I am a bit lost about the broken CI. I suspect that somehow in the workspace setup a too old rules_cc version is being used. Given python/repositories.bzl used maybe to fetch dependencies, this seems possible. But I am lost why only 2 workspace tests red, although there are many more using the workspace setup.

Note, that the failing builds are using bazel 6.4.0. If I remember correctly, they are the only two workflows doing that. Could this be the reason?

@aignas
Some experimentation showed the problem is independent from the Bazel version.
I can't explain what happens exactly, but making the build green requires registering rules_cc before this line in the WORKSPACE file.
To achieve it I added rules_cc to the internal deps, which are loaded before this line. This causes rules_cc to be loaded in 2 places (internal and external deps), but given the same is already happening for bazel_skylib I assume this workaround is fine.

Thanks for this! It's been on my cleanup list for a long time.

Since this introduces a new dependency (it's not conceptually new, but will invoke the various remote-repo subsystems, so counts as new), please mention it in the changelog for completeness. I think rules_cc is largely just thin wrappers around the builtin-bazel rules still?

Otherwise LGTM

Yes, rules_cc are still mostly thin wrappers https://github.com/bazelbuild/rules_cc/blob/main/cc/defs.bzl#L59