The ocx module extension.
Bootstraps the pinned ocx CLI (@ocx_tool) and declares repositories that
provision tools through it. The implementation is a pure function of the
tags — all host detection and environment access happens inside the
repository rules — so the extension is marked reproducible and stays out of
MODULE.bazel.lock.
ocx = use_extension("@rules_ocx//ocx:extensions.bzl", "ocx")
ocx.download(dist_manifest, triple, version)
ocx.package(name, bins, index, isolated_home, package, pins, platform_aliases, platforms)
ocx.project(name, bins, groups, isolated_home, ocx_lock, ocx_toml, platform)
Provisions tools through the OCX package manager.
Always creates @ocx_tool (the pinned ocx CLI). ocx.project() provisions
a workspace toolchain from ocx.toml/ocx.lock; ocx.package() provisions
individual OCI packages. See the tag class docs for details.
TAG CLASSES
Overrides the ocx CLI bootstrap. Root module only; at most one.
Attributes
| Name | Description | Type | Mandatory | Default |
|---|---|---|---|---|
| dist_manifest | dist.json release manifest snapshot to resolve the download from. | Label | optional | "@rules_ocx//dist:dist.json" |
| triple | Exact release target triple, overriding host detection. | String | optional | "" |
| version | Exact ocx version (default: the version pinned with this rules_ocx release). | String | optional | "" |
Provisions a single OCX package from an OCI registry.
Attributes
| Name | Description | Type | Mandatory | Default |
|---|---|---|---|---|
| name | Name of the generated repository (hub name when platforms is set). |
Name | required | |
| bins | Lazy provisioning: names of the executables to expose. When set, nothing is installed at fetch time — each name becomes a launcher re-entering ocx package exec, materializing the package on first execution. Requires a digest-pinned identity (pins or ‘@sha256:’); //:content is not available in lazy mode. |
List of strings | optional | [] |
| index | Committed ocx index snapshot directory (created with ocx --index <dir> index update <package>, refreshed the same way). When set, tag resolution is frozen to the snapshot — floating tags like ‘:latest’ become reproducible until the snapshot is refreshed. |
Label | optional | None |
| isolated_home | Use a repository-local ocx store instead of the shared user OCX_HOME. | Boolean | optional | False |
| package | Fully-qualified identifier: ‘registry/repo[:tag][@sha256:…]’. Freeze tag resolution with index, or pin per-platform manifest digests with pins. |
String | required | |
| pins | Per-platform manifest pins: ocx platform key -> ‘sha256:…’ digest of that platform’s manifest (as reported by ocx package install -p <platform>). The matching platform installs ‘registry/repo@ |
Dictionary: String -> String | optional | {} |
| platform_aliases | Optional declared-platform -> real-platform remap. Each key must appear in platforms; its value is the canonical ocx platform actually sent to -p and used to derive the hub’s Bazel constraints. Everything Bazel-facing — repo suffix, pins lookup, config_setting, use_repo name — still keys on the declared platform; undeclared platforms are sent as-is. Example: {‘linux/arm64’: ‘linux/arm64+libc.musl’} provisions a musl arm64 build under the plain ‘linux/arm64’ target. |
Dictionary: String -> String | optional | {} |
| platforms | ocx platform keys (‘linux/amd64’, …) to provision in addition to the host: creates ‘ |
List of strings | optional | [] |
Provisions the toolchain of a workspace ocx.toml + ocx.lock. Root module only.
Attributes
| Name | Description | Type | Mandatory | Default |
|---|---|---|---|---|
| name | Name of the generated repository. | Name | required | |
| bins | Lazy provisioning: names of the executables to expose. When set, nothing is pulled at fetch time — each name becomes a launcher re-entering ocx run, materializing the toolchain on first execution. Actions key on the lockfile, so fully remote-cached builds download no tool content. |
List of strings | optional | [] |
| groups | ocx.toml groups to provision (scopes both the pull and the composed environment). Reserved names: ‘default’ = the top-level [tools] table, ‘all’ = default + every group. | List of strings | optional | [] |
| isolated_home | Use a repository-local ocx store instead of the shared user OCX_HOME. | Boolean | optional | False |
| ocx_lock | The committed ocx.lock (watched; edits refetch). | Label | required | |
| ocx_toml | The project ocx.toml. | Label | required | |
| platform | ocx platform key (‘linux/arm64’, …) to compose for; empty = host. A foreign platform pulls that platform’s leaves from the same ocx.lock and exposes env.bzl only (no runnable launchers). Incompatible with bins. | String | optional | "" |