Migrate TensoBoard builds to Bazel 8

[psamanoelton]

Summary

This change upgrades TensorBoard's OSS build stack from Bazel 7.7.0 to Bazel 8.7.0 and completes the transition to Bazel Modules (Bzlmod).

Bzlmod is now TensorBoard's only dependency-resolution path. WORKSPACE evaluation is disabled by default, the transitional WORKSPACE.bzlmod bridge and legacy WORKSPACE file are removed, and the build succeeds with --noenable_workspace.

The migration also updates the major Bazel rulesets and language toolchains needed by TensorBoard's Python, Java, TypeScript, Sass, Closure, protobuf/gRPC, and Rust targets. TensorFlow remains a pip/runtime dependency rather than a source-build dependency, so the Bazel stack can be upgraded independently.

Motivation

The earlier Bzlmod migration intentionally remained on Bazel 7.7.0 and kept a WORKSPACE compatibility bridge for dependencies that were not module-native. That limited the benefits of Bzlmod and left TensorBoard dependent on rules and repository patterns that are deprecated or incompatible with Bazel 8.

This change moves the supported build to Bazel 8.7.0, updates or replaces those dependencies, and makes the module graph the single source of truth for build dependency resolution.

Main changes

Upgrade and constrain Bazel

• Pin Bazel to 8.7.0 in .bazelversion, CI, and the development container.
• Declare support for Bazel >=8.7.0 and <9.0.0 in MODULE.bazel.
• Enable Bzlmod and disable WORKSPACE evaluation in .bazelrc.
• Remove WORKSPACE, WORKSPACE.bzlmod, third_party/workspace.bzl, and
  orphaned WORKSPACE compatibility repositories.
• Add a CI check that evaluates the checked-in module lockfile with
  bazel mod graph --lockfile_mode=error.
• Update repository-root, mirror URL, formatting, and whitespace checks for a
  module-only repository.

Upgrade the module-native build stack

The Bazel module graph now uses current Bazel 8-compatible releases, including:

• bazel_skylib 1.9.2
• rules_cc 0.2.22
• rules_java 9.8.0
• rules_jvm_external 7.1
• rules_python 2.3.1
• rules_shell 0.8.0
• Protobuf 33.6
• gRPC 1.76.0.bcr.1
• grpc-java 1.82.0
• rules_rust 0.73.0
• rules_closure 0.16.0
• aspect_rules_js 3.4.0
• aspect_rules_ts 3.10.0
• gzgz_rules_sass 1.0.4

The module lockfile and Maven lockfile are regenerated for the new graph. Small compatibility patches are documented in patches/README.md, together with the condition for removing each patch.

Migrate Closure, Sass, and Java dependencies

• Move Closure/Soy to the module-native rules_closure release.
• Remove the old Closure/Soy WORKSPACE setup and vendored Safe HTML Java source.
• Update Closure Java protobuf targets to use protobuf's supported Bazel API.
• Replace the archived bazelbuild/rules_sass with the maintained Bazel 8-compatible gzgz_rules_sassfork and a TensorBoard adapter for the removednpm_sass_library` API.
• Resolve TensorBoard's Java artifacts through a Bzlmod Maven extension and
  align Guava with the grpc-java dependency graph.
• Use Bazel's hermetic JDK 21 for Java compilation and build tools.

Migrate Rustboard to crate_universe

• Replace the WORKSPACE/cargo-raze repositories with the module-native rules_rust crate_universe extension.
• Keep application crate versions pinned by Cargo.lock.
• Configure a Rust 1.85.0 toolchain and protobuf code generation through the module graph.
• Remove the generated third_party/rust cargo-raze repository files.
• Regenerate the Rust data-server descriptor for the updated protobuf schema.

Modernize the frontend dependency path

• Instantiate the remaining rules_nodejs 5.8.1 Yarn/concatjs stack through a Bzlmod extension instead of WORKSPACE.
• Patch legacy repository-name, runfiles, toolchain, and platform handling for Bazel 8.
• Apply npm patches directly during yarn_install for deterministic setup.
• Add rules_js, rules_ts, and an isolated pnpm-backed package workspace.
• Add a rules_ts canary target so production TypeScript targets can migrate incrementally without changing the existing provider graph in this PR.
• Update affected TypeScript targets for Bazel 8's stricter dependency checks.

Update Python, protobuf, and CI behavior

• Continue using a downloaded, checksummed Python 3.10 toolchain and locked pip graph for Bazel-built Python targets.
• Update protobuf/gRPC rules and source compatibility to Protobuf 33.6, gRPC 1.76, and grpc-java 1.82.
• Keep TensorBoard's runtime pip constraints independent from the C++ protobuf and gRPC versions selected by Bazel.
• Isolate source-tree tests from host virtualenv and user-site Python state.
• Update CI provisioning for Bazel 8 and Python 3.10 development headers.

Validation

The following workflows pass locally in fresh Linux containers:

bazel clean --expunge
bazel mod graph --lockfile_mode=error

bazel fetch //tensorboard/... --noenable_workspace
bazel build //tensorboard/... --noenable_workspace --keep_going
bazel test //tensorboard/... \
  --noenable_workspace \
  --test_output=errors \
  --keep_going

bazel run //tensorboard/pip_package:test_pip_package \
  --noenable_workspace -- \
  --tf-version "tensorflow==2.21"

bazel build //tensorboard/pip_package:build_pip_package --noenable_workspace
mkdir -p /tmp/tb_wheel
./bazel-bin/tensorboard/pip_package/build_pip_package /tmp/tb_wheel
pip install /tmp/tb_wheel/tensorboard-*.whl

Additional validation included:

• Repository lint, license, mirror URL, and whitespace checks
• A frozen-lockfile Bzlmod graph evaluation
• Focused Python/protobuf, Rustboard, Java/Closure, Sass, and TypeScript builds
• Seven focused cross-stack Bazel tests
• TensorFlow 2.21 wheel creation, installation, UI serving, projector/HParams, and TensorFlow summary import checks
• Confirmation that no removed WORKSPACE repository names remain referenced

Scope and follow-up work

This PR intentionally validates the Bazel build on Linux. Windows and macOS builds were not tested.

Recommended follow-up work:

• Complete the production TypeScript migration from legacy rules_nodejs/Yarn/concatjs to rules_js, rules_ts, and pnpm.
• Remove the temporary legacy struct-provider compatibility flag after that frontend migration.
• Remove local dependency patches as their upstream projects publish the corresponding fixes.
• Address the existing rules_python implicit __init__.py warnings.

Known limitation

The build no longer depends on WORKSPACE evaluation. However, production frontend targets still use the legacy rules_nodejs 5.8.1 concatjs APIs, instantiated and patched through Bzlmod. The parallel rules_js/rules_ts workspace establishes the replacement path, but migrating every production TypeScript target is intentionally left for follow-up work.