feat. Bazel V2 Detector With Bzlmod Support #1634

bd-samratmuk · 2026-01-27T15:29:07Z

This PR introduces the Bazel V2 detector, delivering mode-agnostic dependency extraction for both BZLMOD (MODULE.bazel) and WORKSPACE projects.

Key features

Automatic mode detection (BZLMOD vs WORKSPACE) via bazel mod show_repo, with fallback and manual override.
Pipeline selection (MAVEN_INSTALL, MAVEN_JAR, HASKELL_CABAL_LIBRARY, HTTP_ARCHIVE) based on graph probing.
Enhanced HTTP-family detection (http_archive, git_repository, go_repository, http_file) with mode-aware strategies and configurable probe limits.
Deterministic pipeline execution order and single code location output with project name generation from the Bazel target. The code location generation pattern is same as v1.

Properties introduced/changed

detect.bazel.dependency.sources (renamed from detect.bazel.workspace.rules): consistent naming across modes; same behavior, supports manual pipeline selection to skip probing.
detect.bazel.mode: optional override for BZLMOD or WORKSPACE when auto-detection isn’t suitable.
detect.bazel.http.probe.limit: caps external repo probing for performance on large targets.

Copilot

Pull request overview

This PR introduces the Bazel V2 detector, a comprehensive rewrite that delivers robust, mode-agnostic dependency extraction for both BZLMOD (MODULE.bazel) and WORKSPACE-based Bazel projects. The V2 detector replaces the legacy detector's hardcoded WORKSPACE-only approach with an intelligent pipeline selection system that automatically detects the Bazel environment mode and probes the dependency graph to determine which extraction pipelines to run.

Changes:

Introduced automatic Bazel mode detection (BZLMOD vs WORKSPACE) with graceful fallback and manual override capability
Implemented intelligent dependency graph probing to automatically select appropriate extraction pipelines
Enhanced HTTP-family detection with mode-aware strategies and configurable probe limits
Renamed detect.bazel.workspace.rules to detect.bazel.dependency.sources for consistent naming across modes

Reviewed changes

Copilot reviewed 43 out of 47 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
`src/main/java/com/blackduck/integration/detect/lifecycle/run/operation/OperationRunner.java`	Switches from legacy Bazel detector to new V2 detector
`src/main/java/com/blackduck/integration/detect/configuration/DetectProperties.java`	Renames property from `DETECT_BAZEL_WORKSPACE_RULES` to `DETECT_BAZEL_DEPENDENCY_SOURCES` and adds new properties for mode override and HTTP probe limit
`detectable/src/main/java/com/blackduck/integration/detectable/detectables/bazel/DependencySource.java`	Renames enum from `WorkspaceRule` to `DependencySource` for consistent terminology
`detectable/src/main/java/com/blackduck/integration/detectable/detectables/bazel/v2/BazelV2Detectable.java`	New V2 detectable implementation with mode detection and graph probing
`detectable/src/main/java/com/blackduck/integration/detectable/detectables/bazel/v2/BazelEnvironmentAnalyzer.java`	Detects Bazel mode (BZLMOD vs WORKSPACE) via `bazel mod show_repo` probe
`detectable/src/main/java/com/blackduck/integration/detectable/detectables/bazel/v2/BazelGraphProber.java`	Probes dependency graph to determine which pipelines to enable
`detectable/src/main/java/com/blackduck/integration/detectable/detectables/bazel/v2/HttpFamilyProber.java`	Mode-aware HTTP archive detection with configurable probe limits
`detectable/src/main/java/com/blackduck/integration/detectable/detectables/bazel/pipeline/Pipelines.java`	Adds mode-aware HTTP pipeline selection (bzlmod vs workspace variants)
`documentation/src/main/markdown/packagemgrs/bazel.md`	Comprehensive documentation update explaining V2 features, properties, and troubleshooting

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

...m/blackduck/integration/detectable/detectables/bazel/pipeline/step/BazelCommandExecutor.java

...rc/main/java/com/blackduck/integration/detectable/detectables/bazel/v2/BazelGraphProber.java

...n/detectable/detectables/bazel/pipeline/step/IntermediateStepExecuteShowRepoWithMapping.java

...detectable/detectables/bazel/pipeline/step/IntermediateStepParseShowRepoToUrlCandidates.java

src/main/java/com/blackduck/integration/detect/configuration/DetectProperties.java

...st/java/com/blackduck/integration/detectable/detectables/bazel/unit/BazelDetectableTest.java

zahidblackduck · 2026-01-30T08:50:20Z

...m/blackduck/integration/detectable/detectables/bazel/pipeline/step/BazelCommandExecutor.java

+        try {
+            return executableRunner.execute(ExecutableUtils.createFromTarget(workspaceDir, bazelExe, args));
+        } catch (Exception e) {
+            String command = (bazelExe != null ? bazelExe.toCommand() : "bazel") + " " + String.join(" ", args == null ? java.util.Collections.emptyList() : args);


We could avoid fully qualified import here, unless there's not any name conflict for the emptyList() method. We tend to avoid fully qualified imports throughout detect.
And, we can move the string literal to a static final constant and use it here (e.g. "bazel").

zahidblackduck · 2026-01-30T08:51:18Z

...duck/integration/detectable/detectables/bazel/pipeline/step/FinalStepTransformGithubUrl.java

                String repo = githubUrlParser.parseRepo(potentialGithubUrl);
                String version = githubUrlParser.parseVersion(potentialGithubUrl);
+                // Normalize GitHub archive ref tags like `refs/tags/<tag>` to `<tag>`
+                if (version != null && version.startsWith("refs/tags/")) {


We can move these two string literals to a static final constant.

zahidblackduck · 2026-01-30T08:53:08Z

...ion/detectable/detectables/bazel/pipeline/step/IntermediateStepExecuteShowRepoHeuristic.java

+            if (token.isEmpty()) continue;
+
+            // Determine if the repo name is canonical (starts with @@) or synthetic (contains +/~)
+            boolean sawCanonical = token.startsWith("@@");


"@" and "@@" both seems to be candidate for being used with static final string constants.

zahidblackduck · 2026-01-30T08:59:31Z

...ion/detectable/detectables/bazel/pipeline/step/IntermediateStepExecuteShowRepoHeuristic.java

+     * @throws DetectableException if Bazel command execution fails
+     */
+    @Override
+    public List<String> process(List<String> input) throws DetectableException {


My sonarcube is complaining regarding this method, and suggesting to reduce cognitive complexity. Maybe due to so much conditional checks. Could you kindly check with sonarcube (for ide) and see whether this can be refactored to reduce the cognitive complexity warning? This could lead to detect sonarcube pipeline failure.

zahidblackduck · 2026-01-30T09:01:30Z

...detectable/detectables/bazel/pipeline/step/IntermediateStepParseShowRepoToUrlCandidates.java

+    private static final Pattern IMPORTPATH_PATTERN = Pattern.compile("(?i)\\bimportpath\\s*=\\s*\"([^\"]+)\"");
+
+    @Override
+    public List<String> process(List<String> input) throws DetectableException {


This method also has higher cognitive complexity.

zahidblackduck · 2026-01-30T09:23:23Z

...rc/main/java/com/blackduck/integration/detectable/detectables/bazel/v2/BazelV2Extractor.java

+     * @param haskellParser Parses Haskell cabal library JSON proto output
+     * @param projectNameGenerator Generates project names from Bazel targets
+     */
+    public BazelV2Extractor(ExternalIdFactory externalIdFactory,


Quite good usage of doc comments. Really appreciated!

zahidblackduck · 2026-01-30T09:24:55Z

...rc/main/java/com/blackduck/integration/detectable/detectables/bazel/v2/HttpFamilyProber.java

+    public boolean detect(String target) throws Exception {
+        // Query for all library dependencies of the target
+        Optional<String> depsOut = bazel.executeToString(Arrays.asList(
+            "query", "kind(.*library, deps(" + target + "))"


Candidates for static final constants.

zahidblackduck · 2026-01-30T09:25:24Z

...rc/main/java/com/blackduck/integration/detectable/detectables/bazel/v2/HttpFamilyProber.java

+        Map<String, LinkedHashSet<String>> repoLabels = new HashMap<>();
+        for (String line : lines) {
+            // Look for external repository labels (start with @ or @@)
+            if (line.startsWith("@") && line.contains("//")) {


Candidate for static final constant.

zahidblackduck · 2026-01-30T09:26:14Z

...rc/main/java/com/blackduck/integration/detectable/detectables/bazel/v2/HttpFamilyProber.java

+    private boolean probeRepoWithLabelKind(String repo, String queryTarget, String strategyName) {
+        try {
+            Optional<String> result = bazel.executeToString(Arrays.asList(
+                "query", "kind('rule', " + queryTarget + ")", "--output", "label_kind"


Candidate for static final constant.

zahidblackduck · 2026-01-30T09:27:48Z

...rc/main/java/com/blackduck/integration/detectable/detectables/bazel/v2/HttpFamilyProber.java

+     * @throws Exception if Bazel command execution fails
+     */
+    private boolean classifyRepoByModShowRepo(String repo, boolean canonical) throws Exception {
+        String at = canonical ? "@@" : "@";


As these symbols are used in quite a places, are possible candidates for global (within the scope of bazel detector) static final constants.

bd-samratmuk added 29 commits January 27, 2026 16:36

introduce bazelv2 detector

1c47212

avoid total failure if one probing fails

0b74d53

fix http pipeline when external is not aval

7e051ff

fix http pipeline when external is not aval

d195138

use robust parser (parseShowRepoToUrlCandidates)

0437e31

introduce apparent-canonical mapper

9329296

remove usage of dump mapper, need more research

b73b342

enrich logging

f7b29f6

try adding flag --incompatible_require_linker_input_cc_api=false

a27c239

try adding flag --incompatible_require_linker_input_cc_api=false

9da773d

include tool version

56963c9

support detect.bazel.workspace.rules override

2a6bd25

format exception message

ef92ccf

refactor & introduce httpfamilyprober

3d16f6a

introduce centralize bazel era detection

93c1e08

add comments

76e31d7

update bazel doc

4583314

add test cases

55f7e40

fix battery test + introduce era prop

954d31e

add bazel v2 battery tests

6cad7ab

use detect.bazel.mode instead of detect.bazel.era

1a2b239

refactor graph probing & introduce max repo property

e9eaa34

remove timeout param

9479db5

remove sampling

6264012

refactoring redundant code

847d6b6

improve bazel mode detection.

93d2928

improve documentation.

eb0160c

replace workspacerules with dependencysource

ed4db74

add note about detect.bazel.dependency.sources property

e50cb53

bd-samratmuk requested a review from Copilot January 27, 2026 15:29

Copilot AI reviewed Jan 27, 2026

View reviewed changes

bd-samratmuk added 4 commits January 28, 2026 14:41

remove unused class + refactoring

b219071

introduce BazelDetectableOptionsTestBuilder to make tests readable

684a616

update old test file to pass mode

e216339

use BazelDetectableOptionsTestBuilder in BazelDetectableTest

26c18be

bd-samratmuk requested review from devmehtabd, dterrybd, fzhengbd, shantyk, sig-abyreddy and zahidblackduck January 28, 2026 11:26

bd-samratmuk added 4 commits January 28, 2026 17:20

edit doc

2885e73

remove unused class

fc40185

simplify BazelEnvironmentAnalyzer + avoid error msg parsing

822544a

fix test cases

e5f9b19

zahidblackduck reviewed Jan 30, 2026

View reviewed changes

feat. Bazel V2 Detector With Bzlmod Support #1634

Are you sure you want to change the base?

feat. Bazel V2 Detector With Bzlmod Support #1634

Uh oh!

Conversation

bd-samratmuk commented Jan 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

zahidblackduck Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

zahidblackduck Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

bd-samratmuk commented Jan 27, 2026 •

edited

Loading

zahidblackduck Jan 30, 2026 •

edited

Loading

zahidblackduck Jan 30, 2026 •

edited

Loading