[Copilot]

grpc's Envoy patch exposed ssl_lib and crypto_lib override points, but third_party:madler_zlib remained hard-wired to @zlib//:zlib. This prevented downstream consumers from redirecting grpc to their own zlib target and could pull both @zlib and @zlib-ng into the same build graph.

• grpc patch

  • extend the existing third_party/BUILD patch in modules/grpc/1.83.0.envoy/patches/grpc.patch
  • add a new public label_flag:

    label_flag(
        name = "zlib_lib",
        build_setting_default = "@zlib//:zlib",
        visibility = ["//visibility:public"],
    )

  • repoint madler_zlib through that flag instead of the upstream hard-coded alias:

    alias(
        name = "madler_zlib",
        actual = ":zlib_lib",
        tags = ["manual"],
    )

• registry metadata

  • update modules/grpc/1.83.0.envoy/source.json with the new grpc.patch integrity hash for the in-place patch edit

• result

  • downstream builds can now override grpc's zlib binding with:

    build --@grpc//third_party:zlib_lib=@envoy//bazel:zlib

  • this matches the existing ssl/crypto injection model and removes the need for grpc to be pinned to the BCR @zlib target