feat: provide tools via bazel in addition to devcontainer (#116)

Readable docs:
https://github.com/eclipse-score/devcontainer/blob/bazel/tools/README.md
Usage example: eclipse-score/docs-as-code#511

---------

Co-authored-by: Copilot <copilot@github.com>

Author: AlexanderLanin

.devcontainer/post_create_command.sh

@@ -14,8 +14,12 @@
 # *******************************************************************************
 
 npm install -g @devcontainers/cli
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
+REPOSITORY_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd -P)"
+
+sudo "${REPOSITORY_ROOT}/tools/tool_installer.py" install shellcheck yamlfmt
+
 pre-commit install
 
 scripts/create_builder.sh
-
-sudo apt-get update && sudo apt-get install -y shellcheck

.gitignore

@@ -15,3 +15,12 @@
 # Exported image files shall never be committed.
 /export.img
 build/
+
+# bazel files
+/bazel-*
+
+# AI
+/.codex
+
+# Python files
+*.pyc

.pre-commit-config.yaml

@@ -22,14 +22,19 @@ repos:
       - id: check-executables-have-shebangs
       - id: check-added-large-files
         args: [--maxkb=50, --enforce-all] # increase or add git lfs if too strict
-  - repo: https://github.com/google/yamlfmt
-    rev: 21ca5323a9c87ee37a434e0ca908efc0a89daa07 # v0.21.0
+        exclude: ^MODULE\.bazel\.lock$
+  - repo: local
     hooks:
       - id: yamlfmt
-  - repo: https://github.com/jumanjihouse/pre-commit-hooks
-    rev: 38980559e3a605691d6579f96222c30778e5a69e # 3.0.0
-    hooks:
+        name: yamlfmt
+        entry: tools/run_tool.sh yamlfmt
+        language: system
+        types: [yaml]
       - id: shellcheck
+        name: shellcheck
+        entry: tools/run_tool.sh shellcheck
+        language: system
+        types: [shell]
   - repo: https://github.com/eclipse-score/tooling
     rev: 31ff8eee214e4e97ef8f5cb46e443273515b63ec
     hooks:

.shellcheckrc

@@ -24,3 +24,6 @@ disable=SC2046
 
 # optional checks, fixes might not be easy and better not break the code
 disable=SC2292,SC2154,SC2312
+
+# SC1091: Not following sourced files that are not specified as input
+disable=SC1091

MODULE.bazel

@@ -0,0 +1,31 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+
+module(name = "score_devcontainer")
+
+bazel_dep(name = "rules_multitool", version = "1.11.1")
+
+multitool = use_extension("@rules_multitool//multitool:extension.bzl", "multitool")
+
+multitool.hub(lockfile = "//tools:lockfiles/actionlint.lock.json")
+multitool.hub(lockfile = "//tools:lockfiles/ruff.lock.json")
+multitool.hub(lockfile = "//tools:lockfiles/shellcheck.lock.json")
+multitool.hub(lockfile = "//tools:lockfiles/yamlfmt.lock.json")
+multitool.hub(lockfile = "//tools:lockfiles/uv.lock.json")
+multitool.hub(lockfile = "//tools:lockfiles/buildifier.lock.json")
+multitool.hub(lockfile = "//tools:lockfiles/starpls.lock.json")
+multitool.hub(lockfile = "//tools:lockfiles/bazelisk.lock.json")
+
+use_repo(multitool, "multitool")
+
+register_toolchains("@multitool//toolchains:all")

MODULE.bazel.lock

@@ -25,7 +25,9 @@ SPDX-License-Identifier = "Apache-2.0"
 
 [[annotations]]
 path = ["resources/reopen_in_container.png",
-        "resources/devcontainer_success.png"
+        "resources/devcontainer_success.png",
+        "tools/lockfiles/*.lock.json",
+        "MODULE.bazel.lock",
         ]
 SPDX-FileCopyrightText = "Copyright (c) 2026 Contributors to the Eclipse Foundation"
 SPDX-License-Identifier = "Apache-2.0"

REUSE.toml

@@ -16,4 +16,6 @@ FROM buildpack-deps:noble-curl
 
 LABEL dev.containers.features="common"
 
+COPY tools /usr/local/share/score-tools
+
 RUN userdel -f -r ubuntu

src/s-core-devcontainer/.devcontainer/Dockerfile

@@ -3,9 +3,6 @@
     "id": "bazel",
     "version": "1.0.0",
     "description": "Bazel and supplimentary tools for working with Bazel-based projects.",
-    "dependsOn": {
-        "./s-core-local": {} // needed for extracting versions (versions.sh)
-    },
     "onCreateCommand": "/devcontainer/features/bazel/on_create_command.sh",
     "postCreateCommand": {
         // The repos in S-CORE may use different Bazel versions. This ensures that the required version is installed.

src/s-core-devcontainer/.devcontainer/bazel-feature/devcontainer-feature.json

@@ -29,7 +29,7 @@ rm -f "${COPY_TARGET}/devcontainer-features.env" "${COPY_TARGET}/devcontainer-fe
 DEBIAN_FRONTEND=noninteractive
 
 # Read tool versions + metadata into environment variables
-. /devcontainer/features/s-core-local/versions.sh /devcontainer/features/bazel/versions.yaml
+. /usr/local/share/score-tools/versions.sh /devcontainer/features/bazel/versions.yaml
 
 ARCHITECTURE=$(dpkg --print-architecture)
 
@@ -39,20 +39,11 @@ apt-get update
 # Container build dependencies are not pinned, since they are removed anyway after container creation.
 apt-get install apt-transport-https -y
 
-# Bazelisk, directly from GitHub
-# Using the existing devcontainer feature is not optimal:
-# - it does not check the SHA256 checksum of the downloaded file
-# - it cannot pre-install a specific version of Bazel, or prepare bash completion
-BAZELISK_VARIANT="amd64"
-SHA256SUM="${bazelisk_amd64_sha256}"
-if [ "${ARCHITECTURE}" = "arm64" ]; then
-    BAZELISK_VARIANT="arm64"
-    SHA256SUM="${bazelisk_arm64_sha256}"
-fi
-curl -L "https://github.com/bazelbuild/bazelisk/releases/download/v${bazelisk_version}/bazelisk-${BAZELISK_VARIANT}.deb" -o /tmp/bazelisk.deb
-echo "${SHA256SUM} /tmp/bazelisk.deb" | sha256sum -c - || exit 1
-apt-get install -y --no-install-recommends --fix-broken /tmp/bazelisk.deb
-rm /tmp/bazelisk.deb
+# Lockfile-managed Bazel tooling
+/usr/local/share/score-tools/tool_installer.py install bazelisk buildifier starpls
+
+# Bazelisk + Bazel
+ln -sf /usr/local/bin/bazelisk /usr/local/bin/bazel
 
 # Pre-install a fixed Bazel version, setup the bash command completion
 export USE_BAZEL_VERSION=${bazel_version}
@@ -67,29 +58,6 @@ sh -c "echo 'INSTALLED_BAZEL_VERSION=${bazel_version}' >> /devcontainer/features
 # This is required for corporate environments with custom CA certificates
 echo 'startup --host_jvm_args=-Djavax.net.ssl.trustStore=/etc/ssl/certs/java/cacerts --host_jvm_args=-Djavax.net.ssl.trustStorePassword=changeit' >> /etc/bazel.bazelrc
 
-# Buildifier, directly from GitHub (apparently no APT repository available)
-# The version is pinned to a specific release, and the SHA256 checksum is provided by the devcontainer-features.json file.
-BUILDIFIER_VARIANT="amd64"
-SHA256SUM="${buildifier_amd64_sha256}"
-if [ "${ARCHITECTURE}" = "arm64" ]; then
-    BUILDIFIER_VARIANT="arm64"
-    SHA256SUM="${buildifier_arm64_sha256}"
-fi
-curl -L "https://github.com/bazelbuild/buildtools/releases/download/v${buildifier_version}/buildifier-linux-${BUILDIFIER_VARIANT}" -o /usr/local/bin/buildifier
-echo "${SHA256SUM} /usr/local/bin/buildifier" | sha256sum -c - || exit 1
-chmod +x /usr/local/bin/buildifier
-
-# Starlark Language Server, directly from GitHub (apparently no APT repository available)
-STARPLS_VARIANT="amd64"
-SHA256SUM="${starpls_amd64_sha256}"
-if [ "${ARCHITECTURE}" = "arm64" ]; then
-    STARPLS_VARIANT="aarch64"
-    SHA256SUM="${starpls_arm64_sha256}"
-fi
-curl -L "https://github.com/withered-magic/starpls/releases/download/v${starpls_version}/starpls-linux-${STARPLS_VARIANT}" -o /usr/local/bin/starpls
-echo "${SHA256SUM} /usr/local/bin/starpls" | sha256sum -c - || exit 1
-chmod +x /usr/local/bin/starpls
-
 # Code completion for C++ code of Bazel projects
 # (see https://github.com/kiron1/bazel-compile-commands)
 source /etc/lsb-release