[build] All starlark externals are bazel modules

As of this commit, all of our starlark dependencies have been ported
from WORKSPACE to bzlmod.

MODULE.bazel

@@ -11,18 +11,26 @@
 
 module(name = "drake")
 
+bazel_dep(name = "apple_support", version = "1.17.1", repo_name = "build_bazel_apple_support")  # noqa
 bazel_dep(name = "bazel_skylib", version = "1.7.1")
+bazel_dep(name = "platforms", version = "0.0.10")
 bazel_dep(name = "rules_cc", version = "0.0.17")
 bazel_dep(name = "rules_java", version = "8.6.1")
 bazel_dep(name = "rules_license", version = "1.0.0")
 bazel_dep(name = "rules_python", version = "0.40.0")
+bazel_dep(name = "rules_rust", version = "0.54.1")
 
 cc_configure = use_extension(
     "@rules_cc//cc:extensions.bzl",
     "cc_configure_extension",
 )
 use_repo(cc_configure, "local_config_cc")
 
+register_toolchains(
+    "//tools/py_toolchain:toolchain",
+    "//tools/py_toolchain:exec_tools_toolchain",
+)
+
 # TODO(#20731) Move all of our dependencies from WORKSPACE.bzlmod into this
 # file, so that downstream projects can consume Drake exclusively via bzlmod
 # (and so that we can delete our WORKSPACE files prior to Bazel 9 which drops

WORKSPACE.bzlmod

@@ -14,10 +14,6 @@ load("//tools/workspace:default.bzl", "add_default_workspace")
 
 add_default_workspace(bzlmod = True)
 
-load("@build_bazel_apple_support//crosstool:setup.bzl", "apple_cc_configure")
-
-apple_cc_configure()
-
 # Add some special heuristic logic for using CLion with Drake.
 load("//tools/clion:repository.bzl", "drake_clion_environment")
 

tools/workspace/BUILD.bazel

@@ -82,8 +82,11 @@ drake_py_test(
         "//:WORKSPACE",
         "//:WORKSPACE.bzlmod",
         "//tools/workspace/bazel_skylib:repository.bzl",
+        "//tools/workspace/build_bazel_apple_support:repository.bzl",
+        "//tools/workspace/platforms:repository.bzl",
         "//tools/workspace/rules_cc:repository.bzl",
         "//tools/workspace/rules_license:repository.bzl",
+        "//tools/workspace/rules_rust:repository.bzl",
     ],
     tags = ["lint"],
     deps = [

tools/workspace/build_bazel_apple_support/BUILD.bazel

@@ -1,3 +1,9 @@
 load("//tools/lint:lint.bzl", "add_lint_tests")
 
+# Required for workspace_bzlmod_sync_test.py.
+exports_files(
+    ["repository.bzl"],
+    visibility = ["//tools/workspace:__pkg__"],
+)
+
 add_lint_tests()

tools/workspace/build_bazel_apple_support/repository.bzl

@@ -10,6 +10,10 @@ def build_bazel_apple_support_repository(
     github_archive(
         name = name,
         repository = "bazelbuild/apple_support",  # License: Apache-2.0
+        upgrade_advice = """
+        When updating, you must also manually propagate to the new version
+        number into the MODULE.bazel file (at the top level of Drake).
+        """,
         commit = "1.17.1",
         sha256 = "cfc295c5acb751fc3299425a1852e421ec0a560cdd97b6a7426d35a1271c2df5",  # noqa
         patches = [

tools/workspace/default.bzl

@@ -113,11 +113,15 @@ load("//tools/workspace/zlib:repository.bzl", "zlib_repository")
 # This is the list of modules that our MODULE.bazel already incorporates.
 # It is cross-checked by the workspace_bzlmod_sync_test.py test.
 REPOS_ALREADY_PROVIDED_BY_BAZEL_MODULES = [
+    "build_bazel_apple_support",
     "bazel_skylib",
+    "platforms",
+    "rust_toolchain",
     "rules_cc",
     "rules_java",
     "rules_license",
     "rules_python",
+    "rules_rust",
 ]
 
 def add_default_repositories(
@@ -374,6 +378,9 @@ def add_default_toolchains(
         bzlmod: when True, skips toolchains declared in our MODULE.bazel;
           set this to True if you are using bzlmod.
     """
+    if bzlmod:
+        # All toolchains are in MODULE.bazel already.
+        return
 
     if "py" not in excludes:
         native.register_toolchains(

tools/workspace/platforms/BUILD.bazel

@@ -1,3 +1,9 @@
 load("//tools/lint:lint.bzl", "add_lint_tests")
 
+# Required for workspace_bzlmod_sync_test.py.
+exports_files(
+    ["repository.bzl"],
+    visibility = ["//tools/workspace:__pkg__"],
+)
+
 add_lint_tests()

tools/workspace/platforms/repository.bzl

@@ -10,6 +10,10 @@ def platforms_repository(
     github_archive(
         name = name,
         repository = "bazelbuild/platforms",  # License: Apache-2.0
+        upgrade_advice = """
+        When updating, you must also manually propagate to the new version
+        number into the MODULE.bazel file (at the top level of Drake).
+        """,
         commit = "0.0.10",
         sha256 = "3df33228654e56b09f17613613767b052581b822d57cb9cfd5e7b19a8e617b42",  # noqa
         mirrors = mirrors,

tools/workspace/rules_rust/BUILD.bazel

@@ -1,3 +1,9 @@
 load("//tools/lint:lint.bzl", "add_lint_tests")
 
+# Required for workspace_bzlmod_sync_test.py.
+exports_files(
+    ["repository.bzl"],
+    visibility = ["//tools/workspace:__pkg__"],
+)
+
 add_lint_tests()

tools/workspace/rules_rust/repository.bzl

@@ -11,6 +11,10 @@ def rules_rust_repository(
     github_archive(
         name = name,
         repository = "bazelbuild/rules_rust",  # License: Apache-2.0
+        upgrade_advice = """
+        When updating, you must also manually propagate to the new version
+        number into the MODULE.bazel file (at the top level of Drake).
+        """,
         commit = "0.54.1",
         sha256 = "ef64969a9fac996820ede477c874c15efd06d748b5b9a0372da0e64934f82989",  # noqa
         patches = [

tools/workspace/workspace_bzlmod_sync_test.py

@@ -45,6 +45,15 @@ def _parse_repo_rule_version(self, content):
             return version
         self.fail(f"No 'commit = ...' found in:\n{content}")
 
+    def _module_name_to_repo_name(self, module_name):
+        """Some of our repository rules have a different repository name
+         compared to their module name for bzlmod. Given a module name, returns
+        the expected repository name.
+        """
+        if module_name == "apple_support":
+            return "build_bazel_apple_support"
+        return module_name
+
     def test_version_sync(self):
         """Some external version are independently listed in both MODULE.bazel
         and WORKSPACE. This test ensures that the versions pinned in each file
@@ -60,9 +69,10 @@ def test_version_sync(self):
 
         # Check that the module version matches the workspace version.
         self.assertTrue(modules)
-        for name, module_version in modules.items():
-            workspace_version = self._parse_repo_rule_version(
-                self._read(f"drake/tools/workspace/{name}/repository.bzl"))
+        for module_name, module_version in modules.items():
+            repo_name = self._module_name_to_repo_name(module_name)
+            workspace_version = self._parse_repo_rule_version(self._read(
+                f"drake/tools/workspace/{repo_name}/repository.bzl"))
             self.assertEqual(workspace_version, module_version)
 
     def _parse_workspace_already_provided(self, content):
@@ -92,15 +102,24 @@ def test_default_exclude_sync(self):
         synchronized.
         """
         modules = self._parse_modules(self._read(f"drake/MODULE.bazel"))
-        module_names = sorted(modules.keys())
-        self.assertEqual(module_names, self._parse_workspace_already_provided(
+
+        # These workspace-only repositories are irrelevant for bzlmod.
+        modules["rust_toolchain"] = None
+
+        # Check that default.bzl's constant matches the inventory of modules.
+        repo_names = sorted([
+            self._module_name_to_repo_name(module_name)
+            for module_name in modules.keys()
+        ])
+        self.assertEqual(repo_names, self._parse_workspace_already_provided(
             self._read("drake/tools/workspace/default.bzl")))
 
     def _canonicalize_workspace(self, content):
         """Given the contents of WORKSPACE or WORKSPACE.bzlmod, returns a
         modified copy that:
         - strips away comments and blank lines, and
-        - fuzzes out the `bzlmod = ...` attribute.
+        - fuzzes out the `bzlmod = ...` attribute, and
+        - strips some known workspace-only content.
         """
         needle1 = "add_default_workspace(bzlmod = False)"
         needle2 = "add_default_workspace(bzlmod = True)"
@@ -112,6 +131,10 @@ def _canonicalize_workspace(self, content):
             line = line.strip()
             if not line:
                 continue
+            if "apple_cc_configure" in line:
+                # The apple_cc_configure function should only be used when
+                # bzlmod is disabled; as such, it should not be in both files.
+                continue
             if line in (needle1, needle2):
                 line = replacement
             result.append(line)