp /app/dafka-consumer.jar Main, and Temurin puts java on PATH.

3. CI would not have honoured .bazeliskrc anyway

docker.yml and test.yml downloaded bazelisk v1.1.0, which predates .bazeliskrc support — USE_BAZEL_VERSION=6.4.0 is silently ignored. Neither workflow pinned a JDK despite .bazelrc setting --java_language_version=18.

4. Kafka test harness (separate commit)

confluentinc/cp-kafka:7.2.2 ships Zulu 11.0.16.1, which hits JDK-8287073 under cgroup v2 (JMX agent NPE kills ZooKeeper + broker). Bumped to 7.6.0 (Zulu 11.0.21) in a separate commit, same as producer #40.

What changed

Migrated from archived rules_docker (java_image) to rules_oci, packaging the java_binary deploy jar — same shape as producer #40's Scala deploy-jar approach.

WORKSPACE — drop io_bazel_rules_docker; add rules_oci 1.8.0, rules_pkg 0.9.1, aspect_bazel_lib 2.7.7 (pinned ahead of rules_oci_dependencies() for arm64 jq); bump bazel_skylib 1.0.3 → 1.4.2.

src/BUILD — pkg_tar + oci_image + oci_tarball + copy_file so bazel build //src:image.tar still writes bazel-bin/src/image.tar and loads as bazel/src:image. docker.yml load/tag/push and package.json pretest are unchanged.

CI — bazelisk v1.1.0 → v1.20.0 (+ PATH); Temurin 18 via setup-java; checkout/node/login/metadata action major bumps.

5. Bazel Javac workers on Temurin 18 (consumer-specific)

After the rules_docker 403 was gone, CI analysis succeeded but compilation failed:

Caused by: java.lang.NullPointerException: Cannot invoke "jdk.internal.platform.CgroupInfo.getMountPoint()" because "anyController" is null
  at jdk.internal.platform.cgroupv2.CgroupV2Subsystem.getInstance(CgroupV2Subsystem.java:80)
  ...
  at com.google.devtools.build.lib.worker.WorkRequestHandler$CpuTimeBasedGcScheduler.<clinit>(WorkRequestHandler.java:635)

Same JDK-8287073, but in Bazel's persistent Javac worker under Temurin 18 (EOL; fix never landed on 18). Producer #40 did not hit this because it compiles Scala. Added build --strategy=Javac=local in .bazelrc so Javac runs without that worker path. Runtime image stays on eclipse-temurin:18-jdk.

Verification

Built in a Linux container (eclipse-temurin:18-jdk + build-essential + python3 + bazelisk v1.20.0, --platform linux/amd64) because this workstation has no local JDK 18. Loaded bazel/src:image, started the container with required env and no broker:

• JVM: Temurin-18.0.2.1+1
• Entrypoint / JAVA_RUNFILES=/app as intended
• GET /alive → 200 true
• Kafka "broker may not be available" warnings expected and fine

No image was published to any registry.

Follow-ups

• #117 should rebase / refresh from main after this merges — its branch was cut before this build fix.
• Do not merge this PR into a release/tag push from this change alone unless intentionally cutting a new consumer image; this PR only restores the ability to build.

Made with Cursor