refactor(bazel): move test guest rules under bzl

Signed-off-by: Drew Newberry <anewberry@nvidia.com>

MODULE.bazel

@@ -59,7 +59,7 @@ exports_files([
 include("//bazel/annotations:aws-lc-sys.MODULE.bazel")
 include("//bazel/annotations:z3-sys.MODULE.bazel")
 include("//bazel/annotations:zstd-sys.MODULE.bazel")
-include("//nix/test-guest:test-guest.MODULE.bazel")
+include("//bzl/test-guest:test-guest.MODULE.bazel")
 
 z3_repository = use_repo_rule("//third_party/z3:repositories.bzl", "z3_repository")
 

MODULE.bazel.lock

@@ -364,7 +364,7 @@
     "@@rules_nixpkgs_core+//extensions:package.bzl%nix_pkg": {
       "general": {
         "bzlTransitiveDigest": "2alEQC7q9PgrArc8ZeI662VmDHLGfuswqnzBJvVDnmg=",
-        "usagesDigest": "fl4aParJMb0nPCq6frFoa6jNrTkzN3pIXtOS+jtCE9o=",
+        "usagesDigest": "GMnvOnFYwW4oMFhsUdj25RAeRBLVnU9Itk5tNi71YBs=",
         "recordedInputs": [
           "REPO_MAPPING:,openshell_nixpkgs rules_nixpkgs_core++nix_repo+openshell_nixpkgs",
           "REPO_MAPPING:rules_nixpkgs_core+,bazel_skylib bazel_skylib+"
@@ -375,14 +375,14 @@
             "attributes": {
               "unmangled_name": "test_guest_host_tools",
               "attribute_path": "bazelHostTools",
-              "nix_file": "@@//nix/test-guest:host-tools.nix",
+              "nix_file": "@@//bzl/test-guest:host-tools.nix",
               "nix_file_deps": {
-                "@@//nix/test-guest:run.sh": "'@@//nix/test-guest:run.sh'"
+                "@@//bzl/test-guest:run.sh": "'@@//bzl/test-guest:run.sh'"
               },
               "nix_file_content": "",
               "repository": "@@rules_nixpkgs_core++nix_repo+openshell_nixpkgs//:openshell_nixpkgs",
               "repositories": {},
-              "build_file": "@@//nix/test-guest:host-tools.BUILD.bazel",
+              "build_file": "@@//bzl/test-guest:host-tools.BUILD.bazel",
               "build_file_content": "",
               "nixopts": [],
               "quiet": false,
@@ -403,7 +403,7 @@
     "@@rules_nixpkgs_core+//extensions:repository.bzl%nix_repo": {
       "general": {
         "bzlTransitiveDigest": "dTTtWNdwe7E4j77oKh1mHI1qtdxfaVSGSZa1oPf2QjU=",
-        "usagesDigest": "AfE65A51oA1/OZrxKwzTys8xTdDXCUyt3dmnbsZnA0E=",
+        "usagesDigest": "bqUszMUoRUj7FHpInNBJFrGKU8e9C2CfkzSQtVuUlYY=",
         "recordedInputs": [
           "REPO_MAPPING:rules_nixpkgs_core+,bazel_skylib bazel_skylib+"
         ],
@@ -412,7 +412,7 @@
             "repoRuleId": "@@rules_nixpkgs_core+//:nixpkgs.bzl%_nixpkgs_local_repository",
             "attributes": {
               "unmangled_name": "openshell_nixpkgs",
-              "nix_file": "@@//nix/test-guest:nixpkgs.nix",
+              "nix_file": "@@//bzl/test-guest:nixpkgs.nix",
               "nix_file_deps": [
                 "@@//:flake.lock"
               ]

architecture/build.md

@@ -155,20 +155,18 @@ do not infer from kube context.
 
 ## Disposable Test Guests
 
-The Nix test guest harness under `nix/test-guest` boots native-architecture cloud images
-through QEMU for package, release, and E2E validation. A prepared cache entry is
-captured after the exact ordered Ansible configuration list and before
-test-specific packages, copied binaries, forwarded ports, or commands.
+The Bazel test guest harness under `bzl/test-guest` boots native-architecture cloud images
+through QEMU for package, release, and E2E validation. A prepared QCOW2 is
+emitted as a cacheable Bazel output after the exact ordered Ansible
+configuration list and before test-specific packages, copied binaries,
+forwarded ports, or commands.
 
-Prepared disks are flattened, sanitized QCOW2 images. The local cache keeps them
-read-only and each test receives a fresh writable overlay and cloud-init
-identity. The optional shared cache stores the compressed standalone disk and
-its compatibility metadata as a custom OCI artifact. Normal test runs ensure
-the exact local entry exists, invoking the cache builder automatically on a
-miss before booting a disposable overlay. The separate cache app owns OCI
-pulls and explicit publication. OCI pulls require a trusted manifest digest
-and retain that provenance with the local entry; mutable tags are used only
-for explicit publication.
+Prepared disks are flattened, sanitized QCOW2 images with deterministic
+compatibility metadata. Bazel stores both outputs in its local or remote action
+cache. Run and test targets consume the prepared disk read-only and give each
+guest a fresh writable overlay and cloud-init identity. Image construction
+executes locally because it needs host virtualization, but its declared outputs
+remain eligible for remote cache upload and download.
 
 ## Python Wheel Packaging
 

bzl/test-guest/README.md

@@ -27,14 +27,14 @@ Linux hosts, and a slower TCG fallback on Linux when KVM is unavailable.
 Build a prepared Fedora image with Podman:
 
 ```shell
-bazel build //nix/test-guest:fedora_podman_image
+bazel build //bzl/test-guest:fedora_podman_image
 ```
 
 The target produces cacheable Bazel outputs:
 
 ```text
-bazel-bin/nix/test-guest/fedora_podman_image.qcow2
-bazel-bin/nix/test-guest/fedora_podman_image.metadata.json
+bazel-bin/bzl/test-guest/fedora_podman_image.qcow2
+bazel-bin/bzl/test-guest/fedora_podman_image.metadata.json
 ```
 
 The image action boots the pinned cloud image, applies its declared Ansible
@@ -46,13 +46,13 @@ compressed QCOW2, and validates a fresh boot from that output.
 Run an interactive guest backed by the prepared image:
 
 ```shell
-bazel run //nix/test-guest:fedora_podman
+bazel run //bzl/test-guest:fedora_podman
 ```
 
 Arguments after the Bazel separator are passed to the guest runner:
 
 ```shell
-bazel run //nix/test-guest:ubuntu_docker -- \
+bazel run //bzl/test-guest:ubuntu_docker -- \
   --copy ./openshell:/usr/local/bin/openshell \
   -- openshell --version
 ```
@@ -65,7 +65,7 @@ creates a fresh writable overlay; the prepared Bazel output remains unchanged.
 The representative smoke test consumes the same prepared image provider:
 
 ```shell
-bazel test //nix/test-guest:fedora_podman_smoke
+bazel test //bzl/test-guest:fedora_podman_smoke
 ```
 
 Image and VM test actions execute locally because they require networking and
@@ -86,7 +86,7 @@ Append `_image` to a variant to build its QCOW2 directly. Query the package to
 see every generated target:
 
 ```shell
-bazel query //nix/test-guest:all
+bazel query //bzl/test-guest:all
 ```
 
 Ubuntu 24.04 provides Podman 4 without the `pasta` helper required by OpenShell
@@ -111,7 +111,7 @@ packages. Strict reproducibility requires pinned distro repository snapshots.
 Install a repository-built package:
 
 ```shell
-bazel run //nix/test-guest:ubuntu_docker -- \
+bazel run //bzl/test-guest:ubuntu_docker -- \
   --install artifacts/openshell_0.0.0-local_arm64.deb \
   -- openshell --version
 ```
@@ -122,7 +122,7 @@ packages. Package architecture must match the host and guest architecture.
 Copy executables without packaging them:
 
 ```shell
-bazel run //nix/test-guest:fedora_podman -- \
+bazel run //bzl/test-guest:fedora_podman -- \
   --copy ./openshell:/usr/local/bin/openshell \
   -- openshell --version
 ```
@@ -151,7 +151,7 @@ must correspond to a supported target suffix, such as `rocky_docker_selinux`.
 ## Directory structure
 
 ```text
-nix/test-guest/
+bzl/test-guest/
 ├── README.md
 ├── BUILD.bazel
 ├── catalog.bzl

bzl/test-guest/run.sh

@@ -9,7 +9,7 @@ set -Eeuo pipefail
 usage() {
 	cat <<'EOF'
 Usage:
-  bazel run //nix/test-guest:VARIANT -- [OPTIONS] [-- COMMAND...]
+  bazel run //bzl/test-guest:VARIANT -- [OPTIONS] [-- COMMAND...]
 
 Options:
   --install PATH      Install a .deb or .rpm package; repeatable
@@ -25,7 +25,7 @@ EOF
 }
 
 if [ "${OPENSHELL_TEST_GUEST_RUNTIME:-}" != 1 ]; then
-	echo "run this script through a //nix/test-guest Bazel target" >&2
+	echo "run this script through a //bzl/test-guest Bazel target" >&2
 	exit 2
 fi
 

bzl/test-guest/test-guest.MODULE.bazel

@@ -9,7 +9,7 @@ nix_repo = use_extension(
 )
 nix_repo.file(
     name = "openshell_nixpkgs",
-    file = "//nix/test-guest:nixpkgs.nix",
+    file = "//bzl/test-guest:nixpkgs.nix",
     file_deps = ["//:flake.lock"],
 )
 use_repo(nix_repo, "openshell_nixpkgs")
@@ -21,16 +21,16 @@ nix_pkg = use_extension(
 nix_pkg.file(
     name = "test_guest_host_tools",
     attr = "bazelHostTools",
-    build_file = "//nix/test-guest:host-tools.BUILD.bazel",
-    file = "//nix/test-guest:host-tools.nix",
+    build_file = "//bzl/test-guest:host-tools.BUILD.bazel",
+    file = "//bzl/test-guest:host-tools.nix",
     file_deps = [
-        "//nix/test-guest:run.sh",
+        "//bzl/test-guest:run.sh",
     ],
     repo = "@openshell_nixpkgs",
 )
 use_repo(nix_pkg, "test_guest_host_tools")
 
-test_guest_images = use_extension("//nix/test-guest:extensions.bzl", "test_guest_images")
+test_guest_images = use_extension("//bzl/test-guest:extensions.bzl", "test_guest_images")
 use_repo(
     test_guest_images,
     "test_guest_centos_aarch64",
@@ -43,4 +43,4 @@ use_repo(
     "test_guest_ubuntu_x86_64",
 )
 
-register_toolchains("//nix/test-guest:nix_host_tools_toolchain")
+register_toolchains("//bzl/test-guest:nix_host_tools_toolchain")

bzl/test-guest/test_guest.bzl

@@ -3,7 +3,7 @@
 load("@rules_shell//shell:sh_binary.bzl", "sh_binary")
 load("@rules_shell//shell:sh_test.bzl", "sh_test")
 
-_HOST_TOOLS_TOOLCHAIN = "//nix/test-guest:host_tools_toolchain_type"
+_HOST_TOOLS_TOOLCHAIN = "//bzl/test-guest:host_tools_toolchain_type"
 
 TestGuestBaseImageInfo = provider(
     fields = {
@@ -168,11 +168,11 @@ test_guest_image = rule(
         "generation": attr.int(default = 1),
         "_builder": attr.label(
             allow_single_file = True,
-            default = "//nix/test-guest:build-image.sh",
+            default = "//bzl/test-guest:build-image.sh",
         ),
         "_seal": attr.label(
             allow_single_file = True,
-            default = "//nix/test-guest:image-seal.sh",
+            default = "//bzl/test-guest:image-seal.sh",
         ),
     },
     toolchains = [_HOST_TOOLS_TOOLCHAIN],

e2e/run.sh

@@ -163,7 +163,7 @@ if [ "${mode}" = vm ]; then
 	for configuration in "${with_configurations[@]}"; do
 		vm_target_name+=_${configuration}
 	done
-	vm_bazel_target="//nix/test-guest:${vm_target_name}"
+	vm_bazel_target="//bzl/test-guest:${vm_target_name}"
 	if ! (cd "${ROOT}" && bazel query "${vm_bazel_target}" >/dev/null); then
 		die "unsupported Bazel test-guest combination: ${vm_target_name}"
 	fi