feat(cloud-tasks): import the Java cloud-tasks service under Bazel

.bazelignore

@@ -28,7 +28,12 @@
 # with our bzlmod setup. Re-enable per-subtree as Phase B brings each subtree
 # native.
 src/compute-plane-services
-src/control-plane-services
+# src/control-plane-services is carved out per-subtree: cloud-tasks is native
+# (Phase B) and must stay loadable, while these siblings still carry nested
+# MODULE.bazel / WORKSPACE-style BUILD files that conflict with bzlmod.
+src/control-plane-services/function-autoscaler
+src/control-plane-services/helm-reval
+src/control-plane-services/nats-auth-callout
 src/invocation-plane-services
 src/libraries/python
 # stargate is a nested Bazel module (own MODULE.bazel under
@@ -47,6 +52,14 @@ infra
 migrations
 tools
 
+# Standalone Java modules. Each has its own MODULE.bazel, its own
+# nv_third_party_deps hub, and a CI matrix row in .github/workflows/bazel.yml;
+# their BUILD files reference module-local repos (@nv_third_party_deps,
+# @nv_boot_parent) that the root module does not define, so the root build must
+# not recurse into them.
+src/libraries/java/nv-boot-parent
+src/control-plane-services/cloud-tasks
+
 # Vendored dependencies inside the two Phase 1 subtrees. Bazel resolves these
 # from MODULE.bazel via Gazelle's go_deps extension, not from on-disk vendor.
 src/libraries/go/lib/vendor

.github/workflows/bazel.yml

@@ -114,10 +114,22 @@ jobs:
           worker-utils|src/compute-plane-services/worker-utils|false
           function-autoscaler|src/control-plane-services/function-autoscaler|false
           helm-reval|src/control-plane-services/helm-reval|false
-          stargate|src/libraries/rust/stargate|false'
-          # Paths that affect the root-module workspace build (native
-          # root subtrees, Go and Java, plus the shared Bazel scaffold).
-          ROOT_GLOBS=(MODULE.bazel .bazelrc .bazelversion BUILD.bazel WORKSPACE WORKSPACE.bazel go.work go.work.bazel rules/ platforms/ tools/ ci/ src/clis/ src/libraries/ .github/bazel-root-test-quarantine.txt)
+          stargate|src/libraries/rust/stargate|false
+          nv-boot-parent|src/libraries/java/nv-boot-parent|false
+          cloud-tasks|src/control-plane-services/cloud-tasks|false'
+          # Standalone Java modules. Each has its own MODULE.bazel and its own
+          # nv_third_party_deps hub, so it builds+tests in its own module dir.
+          # Like every non-root row they do NOT set --config=remote; the
+          # build/test steps below inject --remote_cache/--tls_certificate/
+          # --remote_header from the EC2 Buildbarn secrets, so these rows warm
+          # from and hit that shared cache rather than cold-building (see
+          # NVIDIA/nvcf#372).
+          # Paths that affect the root-module workspace build (native root
+          # subtrees plus the shared Bazel scaffold). Java and stargate no longer
+          # ride the root row: nv-boot-parent, cloud-tasks, and stargate are
+          # their own module rows, so src/libraries/ is narrowed to
+          # src/libraries/go/ and cloud-tasks is dropped here.
+          ROOT_GLOBS=(MODULE.bazel .bazelrc .bazelversion BUILD.bazel WORKSPACE WORKSPACE.bazel go.work go.work.bazel rules/ platforms/ tools/ ci/ src/clis/ src/libraries/go/ .github/bazel-root-test-quarantine.txt)
 
           run_all=false
           changed=""
@@ -192,6 +204,12 @@ jobs:
       CACHE_TOKEN: ${{ secrets.BAZEL_REMOTE_CACHE_TOKEN }}
       CACHE_ENDPOINT: ${{ vars.BAZEL_REMOTE_CACHE_ENDPOINT }}
     container:
+      # Staged bump: ci/Dockerfile.bazel + bazel-ci-image.yml move to 0.13.0
+      # (adds the remotejdk_25 / Bazel 9.1.1 pre-warm the Java module rows use).
+      # 0.13.0 publishes only on merge to main, so this consumer ref stays at
+      # 0.12.0 until then to keep the matrix from pinning an unpublished image;
+      # a fast-follow bumps it to 0.13.0. The Java rows still work on 0.12.0 (they
+      # cold-fetch the JDK once, then reuse it via actions/cache). See #372.
       image: ghcr.io/nvidia/nvcf/bazel-ci:0.12.0
       credentials:
         username: ${{ github.actor }}
@@ -451,7 +469,11 @@ jobs:
             grep -E '^[[:space:]]*-//' "$qfile" | sed -E 's/^[[:space:]]+//' >> "$ttfile"
             echo "quarantine: subtracted ${n:-0} pattern(s) from the root test set"
           fi
-          COMMON=(--flaky_test_attempts=3)
+          # requires-docker tests (Testcontainers/DinD) run in the dedicated
+          # bazel-integration lane, not here; this matrix has no Docker daemon.
+          # They still compile in the build step; only their execution is
+          # deferred to that lane (see the bazel-integration job).
+          COMMON=(--flaky_test_attempts=3 --test_tag_filters=-requires-docker)
           CACHE=(--remote_cache=)
           if [ "${CACHE_READY:-0}" = "1" ]; then
             CACHE=(--remote_cache="$CACHE_ENDPOINT"
@@ -482,16 +504,60 @@ jobs:
             bazel test "${COMMON[@]}" --remote_cache= "${TARGETS[@]}"
           fi
 
+  # Docker integration lane. Runs only the "requires-docker"-tagged tests
+  # (Testcontainers suites) that the containerized fast matrix cannot run
+  # because it has no Docker daemon. This is how integration tests stay ENABLED
+  # instead of being skipped. Runs on the bare runner (not the bazel-ci
+  # container) because ubuntu-latest ships Docker running, so Testcontainers
+  # uses the host daemon directly -- no DinD, no host-override networking, and it
+  # avoids the container+service checkout fragility. bazelisk reads
+  # .bazelversion for the pinned Bazel.
+  bazel-integration:
+    name: bazel integration (docker)
+    needs: detect
+    if: needs.detect.outputs.any == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Install bazelisk
+        run: |
+          sudo curl -fsSLo /usr/local/bin/bazel \
+            https://github.com/bazelbuild/bazelisk/releases/download/v1.20.0/bazelisk-linux-amd64
+          sudo chmod +x /usr/local/bin/bazel
+          bazel version
+      - name: bazel integration tests (requires-docker)
+        run: |
+          # Run only the Testcontainers suites across the root workspace against
+          # the host Docker. If a change touches none, bazel exits 4 (no tests
+          # matched) which we treat as success. Nested-module subtrees are
+          # handled in a later fan-out.
+          set +e
+          bazel test //... \
+            --build_tests_only \
+            --test_tag_filters=requires-docker \
+            --test_output=errors \
+            --flaky_test_attempts=2
+          rc=$?
+          set -e
+          if [ "$rc" -eq 4 ]; then
+            echo "no requires-docker tests matched; nothing to run"
+            exit 0
+          fi
+          exit "$rc"
+
   bazel-verification:
     name: bazel verification
-    needs: [detect, bazel]
+    needs: [detect, bazel, bazel-integration]
     if: ${{ always() }}
     runs-on: ubuntu-latest
     steps:
       - name: Check Bazel workflow result
         env:
           DETECT_RESULT: ${{ needs.detect.result }}
           BAZEL_RESULT: ${{ needs.bazel.result }}
+          INTEGRATION_RESULT: ${{ needs.bazel-integration.result }}
           BAZEL_ANY: ${{ needs.detect.outputs.any }}
         run: |
           set -euo pipefail
@@ -514,3 +580,9 @@ jobs:
             echo "one or more Bazel matrix rows failed, were cancelled, or were skipped"
             exit 1
           fi
+
+          echo "integration result: ${INTEGRATION_RESULT}"
+          if [ "${INTEGRATION_RESULT}" != "success" ] && [ "${INTEGRATION_RESULT}" != "skipped" ]; then
+            echo "the bazel integration (docker) lane failed or was cancelled"
+            exit 1
+          fi

MODULE.bazel

@@ -148,21 +148,93 @@ use_repo(
 # Java / JVM
 #
 # Foundation for Spring Boot (and plain Java) services: Maven dependency
-# resolution via rules_jvm_external, JUnit 5 test support via contrib_rules_jvm,
-# and the nvcf_spring_boot_image macro in //rules/java. A new Java service wires
-# in by adding its Maven coordinates to maven.install below (re-pin with
-# `bazel run @maven//:pin`) and calling the macro from its BUILD.bazel.
+# resolution via rules_jvm_external and JUnit 5 test support via
+# contrib_rules_jvm. A new root-workspace Java target wires in by adding its
+# Maven coordinates to maven.install below and re-pinning with
+# `bazel run @nv_third_party_deps//:pin`.
 #
 # The pinned lock file (//:maven_install.json) makes resolution reproducible and
 # lets `bazel mod` run offline. Repositories intentionally lists only Maven
 # Central so the foundation builds anywhere, including the public GitHub mirror.
-# Internal services that depend on nv-boot add the internal Artifactory virtual
-# repo here; see rules/java/README.md.
+# Standalone Java modules (src/libraries/java/nv-boot-parent,
+# src/control-plane-services/cloud-tasks) instead own their own MODULE.bazel and
+# nv_third_party_deps hub and are ignored by the root build (see .bazelignore).
 # ============================================================================
 bazel_dep(name = "rules_java", version = "9.3.0")
 bazel_dep(name = "rules_jvm_external", version = "7.0")
 bazel_dep(name = "contrib_rules_jvm", version = "0.33.0")
 
+# gRPC-Java codegen. rules_proto_grpc_java drives the protoc-gen-grpc-java
+# plugin (fetched as native binaries below) to generate Java gRPC stubs for
+# Java services that expose or consume gRPC. protobuf/com_google_protobuf and
+# rules_java are already declared above.
+bazel_dep(name = "rules_proto_grpc", version = "5.8.0")
+bazel_dep(name = "rules_proto_grpc_java", version = "5.8.0")
+
+# The gRPC generator is a native executable, not a Java dependency. Keep it
+# outside the shared Maven hub so fetch_sources applies only to Java artifacts.
+GRPC_VERSION = "1.63.0"
+
+http_file = use_repo_rule(
+    "@bazel_tools//tools/build_defs/repo:http.bzl",
+    "http_file",
+)
+
+http_file(
+    name = "grpc_java_plugin_linux_aarch_64",
+    downloaded_file_path = "protoc-gen-grpc-java.exe",
+    executable = True,
+    sha256 = "471427565ad82b3caac5e19dba2d15fb75b81042503ea32357630312d1f074b4",
+    urls = [
+        "https://maven-central.storage-download.googleapis.com/maven2/io/grpc/protoc-gen-grpc-java/%s/protoc-gen-grpc-java-%s-linux-aarch_64.exe" % (GRPC_VERSION, GRPC_VERSION),
+        "https://repo.maven.apache.org/maven2/io/grpc/protoc-gen-grpc-java/%s/protoc-gen-grpc-java-%s-linux-aarch_64.exe" % (GRPC_VERSION, GRPC_VERSION),
+    ],
+)
+
+http_file(
+    name = "grpc_java_plugin_linux_x86_64",
+    downloaded_file_path = "protoc-gen-grpc-java.exe",
+    executable = True,
+    sha256 = "0e3e8db80ba1fbddeed97ea3220b52cfaa95764ff8bf00716df7322883ce47e8",
+    urls = [
+        "https://maven-central.storage-download.googleapis.com/maven2/io/grpc/protoc-gen-grpc-java/%s/protoc-gen-grpc-java-%s-linux-x86_64.exe" % (GRPC_VERSION, GRPC_VERSION),
+        "https://repo.maven.apache.org/maven2/io/grpc/protoc-gen-grpc-java/%s/protoc-gen-grpc-java-%s-linux-x86_64.exe" % (GRPC_VERSION, GRPC_VERSION),
+    ],
+)
+
+http_file(
+    name = "grpc_java_plugin_osx_aarch_64",
+    downloaded_file_path = "protoc-gen-grpc-java.exe",
+    executable = True,
+    sha256 = "28290117a2ee9ea60f50f94273ab139dc2b3be4b8f2a557bef7e6efefee5b363",
+    urls = [
+        "https://maven-central.storage-download.googleapis.com/maven2/io/grpc/protoc-gen-grpc-java/%s/protoc-gen-grpc-java-%s-osx-aarch_64.exe" % (GRPC_VERSION, GRPC_VERSION),
+        "https://repo.maven.apache.org/maven2/io/grpc/protoc-gen-grpc-java/%s/protoc-gen-grpc-java-%s-osx-aarch_64.exe" % (GRPC_VERSION, GRPC_VERSION),
+    ],
+)
+
+http_file(
+    name = "grpc_java_plugin_osx_x86_64",
+    downloaded_file_path = "protoc-gen-grpc-java.exe",
+    executable = True,
+    sha256 = "28290117a2ee9ea60f50f94273ab139dc2b3be4b8f2a557bef7e6efefee5b363",
+    urls = [
+        "https://maven-central.storage-download.googleapis.com/maven2/io/grpc/protoc-gen-grpc-java/%s/protoc-gen-grpc-java-%s-osx-x86_64.exe" % (GRPC_VERSION, GRPC_VERSION),
+        "https://repo.maven.apache.org/maven2/io/grpc/protoc-gen-grpc-java/%s/protoc-gen-grpc-java-%s-osx-x86_64.exe" % (GRPC_VERSION, GRPC_VERSION),
+    ],
+)
+
+http_file(
+    name = "grpc_java_plugin_windows_x86_64",
+    downloaded_file_path = "protoc-gen-grpc-java.exe",
+    executable = True,
+    sha256 = "c3e9aaefd825a6ea9a252e153e0998d7ef36a7b27c2156867a98c71edf9c18a1",
+    urls = [
+        "https://maven-central.storage-download.googleapis.com/maven2/io/grpc/protoc-gen-grpc-java/%s/protoc-gen-grpc-java-%s-windows-x86_64.exe" % (GRPC_VERSION, GRPC_VERSION),
+        "https://repo.maven.apache.org/maven2/io/grpc/protoc-gen-grpc-java/%s/protoc-gen-grpc-java-%s-windows-x86_64.exe" % (GRPC_VERSION, GRPC_VERSION),
+    ],
+)
+
 maven = use_extension("@rules_jvm_external//:extensions.bzl", "maven")
 maven.install(
     name = "nv_third_party_deps",
@@ -218,12 +290,52 @@ maven.install(
         "org.wiremock:wiremock-standalone:3.13.2",
         "software.amazon.awssdk:regions:2.40.1",
         "tools.jackson.module:jackson-module-blackbird",
-        # examples/java-spring-boot-service (versions from the Spring Boot BOM).
+        # General Java test/web roots (versions from the Spring Boot BOM).
         "org.springframework.boot:spring-boot-starter-web",
         "org.junit.jupiter:junit-jupiter-api",
         "org.junit.jupiter:junit-jupiter-engine",
         "org.junit.platform:junit-platform-launcher",
         "org.junit.platform:junit-platform-reporting",
+        # cloud-tasks service closure. Version-less coordinates are managed by
+        # the BOMs above (spring-boot 4.0.7 / spring-cloud 2025.1.2 /
+        # testcontainers 2.0.5 / shedlock 7.7.0). Explicit versions match the
+        # cloud-tasks standalone module; io.grpc pins track GRPC_VERSION.
+        "com.bucket4j:bucket4j_jdk17-core:8.19.0",
+        "com.github.ben-manes.caffeine:caffeine",
+        "com.google.protobuf:protobuf-java:4.33.4",
+        "com.google.protobuf:protobuf-java-util:4.33.4",
+        "io.grpc:grpc-api:%s" % GRPC_VERSION,
+        "io.grpc:grpc-protobuf:%s" % GRPC_VERSION,
+        "io.grpc:grpc-stub:%s" % GRPC_VERSION,
+        "io.micrometer:micrometer-registry-prometheus",
+        "io.projectreactor.netty:reactor-netty-core",
+        "io.projectreactor.netty:reactor-netty-http",
+        "javax.annotation:javax.annotation-api:1.3.2",
+        "net.devh:grpc-server-spring-boot-starter:3.1.0.RELEASE",
+        "net.javacrumbs.shedlock:shedlock-provider-cassandra",
+        "net.javacrumbs.shedlock:shedlock-spring",
+        "org.assertj:assertj-core",
+        "org.awaitility:awaitility",
+        "org.junit.jupiter:junit-jupiter-params",
+        "org.mockito:mockito-core",
+        "org.mockito:mockito-junit-jupiter",
+        "org.ow2.asm:asm:9.9",
+        "org.ow2.asm:asm-commons:9.9",
+        "org.ow2.asm:asm-tree:9.9",
+        "org.springframework:spring-context-support",
+        "org.springframework:spring-webflux",
+        "org.springframework.boot:spring-boot-actuator",
+        "org.springframework.boot:spring-boot-loader",
+        "org.springframework.boot:spring-boot-micrometer-metrics",
+        "org.springframework.boot:spring-boot-micrometer-tracing",
+        "org.springframework.boot:spring-boot-opentelemetry",
+        "org.springframework.boot:spring-boot-starter-aspectj",
+        "org.springframework.boot:spring-boot-starter-security",
+        "org.springframework.boot:spring-boot-starter-webmvc",
+        "org.springframework.cloud:spring-cloud-starter-kubernetes-client-config",
+        "org.springframework.retry:spring-retry",
+        "org.testcontainers:testcontainers",
+        "org.testcontainers:testcontainers-localstack",
     ],
     boms = [
         "net.javacrumbs.shedlock:shedlock-bom:7.7.0",
@@ -233,7 +345,10 @@ maven.install(
     ],
     fail_on_missing_checksum = True,
     fetch_sources = True,
-    known_contributing_modules = ["protobuf"],
+    known_contributing_modules = [
+        "protobuf",
+        "rules_proto_grpc_java",
+    ],
     lock_file = "//:maven_install.json",
     repositories = [
         # Public Central mirrors only. This is the public GitHub mirror; its