Bazel 9 upgrade: migrate to rules_cc/rules_java explicit imports

Bazel 9 removes native.cc_* and native.java_* rules from Starlark. These
now return stub functions that fail at analysis time. The autoload mechanism
(--incompatible_autoload_externally) that would automatically redirect these
is disabled in Bazel 9 (bazelbuild/bazel#23043), so all usages must be
converted to explicit loads from rules_cc and rules_java.

Similarly, providers like CcInfo and APIs like cc_common are no longer
available as globals and must be explicitly imported from their new locations.

Version updates:
- .bazelversion: 8.4.2 → 9.0.0
- MODULE.bazel: Added rules_cc 0.2.16, rules_java 9.0.3 dependencies
- MODULE.bazel: Added Python 3.12 toolchain registration (rules_python 1.x
  requires explicit toolchain setup, no longer auto-registers)

Bazelrc changes:
- Removed --incompatible_strict_action_env (now default, flag removed in Bazel 9)
- Removed --legacy_external_runfiles (now default false, flag removed)
- Added +@rules_cc,+@rules_java,+@rules_shell to autoload for graceful migration

BUILD/bzl migrations:
- swift/rules.bzl: Added cc_binary, cc_library, CcInfo imports; changed
  native.cc_binary → cc_binary, native.cc_library → cc_library
- misc/bazel/cmake/cmake.bzl: Added CcInfo import (used in provider returns)
- misc/bazel/internal/zipmerge/BUILD.bazel: Added cc_binary, cc_library, cc_test
- shared/cpp/BUILD.bazel, swift/logging/BUILD.bazel: Added cc_library load
- javascript/extractor/test/.../BUILD.bazel: Added java_test load

C++ runfiles API migration:
- zipmerge_test.cpp: Bazel 9 moves the C++ runfiles library from
  @bazel_tools//tools/cpp/runfiles to @rules_cc//cc/runfiles. Updated
  include path and namespace accordingly.

Author: redsun82

.bazelrc

@@ -34,7 +34,7 @@ common --@rules_dotnet//dotnet/settings:strict_deps=false
 common --@rules_rust//rust/toolchain/channel=nightly
 
 # Reduce this eventually to empty, once we've fixed all our usages of java, and https://github.com/bazel-contrib/rules_go/issues/4193 is fixed
-common --incompatible_autoload_externally="+@rules_java,+@rules_shell"
+common --incompatible_autoload_externally="+@rules_cc,+@rules_java,+@rules_shell"
 
 build --java_language_version=17
 build --tool_java_language_version=17

.bazelversion

@@ -1 +1 @@
-8.4.2
+9.0.0

MODULE.bazel

@@ -15,17 +15,19 @@ local_path_override(
 # see https://registry.bazel.build/ for a list of available packages
 
 bazel_dep(name = "platforms", version = "1.0.0")
-bazel_dep(name = "rules_go", version = "0.56.1")
+bazel_dep(name = "rules_cc", version = "0.2.16")
+bazel_dep(name = "rules_go", version = "0.59.0")
+bazel_dep(name = "rules_java", version = "9.0.3")
 bazel_dep(name = "rules_pkg", version = "1.0.1")
-bazel_dep(name = "rules_nodejs", version = "6.2.0-codeql.1")
+bazel_dep(name = "rules_nodejs", version = "6.7.3")
 bazel_dep(name = "rules_python", version = "0.40.0")
 bazel_dep(name = "rules_shell", version = "0.5.0")
 bazel_dep(name = "bazel_skylib", version = "1.8.1")
 bazel_dep(name = "abseil-cpp", version = "20240116.1", repo_name = "absl")
 bazel_dep(name = "nlohmann_json", version = "3.11.3", repo_name = "json")
 bazel_dep(name = "fmt", version = "12.1.0-codeql.1")
 bazel_dep(name = "rules_kotlin", version = "2.2.0-codeql.1")
-bazel_dep(name = "gazelle", version = "0.40.0")
+bazel_dep(name = "gazelle", version = "0.47.0")
 bazel_dep(name = "rules_dotnet", version = "0.21.5-codeql.1")
 bazel_dep(name = "googletest", version = "1.14.0.bcr.1")
 bazel_dep(name = "rules_rust", version = "0.66.0")
@@ -188,6 +190,15 @@ pip.parse(
 )
 use_repo(pip, "codegen_deps")
 
+python = use_extension("@rules_python//python/extensions:python.bzl", "python")
+python.toolchain(
+    is_default = True,
+    python_version = "3.12",
+)
+use_repo(python, "python_3_12", "python_versions")
+
+register_toolchains("@python_versions//3.12:all")
+
 swift_deps = use_extension("//swift/third_party:load.bzl", "swift_deps")
 
 # following list can be kept in sync with `bazel mod tidy`

javascript/extractor/BUILD.bazel

@@ -1,3 +1,4 @@
+load("@rules_java//java:defs.bzl", "java_library")
 load("@rules_pkg//pkg:mappings.bzl", "pkg_files")
 load("@semmle_code//:common.bzl", "codeql_fat_jar", "codeql_java_project")
 

javascript/extractor/test/com/semmle/js/extractor/test/BUILD.bazel

@@ -1,3 +1,5 @@
+load("@rules_java//java:defs.bzl", "java_test")
+
 java_test(
     name = "test",
     srcs = glob(["**/*.java"]),

misc/bazel/cmake/cmake.bzl

@@ -1,3 +1,5 @@
+load("@rules_cc//cc/common:cc_info.bzl", "CcInfo")
+
 CmakeInfo = provider(
     fields = {
         "name": "",

misc/bazel/internal/zipmerge/BUILD.bazel

@@ -1,3 +1,5 @@
+load("@rules_cc//cc:defs.bzl", "cc_binary", "cc_library", "cc_test")
+
 cc_library(
     name = "lib",
     srcs = [
@@ -28,7 +30,7 @@ cc_test(
     linkstatic = True,  # required to build the test in the internal repo
     deps = [
         ":lib",
-        "@bazel_tools//tools/cpp/runfiles",
         "@googletest//:gtest_main",
+        "@rules_cc//cc/runfiles",
     ],
 )

misc/bazel/internal/zipmerge/zipmerge_test.cpp

@@ -9,9 +9,9 @@
 
 #include <gtest/gtest.h>
 #include <gmock/gmock.h>
-#include "tools/cpp/runfiles/runfiles.h"
+#include "rules_cc/cc/runfiles/runfiles.h"
 
-using bazel::tools::cpp::runfiles::Runfiles;
+using rules_cc::cc::runfiles::Runfiles;
 using namespace std::string_literals;
 namespace fs = std::filesystem;
 

misc/bazel/registry/modules/rules_nodejs/metadata.json

@@ -1,5 +1,3 @@
 {
     "versions": [
-        "6.2.0-codeql.1"
-    ]
-}
+    "6.2.0-codeql.1"

shared/cpp/BUILD.bazel

@@ -1,3 +1,5 @@
+load("@rules_cc//cc:defs.bzl", "cc_library")
+
 cc_library(
     name = "extractor_shared",
     srcs = glob(["*.cpp"]),