ci: stop duplicate PR builds; pin actions to SHAs

.bazelrc

@@ -1 +1,7 @@
 common --enable_bzlmod
+
+# The go_deps extension is isolated so the docker proto-disable gazelle_override
+# (forbidden in non-root modules) keeps working when bazel/test consumes this
+# module as a dependency to build the from-source container-structure-test
+# binary. Isolated usages may carry overrides regardless of root status.
+common --experimental_isolated_extension_usages

.github/workflows/bazel.yaml

@@ -10,7 +10,7 @@ on:
 
 jobs:
   test:
-    uses: bazel-contrib/.github/.github/workflows/bazel.yaml@v7
+    uses: bazel-contrib/.github/.github/workflows/bazel.yaml@v7.7.0
     with:
       folders: '["bazel/test"]'
       exclude_windows: true

.github/workflows/integration-tests.yml

@@ -1,47 +1,76 @@
 name: PR unit tests
 
-# Triggers the workflow on push or pull request events
-on: [push, pull_request]
+# PRs are covered by pull_request; push is limited to main so same-repo PR
+# branches don't run every build twice.
+on:
+  push:
+    branches: [main]
+  pull_request:
 
 permissions: read-all
 
 concurrency:
-  # On master/release, we don't want any jobs cancelled
+  # On main, we don't want any jobs cancelled
   # On PR branches, we cancel the job if new commits are pushed
   # More info: https://stackoverflow.com/a/70972844/1261287
   group: ${{ github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
 jobs:
   build:
     name: PR unit tests
     strategy:
       matrix:
-        os: [ubuntu-latest, macos-12]
+        # macos-15-intel is the only GitHub-hosted macOS runner that can run a
+        # Docker daemon: colima needs nested virtualization, which is absent on
+        # Apple Silicon runners (HV_UNSUPPORTED) and gone from retired macos-12/13.
+        os: [ubuntu-latest, macos-15-intel]
       fail-fast: false
     runs-on: ${{ matrix.os }}
-    
+
     steps:
-    - name: start docker
-      if: ${{ matrix.os == 'macos-12' }}
-      run: |
-        brew install docker
-        colima start
-        echo "DOCKER_HOST=unix:///Users/runner/.colima/default/docker.sock" >> $GITHUB_ENV
-
+    # Installs colima + the Docker CLI and starts the daemon; sets the active
+    # docker context so `docker` works without DOCKER_HOST. macOS-only — the
+    # action's own ARM64 guard exits if it ever lands on an Apple Silicon runner.
+    - name: Set up Docker (macOS)
+      if: ${{ runner.os == 'macOS' }}
+      uses: douglascamata/setup-docker-macos-action@d5ccc6aae0ce23e7700154f5e63cc53e6433ac48  # v1.1.0
+
+    - name: Point go-dockerclient at colima's socket (macOS)
+      if: ${{ runner.os == 'macOS' }}
+      # The container-structure-test binary uses go-dockerclient, which honors
+      # DOCKER_HOST but NOT the docker CLI context that colima configures. Without
+      # this it falls back to /var/run/docker.sock (absent on colima) and every
+      # docker-driver test fails. Derive the socket from colima's docker context.
+      run: echo "DOCKER_HOST=$(docker context inspect colima -f '{{.Endpoints.docker.Host}}')" >> "$GITHUB_ENV"
+
     - name: Set up Go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16  # v6.5.0
       with:
-        go-version: ^1.22
+        go-version: ^1.24
       id: go
-    
-    - uses: imjasonh/setup-crane@v0.4
+
+    - uses: imjasonh/setup-crane@59c71e96a00b28651f10369ba3359a6d730740a0  # v0.6
 
     - name: Check out code into the Go module directory
-      uses: actions/checkout@v4
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
       with:
         fetch-depth: 0
+        persist-credentials: false
 
     - name: Run tests
       run: |
         make test
+
+    # Ensure the Go code stays buildable and testable via Bazel (rules_go + gazelle).
+    # Scoped to the Go packages: //bazel/test is the rule's smoke test (covered by
+    # the dedicated Bazel workflow as its own module).
+    - name: Bazel
+      if: ${{ matrix.os == 'ubuntu-latest' }}
+      run: |
+        bazel build //cmd/... //pkg/... //internal/... //testutil/...
+        bazel test //pkg/... //internal/...
+        # Doc-freshness: //bazel/docs:update_test fails if bazel/docs/defs.md
+        # drifts from the rule. Run `bazel run //bazel/docs:update` to regenerate.
+        bazel build //bazel/docs/...
+        bazel test //bazel/docs:update_test

.github/workflows/release.yml

@@ -13,15 +13,15 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
 
     - name: Set up Go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@v6
       with:
         go-version-file: 'go.mod'
 
     - name: Run GoReleaser
-      uses: goreleaser/goreleaser-action@v6
+      uses: goreleaser/goreleaser-action@v7
       with:
         distribution: goreleaser
         version: latest

BUILD.bazel

@@ -1,11 +1,16 @@
 load("@bazel_skylib//:bzl_library.bzl", "bzl_library")
+load("@gazelle//:def.bzl", "gazelle")
+
+# gazelle:prefix github.com/GoogleContainerTools/container-structure-test
+# gazelle:exclude bazel
+gazelle(name = "gazelle")
 
 # For stardoc to reference the file directly
 exports_files(["defs.bzl"])
 
 bzl_library(
     name = "defs",
     srcs = ["defs.bzl"],
-    deps = ["//bazel:container_structure_test"],
     visibility = ["//visibility:public"],
+    deps = ["//bazel:container_structure_test"],
 )

MODULE.bazel

@@ -29,3 +29,31 @@ register_toolchains("@structure_test_toolchains//:all")
 
 # 0.5.4 is the first version with bzlmod support
 bazel_dep(name = "stardoc", version = "0.7.2", dev_dependency = True, repo_name = "io_bazel_stardoc")
+
+bazel_dep(name = "rules_go", version = "0.61.1", repo_name = "io_bazel_rules_go")
+bazel_dep(name = "gazelle", version = "0.51.3")
+
+# go-dockerclient v1.13.2 declares `go 1.25.5`; pin the SDK so bazel's go_deps
+# fetch/build satisfies that directive (rules_go 0.61.1 otherwise defaults to
+# go 1.25.0, which fails with "requires go >= 1.25.5").
+go_sdk = use_extension("@io_bazel_rules_go//go:extensions.bzl", "go_sdk")
+go_sdk.download(version = "1.25.5")
+
+go_deps = use_extension("@gazelle//:extensions.bzl", "go_deps", isolate = True)
+go_deps.from_file(go_mod = "//:go.mod")
+
+# All *direct* Go dependencies of the module have to be listed explicitly.
+use_repo(
+    go_deps,
+    "com_github_fsouza_go_dockerclient",
+    "com_github_google_go_cmp",
+    "com_github_google_go_containerregistry",
+    "com_github_joho_godotenv",
+    "com_github_moby_sys_sequential",
+    "com_github_opencontainers_image_spec",
+    "com_github_pkg_errors",
+    "com_github_sirupsen_logrus",
+    "com_github_spf13_cobra",
+    "in_gopkg_yaml_v2",
+    "org_golang_x_crypto",
+)