From aabb23492c4235ba05eb3d17e82de264eabb0a97 Mon Sep 17 00:00:00 2001
From: Ryan Northey <ryan@synca.io>
Date: Thu, 15 Oct 2026 17:43:12 +0000
Subject: [PATCH] bazel/deps: Fix tool to not require runfiles

Signed-off-by: Ryan Northey <ryan@synca.io>
---
 bazel/dependency/reachability.bzl             |  4 ++++
 bazel/dependency/test/BUILD                   | 21 ++++++++++++++++++-
 .../test/exclusions_reachability_test.sh      |  6 ++++++
 3 files changed, 30 insertions(+), 1 deletion(-)

diff --git a/bazel/dependency/reachability.bzl b/bazel/dependency/reachability.bzl
index 8907e43bac..b00a7e0709 100644
--- a/bazel/dependency/reachability.bzl
+++ b/bazel/dependency/reachability.bzl
@@ -183,6 +183,10 @@ on a path. The same pruning applies to `attributed_packages`: excluded
 repositories are not attributed, and packages are not attributed to repositories
 reachable only through an excluded repository.
 
+Aliases are transparent: an edge to an `alias` is recorded against the actual
+target's repository. `excluded_patterns` and JSON consumers such as `deps.yaml`
+validation must therefore match the resolved repository, not the alias's.
+
 `attribution_patterns` is opt-in and defaults to empty. When left unset, the
 emitted JSON is byte-identical to the historical output and no attribution sets
 are propagated through the aspect. Opt in only when a consumer specifically
diff --git a/bazel/dependency/test/BUILD b/bazel/dependency/test/BUILD
index e0a0abd034..b61f1c68f7 100644
--- a/bazel/dependency/test/BUILD
+++ b/bazel/dependency/test/BUILD
@@ -494,7 +494,9 @@ filegroup(
     name = "pattern_root",
     srcs = [
         "@bazel_skylib//lib:paths",
-        "@bazel_tools//tools/bash/runfiles",
+        # Use a concrete rule: since Bazel 9, bash/runfiles aliases rules_shell,
+        # and aspects observe the actual target's repository.
+        "@bazel_tools//tools/cpp:toolchain_type",
     ],
 )
 
@@ -505,6 +507,22 @@ dependency_reachability(
     roots = [":pattern_root"],
 )
 
+alias(
+    name = "skylib_alias",
+    actual = "@bazel_skylib//lib:sets",
+)
+
+filegroup(
+    name = "alias_root",
+    srcs = [":skylib_alias"],
+)
+
+dependency_reachability(
+    name = "reachability_alias",
+    testonly = True,
+    roots = [":alias_root"],
+)
+
 filegroup(
     name = "apparent_exclusion_root",
     srcs = ["@apparent_excluded_repo//:direct"],
@@ -560,6 +578,7 @@ sh_test(
     size = "small",
     srcs = ["exclusions_reachability_test.sh"],
     data = [
+        ":reachability_alias",
         ":reachability_apparent_exclusion",
         ":reachability_apparent_exclusion_baseline",
         ":reachability_attribution_excluded",
diff --git a/bazel/dependency/test/exclusions_reachability_test.sh b/bazel/dependency/test/exclusions_reachability_test.sh
index f516075768..719f730414 100755
--- a/bazel/dependency/test/exclusions_reachability_test.sh
+++ b/bazel/dependency/test/exclusions_reachability_test.sh
@@ -14,6 +14,7 @@ else
 fi
 
 JQ="${JQ_BIN:-jq}"
+REACHABILITY_ALIAS_JSON="${RUNFILES_DIR}/dependency/test/reachability_alias.json"
 REACHABILITY_EXCLUDED_EDGE_JSON="${RUNFILES_DIR}/dependency/test/reachability_excluded_edge.json"
 REACHABILITY_EDGE_AND_PATTERN_JSON="${RUNFILES_DIR}/dependency/test/reachability_edge_and_pattern.json"
 REACHABILITY_EXCLUDED_PATTERN_JSON="${RUNFILES_DIR}/dependency/test/reachability_excluded_pattern.json"
@@ -72,6 +73,11 @@ check "excluded_patterns can remove all matching deps from one root" \
     "0" \
     "${REACHABILITY_EXCLUDED_PATTERN_JSON}"
 
+check "alias edges record the actual target under its external repository" \
+    '.dependencies[] | select(.name == "bazel_skylib") | .targets | map(sub("^@+[^/]*//"; "//")) | sort | join(",")' \
+    "//lib:sets" \
+    "${REACHABILITY_ALIAS_JSON}"
+
 check "excluded_patterns baseline includes the matched boundary repo" \
     '[.dependencies[] | .name] | any(. == "rules_pkg")' \
     "true" \