MODULE.bazel

module(
    name = "ql",
    version = "0.0",
    repo_name = "codeql",
)

# this points to our internal repository when `codeql` is checked out as a submodule thereof
# when building things from `codeql` independently this is stubbed out in `.bazelrc`
bazel_dep(name = "semmle_code", version = "0.0")
local_path_override(
    module_name = "semmle_code",
    path = "..",
)

# see https://registry.bazel.build/ for a list of available packages

bazel_dep(name = "platforms", version = "1.0.0")
bazel_dep(name = "rules_cc", version = "0.2.20")
bazel_dep(name = "rules_go", version = "0.60.0")
bazel_dep(name = "rules_java", version = "9.6.1")
bazel_dep(name = "rules_pkg", version = "1.2.0")
bazel_dep(name = "rules_nodejs", version = "6.7.5")
bazel_dep(name = "rules_python", version = "1.9.0")
bazel_dep(name = "rules_shell", version = "0.7.1")
bazel_dep(name = "bazel_skylib", version = "1.9.0")
bazel_dep(name = "abseil-cpp", version = "20260107.1", repo_name = "absl")
bazel_dep(name = "nlohmann_json", version = "3.12.0.bcr.1", repo_name = "json")
bazel_dep(name = "fmt", version = "12.1.0-codeql.1")
bazel_dep(name = "rules_kotlin", version = "2.2.2-codeql.1")
bazel_dep(name = "gazelle", version = "0.50.0")
bazel_dep(name = "rules_dotnet", version = "0.21.5-codeql.2")
bazel_dep(name = "googletest", version = "1.17.0.bcr.2")
bazel_dep(name = "rules_rust", version = "0.74.0")
bazel_dep(name = "rules_swift", version = "4.0.0-rc5-codeql.2")
bazel_dep(name = "swift-syntax", version = "603.0.2")
bazel_dep(name = "zstd", version = "1.5.7.bcr.1")

bazel_dep(name = "buildifier_prebuilt", version = "6.4.0", dev_dependency = True)

# Keep edition and version approximately in sync with internal repo.
# the versions there are canonical, the versions here are used for CI in github/codeql, as well as for the vendoring of dependencies.
RUST_EDITION = "2024"

# run buildutils-internal/scripts/fill-rust-sha256s.py when updating (internal repo)
# a nightly toolchain is required to enable experimental_use_cc_common_link, which we require internally
# we prefer to run the same version as internally, even if experimental_use_cc_common_link is not really
# required in this repo
RUST_VERSION = "nightly/2026-09-03"

rust = use_extension("@rules_rust//rust:extensions.bzl", "rust")
rust.toolchain(
    edition = RUST_EDITION,
    # We need those extra target triples so that we can build universal binaries on macos
    extra_target_triples = [
        "x86_64-apple-darwin",
        "aarch64-apple-darwin",
    ],
    # generated by buildutils-internal/scripts/fill-rust-sha256s.py (internal repo)
    sha256s = {
        "2026-09-03/rustc-nightly-x86_64-unknown-linux-gnu.tar.xz": "bd1f0986150596835e808635d81786c60ab9da3981687dfb00918329925e837a",
        "2026-09-03/rustc-nightly-x86_64-apple-darwin.tar.xz": "8f3da4fcdaf5c8574f723ee0dab80c0e47e59e97fb55c1b84a1dc96dc2b90f6b",
        "2026-09-03/rustc-nightly-aarch64-apple-darwin.tar.xz": "ef4e9dda67ee052fb60b506f76a5dbd2f1c45822aec878b31b98c2fe75ab6f84",
        "2026-09-03/rustc-nightly-x86_64-pc-windows-msvc.tar.xz": "b2feb930850f69c40c4fc4658a054676de9a3c263b6e1afbdad86b61ab0940ef",
        "2026-09-03/clippy-nightly-x86_64-unknown-linux-gnu.tar.xz": "9715b53a8e80261f85eeddc6096e82e6038218ddd81e9fd8d7d5d558d076191b",
        "2026-09-03/clippy-nightly-x86_64-apple-darwin.tar.xz": "83b26f9becd27e65b822a70d2f0ca1b676e0bad3d7a99597adf65326692744bb",
        "2026-09-03/clippy-nightly-aarch64-apple-darwin.tar.xz": "51708a4c7399d2a71e5fcaa491a9e233e63c98f67dcad7bbe11fd164ba604690",
        "2026-09-03/clippy-nightly-x86_64-pc-windows-msvc.tar.xz": "2990517d181ffe467505070d8842ae63089b781addedffa296100d018b746979",
        "2026-09-03/cargo-nightly-x86_64-unknown-linux-gnu.tar.xz": "a60615509715996b8d4d54b30a7db8a1cd62400d06206dbeeb20b223ad1e6b34",
        "2026-09-03/cargo-nightly-x86_64-apple-darwin.tar.xz": "1650d406de2cef5d7b0d573fa131937a09559c33b03766380fb3b97eb30b2493",
        "2026-09-03/cargo-nightly-aarch64-apple-darwin.tar.xz": "058ced0d2b26cde728a0553a572c0895cbbc5bdaaf23dc995649737cb2dd043d",
        "2026-09-03/cargo-nightly-x86_64-pc-windows-msvc.tar.xz": "1ce268af2f3e143b4a4aa114cfcead7091659af7b36660b007652b1f34329dff",
        "2026-09-03/llvm-tools-nightly-x86_64-unknown-linux-gnu.tar.xz": "c4557aaddd0b4a65593bd1f8474322fe3d91e5cc41a0221f383a8780256ad102",
        "2026-09-03/llvm-tools-nightly-x86_64-apple-darwin.tar.xz": "47d0e8184d270c223c298a227b0485afcfa5dc70429f5454b472a8b69ca03e9c",
        "2026-09-03/llvm-tools-nightly-aarch64-apple-darwin.tar.xz": "141b1f097db3a292f8641fe6e4ec1e48edb758154a2defa2dbd4a088af72caf7",
        "2026-09-03/llvm-tools-nightly-x86_64-pc-windows-msvc.tar.xz": "f6bb9e1cabc5b790bd419b7fe18c7ff132a40d0ff2db794efd2d5f4c0b535ba0",
        "2026-09-03/rust-std-nightly-x86_64-unknown-linux-gnu.tar.xz": "7bfd37eda0920b04ef50b4785475c5fa2cea8df19c24f3879d0b5cac6e4dcdbc",
        "2026-09-03/rust-std-nightly-x86_64-apple-darwin.tar.xz": "462e83115594799aff5d77a221b29a59d5e166435773c8eae37d047a8a5f39e1",
        "2026-09-03/rust-std-nightly-aarch64-apple-darwin.tar.xz": "79f676f8265e332ece71eea226a3a9b124506c9460e758ca1f669f80e0336eb0",
        "2026-09-03/rust-std-nightly-x86_64-pc-windows-msvc.tar.xz": "075661d74da5a65b8d5c8adb9375a868fea80d5b0e5c131af6f4cd059d6b3113",
    },
    versions = [RUST_VERSION],
)
use_repo(rust, "rust_toolchains")

register_toolchains("@rust_toolchains//:all")

# deps for python extractor
# keep in sync by running `misc/bazel/3rdparty/update_cargo_deps.sh`
py_deps = use_extension("//misc/bazel/3rdparty:py_deps_extension.bzl", "p")
use_repo(
    py_deps,
    "vendor_py",
    "vendor_py__anyhow-1.0.95",
    "vendor_py__cc-1.2.14",
    "vendor_py__clap-4.5.30",
    "vendor_py__regex-1.11.1",
    "vendor_py__serde_json-1.0.138",
    "vendor_py__tree-sitter-0.24.7",
    "vendor_py__tree-sitter-graph-0.12.0",
)

# deps for ruby+rust
# keep in sync by running `misc/bazel/3rdparty/update_cargo_deps.sh`
tree_sitter_extractors_deps = use_extension("//misc/bazel/3rdparty:tree_sitter_extractors_extension.bzl", "r")
use_repo(
    tree_sitter_extractors_deps,
    "vendor_ts",
    "vendor_ts__anyhow-1.0.104",
    "vendor_ts__argfile-1.0.0",
    "vendor_ts__chalk-ir-0.104.0",
    "vendor_ts__chrono-0.4.45",
    "vendor_ts__clap-4.6.7",
    "vendor_ts__dunce-1.0.5",
    "vendor_ts__either-1.19.0",
    "vendor_ts__encoding-0.2.33",
    "vendor_ts__figment-0.10.19",
    "vendor_ts__flate2-1.1.9",
    "vendor_ts__glob-0.3.4",
    "vendor_ts__globset-0.4.18",
    "vendor_ts__itertools-0.15.0",
    "vendor_ts__lazy_static-1.5.1",
    "vendor_ts__mustache-0.9.0",
    "vendor_ts__num-traits-0.2.19",
    "vendor_ts__num_cpus-1.17.0",
    "vendor_ts__proc-macro2-1.0.107",
    "vendor_ts__quote-1.0.47",
    "vendor_ts__ra_ap_base_db-0.0.357",
    "vendor_ts__ra_ap_cfg-0.0.357",
    "vendor_ts__ra_ap_hir-0.0.357",
    "vendor_ts__ra_ap_hir_def-0.0.357",
    "vendor_ts__ra_ap_hir_expand-0.0.357",
    "vendor_ts__ra_ap_hir_ty-0.0.357",
    "vendor_ts__ra_ap_ide_db-0.0.357",
    "vendor_ts__ra_ap_intern-0.0.357",
    "vendor_ts__ra_ap_load-cargo-0.0.357",
    "vendor_ts__ra_ap_parser-0.0.357",
    "vendor_ts__ra_ap_paths-0.0.357",
    "vendor_ts__ra_ap_project_model-0.0.357",
    "vendor_ts__ra_ap_span-0.0.357",
    "vendor_ts__ra_ap_stdx-0.0.357",
    "vendor_ts__ra_ap_syntax-0.0.357",
    "vendor_ts__ra_ap_syntax-bridge-0.0.357",
    "vendor_ts__ra_ap_toolchain-0.0.357",
    "vendor_ts__ra_ap_vfs-0.0.357",
    "vendor_ts__rand-0.10.3",
    "vendor_ts__rayon-1.12.0",
    "vendor_ts__regex-1.13.1",
    "vendor_ts__serde-1.0.229",
    "vendor_ts__serde_json-1.0.151",
    "vendor_ts__serde_with-3.24.0",
    "vendor_ts__serde_yaml-0.9.34-deprecated",
    "vendor_ts__syn-3.0.6",
    "vendor_ts__toml-1.1.6-spec-1.1.0",
    "vendor_ts__tracing-0.1.44",
    "vendor_ts__tracing-flame-0.2.0",
    "vendor_ts__tracing-subscriber-0.3.23",
    "vendor_ts__tree-sitter-0.26.9",
    "vendor_ts__tree-sitter-embedded-template-0.25.0",
    "vendor_ts__tree-sitter-json-0.24.8",
    "vendor_ts__tree-sitter-python-0.25.0",
    "vendor_ts__tree-sitter-ql-0.23.1",
    "vendor_ts__tree-sitter-ruby-0.23.1",
    "vendor_ts__triomphe-0.1.16",
    "vendor_ts__ungrammar-1.16.1",
    "vendor_ts__zstd-0.14.0",
)

http_archive = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

# rust-analyzer sources needed by the rust ast-generator (see `rust/ast-generator/README.md`).
# These should be updated through the `rust/scripts/update_rust_analyzer.py` script.
RUST_ANALYZER_SRC_TAG = "2026-10-05"

RUST_ANALYZER_SRC_INTEGRITY = "sha256-1p+2oq6NqFQjdRezQijZRzLxsZfwnLA+sPXgIiuP8Us="

http_archive(
    name = "rust-analyzer-src",
    build_file = "//rust/ast-generator:BUILD.rust-analyzer-src.bazel",
    integrity = RUST_ANALYZER_SRC_INTEGRITY,
    patch_args = ["-p1"],
    patches = [
        "//rust/ast-generator:patches/rust-analyzer.patch",
    ],
    strip_prefix = "rust-analyzer-%s" % RUST_ANALYZER_SRC_TAG,
    url = "https://github.com/rust-lang/rust-analyzer/archive/refs/tags/%s.tar.gz" % RUST_ANALYZER_SRC_TAG,
)

dotnet = use_extension("@rules_dotnet//dotnet:extensions.bzl", "dotnet")
dotnet.toolchain(dotnet_version = "10.0.100")
use_repo(dotnet, "dotnet_toolchains")

register_toolchains("@dotnet_toolchains//:all")

csharp_main_extension = use_extension("//csharp:paket.main_extension.bzl", "main_extension")
use_repo(csharp_main_extension, "paket.main")

powershell_extension = use_extension("//powershell:paket.powershell_extension.bzl", "powershell_extension")
use_repo(powershell_extension, "paket.powershell")

pip = use_extension("@rules_python//python/extensions:pip.bzl", "pip")
pip.parse(
    hub_name = "codegen_deps",
    python_version = "3.12",
    requirements_lock = "//misc/codegen:requirements_lock.txt",
)
use_repo(pip, "codegen_deps")

python = use_extension("@rules_python//python/extensions:python.bzl", "python")
python.toolchain(
    is_default = True,
    python_version = "3.12",
)
use_repo(python, "python_3_12", "python_versions")

register_toolchains("@python_versions//3.12:all")

swift_deps = use_extension("//swift/third_party:load.bzl", "swift_deps")

# following list can be kept in sync with `bazel mod tidy`
use_repo(
    swift_deps,
    "binlog",
    "picosha2",
    "swift-prebuilt-linux",
    "swift-prebuilt-linux-download-only",
    "swift-prebuilt-macos",
    "swift-prebuilt-macos-download-only",
    "swift-resource-dir-linux",
    "swift-resource-dir-macos",
)

# Hermetic swift.org toolchain for building `unified/swift-syntax-rs`.
#
# The version is pinned as a literal rather than read from
# `unified/swift-syntax-rs/.swift-version` via `swift_version_file`: the latter
# makes the extension `module_ctx.read` a `//unified/...` label, which fails to
# resolve when this repo is consumed as a dependency module (`@@ql+`) whose
# `unified/swift-syntax-rs` package is not loadable in that context. Keep this
# in sync with `unified/swift-syntax-rs/.swift-version` (used by the `cargo`
# build) and the `swift-syntax` release in `swift/Package.swift`.
swift = use_extension("@rules_swift//swift:extensions.bzl", "swift", dev_dependency = True)
swift.toolchain(
    name = "swift_toolchain",
    swift_version = "6.3.3",
)
use_repo(
    swift,
    "swift_toolchain",
    "swift_toolchain_ubuntu22.04",
    "swift_toolchain_ubuntu22.04-aarch64",
    "swift_toolchain_xcode",
)

register_toolchains(
    "@swift_toolchain//:swift_toolchain_exec_ubuntu22.04",
    "@swift_toolchain//:swift_toolchain_exec_ubuntu22.04-aarch64",
    "@swift_toolchain//:swift_toolchain_exec_xcode",
    dev_dependency = True,
)

node = use_extension("@rules_nodejs//nodejs:extensions.bzl", "node")
node.toolchain(
    name = "nodejs",
    node_urls = [
        "https://nodejs.org/dist/v{version}/{filename}",
        "https://mirrors.dotsrc.org/nodejs/release/v{version}/{filename}",
    ],
    node_version = "18.15.0",
)
use_repo(node, "nodejs", "nodejs_toolchains")

kotlin_extractor_deps = use_extension("//java/kotlin-extractor:deps.bzl", "kotlin_extractor_deps")

# following list can be kept in sync by running `bazel mod tidy` in `codeql`
use_repo(
    kotlin_extractor_deps,
    "codeql_kotlin_defaults",
    "codeql_kotlin_embeddable",
    "kotlin-compiler-1.8.0",
    "kotlin-compiler-1.9.0-Beta",
    "kotlin-compiler-1.9.20-Beta",
    "kotlin-compiler-2.0.0-RC1",
    "kotlin-compiler-2.0.20-Beta2",
    "kotlin-compiler-2.1.0-Beta1",
    "kotlin-compiler-2.1.20-Beta1",
    "kotlin-compiler-2.2.0-Beta1",
    "kotlin-compiler-2.2.20-Beta2",
    "kotlin-compiler-2.3.0",
    "kotlin-compiler-2.3.20",
    "kotlin-compiler-2.4.0",
    "kotlin-compiler-2.4.20",
    "kotlin-compiler-embeddable-1.8.0",
    "kotlin-compiler-embeddable-1.9.0-Beta",
    "kotlin-compiler-embeddable-1.9.20-Beta",
    "kotlin-compiler-embeddable-2.0.0-RC1",
    "kotlin-compiler-embeddable-2.0.20-Beta2",
    "kotlin-compiler-embeddable-2.1.0-Beta1",
    "kotlin-compiler-embeddable-2.1.20-Beta1",
    "kotlin-compiler-embeddable-2.2.0-Beta1",
    "kotlin-compiler-embeddable-2.2.20-Beta2",
    "kotlin-compiler-embeddable-2.3.0",
    "kotlin-compiler-embeddable-2.3.20",
    "kotlin-compiler-embeddable-2.4.0",
    "kotlin-compiler-embeddable-2.4.20",
    "kotlin-stdlib-1.8.0",
    "kotlin-stdlib-1.9.0-Beta",
    "kotlin-stdlib-1.9.20-Beta",
    "kotlin-stdlib-2.0.0-RC1",
    "kotlin-stdlib-2.0.20-Beta2",
    "kotlin-stdlib-2.1.0-Beta1",
    "kotlin-stdlib-2.1.20-Beta1",
    "kotlin-stdlib-2.2.0-Beta1",
    "kotlin-stdlib-2.2.20-Beta2",
    "kotlin-stdlib-2.3.0",
    "kotlin-stdlib-2.3.20",
    "kotlin-stdlib-2.4.0",
    "kotlin-stdlib-2.4.20",
)

go_sdk = use_extension("@rules_go//go:extensions.bzl", "go_sdk")
go_sdk.download(version = "1.27.2")

go_deps = use_extension("@gazelle//:extensions.bzl", "go_deps")
go_deps.from_file(go_mod = "//go/extractor:go.mod")
use_repo(go_deps, "com_github_stretchr_testify", "org_golang_x_mod", "org_golang_x_sys", "org_golang_x_tools")

ripunzip_archive = use_repo_rule("//misc/ripunzip:ripunzip.bzl", "ripunzip_archive")

# go to https://github.com/GoogleChrome/ripunzip/releases to find latest version and corresponding sha256s
ripunzip_archive(
    name = "ripunzip",
    sha256_linux_arm64 = "a282740ef376ff8dc0de3c589b7457598db15cc045b7daa688f15531612e0bbe",
    sha256_linux_x64 = "71482d7a7e4ea9176d5596161c49250c34b136b157c45f632b1111323fbfc0de",
    sha256_macos_arm64 = "604194ab13f0aba3972995d995f11002b8fc285c8170401fcd46655065df20c9",
    sha256_macos_x64 = "65367b94fd579d93d46f2d2595cc4c9a60cfcf497e3c824f9d1a7b80fa8bd38a",
    sha256_windows_x64 = "ac3874075def2b9e5074a3b5945005ab082cc6e689e1de658da8965bc23e643e",
    version = "2.0.4",
)

register_toolchains(
    "@nodejs_toolchains//:all",
)