[manuelnaranjo]

Description

Adds guidance to SKILL.md under the "Create initial BUILD.bazel files" section on how to handle third-party dependencies not present in the Bazel Central Registry (BCR):

• Explains setting up an in-repo local BCR registry (e.g. registry/ containing bazel_registry.json and module definitions) and depending on it via bazel_dep in MODULE.bazel.
• Details configuring --registry in .bazelrc with both the local registry and the public BCR (https://bcr.bazel.build), since passing --registry overrides Bazel's default registry list.

Verification

• Presubmit Python tests passed (130/130).
• Apache 2.0 copyright header verification passed (bazel run //infra/internal/check_copyright_headers).

[armandomontanez]

Thanks for your interest in contributing to any2bazel. We need a signed CLA on hand to accept these contributions. Please reach out to open-source@engflow.com indicating whether this is an individual contribution or as part of your work for a company, and we'll help get that squared away.

https://github.com/EngFlow/any2bazel/blob/main/CONTRIBUTING.md#engflow-cla

[armandomontanez]

IMO this depends on whether or not the resulting project will be in the BCR. If it's for an internal migration, this is totally fine. If the migrated project will live in the BCR, referencing nonexistent modules makes it a broken dependency.

Typically to be safe, I use http_archive or new_local_repository until the dependency is migrated to also be a Bazel module.

[manuelnaranjo]

I agree that if you plan to publish into BCR using a local index is a problem, on the other hand my approach has 2 advantages IMO:

• Easier to contribute back to BCR as the dependency is already in a state that's contributable.
• Cleaner MODULE.bazel specially if you have 10s of missing dependencies like I'm getting

Maybe the skill should ask the user for which style to adopt? Not sure if that's possible

[armandomontanez]

Stop-and-ask does tend to work (key word being "tend"), but generally we're moving to more automation in favor of stop-and-ask. Also, external dependency handling is a bit of an open question so this may churn a bit as we explore what's best.

This guidance is reasonable if we also direct agents to clarify that using a local registry is considered an intermediate step until external dependencies are added to the BCR. i.e. let's add a snippet that directs agents to flag the external dependencies that are missing from the BCR that should be added before this project works as a BCR dependency.