diff --git a/src/BUILD b/src/BUILD
index 03e3551..af2999a 100644
--- a/src/BUILD
+++ b/src/BUILD
@@ -736,3 +736,61 @@
         "//third_party/ijar:__pkg__",
     ],
 )
+
+filegroup(
+    name = "test_repos",
+    srcs = [
+        "@android_tools_for_testing//:WORKSPACE",
+        "@bazel_toolchains//:WORKSPACE",
+        "@com_google_protobuf//:WORKSPACE",
+        "@openjdk10_darwin_archive//:WORKSPACE",
+        "@openjdk10_linux_archive//:WORKSPACE",
+        "@openjdk10_windows_archive//:WORKSPACE",
+        "@openjdk11_darwin_archive//:WORKSPACE",
+        "@openjdk11_linux_archive//:WORKSPACE",
+        "@openjdk11_windows_archive//:WORKSPACE",
+        "@openjdk12_darwin_archive//:WORKSPACE",
+        "@openjdk12_linux_archive//:WORKSPACE",
+        "@openjdk12_windows_archive//:WORKSPACE",
+        "@openjdk9_darwin_archive//:WORKSPACE",
+        "@openjdk9_linux_archive//:WORKSPACE",
+        "@openjdk9_windows_archive//:WORKSPACE",
+        "@openjdk_linux_aarch64_minimal//file",
+        "@openjdk_linux_minimal//file",
+        "@openjdk_macos_minimal//file",
+        "@openjdk_win_minimal//file",
+        "@remote_coverage_tools_for_testing//:WORKSPACE",
+        "@remote_java_tools_darwin_for_testing//:WORKSPACE",
+        "@remote_java_tools_javac10_test_darwin//:WORKSPACE",
+        "@remote_java_tools_javac10_test_linux//:WORKSPACE",
+        "@remote_java_tools_javac10_test_windows//:WORKSPACE",
+        "@remote_java_tools_javac11_test_darwin//:WORKSPACE",
+        "@remote_java_tools_javac11_test_linux//:WORKSPACE",
+        "@remote_java_tools_javac11_test_windows//:WORKSPACE",
+        "@remote_java_tools_javac12_test_darwin//:WORKSPACE",
+        "@remote_java_tools_javac12_test_linux//:WORKSPACE",
+        "@remote_java_tools_javac12_test_windows//:WORKSPACE",
+        "@remote_java_tools_javac9_test_darwin//:WORKSPACE",
+        "@remote_java_tools_javac9_test_linux//:WORKSPACE",
+        "@remote_java_tools_javac9_test_windows//:WORKSPACE",
+        "@remote_java_tools_linux_for_testing//:WORKSPACE",
+        "@remote_java_tools_windows_for_testing//:WORKSPACE",
+        "@remotejdk10_linux_aarch64_for_testing//:WORKSPACE",
+        "@remotejdk10_linux_for_testing//:WORKSPACE",
+        "@remotejdk10_macos_for_testing//:WORKSPACE",
+        "@remotejdk10_win_for_testing//:WORKSPACE",
+        "@remotejdk11_linux_aarch64_for_testing//:WORKSPACE",
+        "@remotejdk11_linux_for_testing//:WORKSPACE",
+        "@remotejdk11_macos_for_testing//:WORKSPACE",
+        "@remotejdk11_win_for_testing//:WORKSPACE",
+        "@remotejdk_linux_aarch64_for_testing//:WORKSPACE",
+        "@remotejdk_linux_for_testing//:WORKSPACE",
+        "@remotejdk_macos_for_testing//:WORKSPACE",
+        "@remotejdk_win_for_testing//:WORKSPACE",
+        "@rules_cc//:WORKSPACE",
+        "@rules_java//:WORKSPACE",
+        "@rules_pkg//:WORKSPACE",
+        "@rules_proto//:WORKSPACE",
+        "@rules_python//:WORKSPACE",
+    ],
+)
diff --git a/src/main/java/com/google/devtools/build/lib/bazel/rules/android/android_remote_tools.WORKSPACE b/src/main/java/com/google/devtools/build/lib/bazel/rules/android/android_remote_tools.WORKSPACE
index 6c93057..3a8710b 100644
--- a/src/main/java/com/google/devtools/build/lib/bazel/rules/android/android_remote_tools.WORKSPACE
+++ b/src/main/java/com/google/devtools/build/lib/bazel/rules/android/android_remote_tools.WORKSPACE
@@ -1,8 +1,8 @@
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
+# This must be kept in sync with the top-level WORKSPACE file.
 http_archive(
     name = "android_tools",
+    sha256 = "a3a951838448483e7af25afd10671b266cc6283104b4a2a427d31cac12cf0912",  # built at 6c63d70ef9c11a662b8323c0ae4f6d3ac53b1a60
     url = "https://mirror.bazel.build/bazel_android_tools/android_tools_pkg-0.14.tar.gz",
-    sha256 = "a3a951838448483e7af25afd10671b266cc6283104b4a2a427d31cac12cf0912", # built at 6c63d70ef9c11a662b8323c0ae4f6d3ac53b1a60
 )
-
diff --git a/src/main/java/com/google/devtools/build/lib/bazel/rules/coverage.WORKSPACE b/src/main/java/com/google/devtools/build/lib/bazel/rules/coverage.WORKSPACE
index 70751c6..8f5f189 100644
--- a/src/main/java/com/google/devtools/build/lib/bazel/rules/coverage.WORKSPACE
+++ b/src/main/java/com/google/devtools/build/lib/bazel/rules/coverage.WORKSPACE
@@ -6,6 +6,8 @@
 # 1. bazel build tools/test/CoverageOutputGenerator/java/com/google/devtools/coverageoutputgenerator:coverage_output_generator_zip
 # 2. Copy and rename the zip file with a new version locally.
 # 3. Upload the file under https://mirror.bazel.build/bazel_coverage_output_generator/releases.
+#
+# This must be kept in sync with the top-level WORKSPACE file.
 http_archive(
     name = "remote_coverage_tools",
     sha256 = "96ac6bc9b9fbc67b532bcae562da1642409791e6a4b8e522f04946ee5cc3ff8e",
diff --git a/src/main/java/com/google/devtools/build/lib/bazel/rules/java/jdk.WORKSPACE b/src/main/java/com/google/devtools/build/lib/bazel/rules/java/jdk.WORKSPACE
index 8a0c823..5416e19 100644
--- a/src/main/java/com/google/devtools/build/lib/bazel/rules/java/jdk.WORKSPACE
+++ b/src/main/java/com/google/devtools/build/lib/bazel/rules/java/jdk.WORKSPACE
@@ -92,6 +92,8 @@
 # This will allow us to stop bundling the full JDK with Bazel.
 # Note that while these are currently the same as the openjdk_* rules in
 # Bazel's WORKSPACE file, but they don't have to be the same.
+
+# This must be kept in sync with the top-level WORKSPACE file.
 maybe(
     http_archive,
     name = "remotejdk_linux",
@@ -103,6 +105,7 @@
     ],
 )
 
+# This must be kept in sync with the top-level WORKSPACE file.
 maybe(
     http_archive,
     name = "remotejdk_macos",
@@ -114,6 +117,7 @@
     ],
 )
 
+# This must be kept in sync with the top-level WORKSPACE file.
 maybe(
     http_archive,
     name = "remotejdk_win",
@@ -127,6 +131,7 @@
 
 # The source-code for this OpenJDK can be found at:
 # https://openjdk.linaro.org/releases/jdk9-src-1708.tar.xz
+# This must be kept in sync with the top-level WORKSPACE file.
 maybe(
     http_archive,
     name = "remotejdk_linux_aarch64",
@@ -140,6 +145,7 @@
     ],
 )
 
+# This must be kept in sync with the top-level WORKSPACE file.
 maybe(
     http_archive,
     name = "remotejdk10_linux",
@@ -151,6 +157,7 @@
     ],
 )
 
+# This must be kept in sync with the top-level WORKSPACE file.
 maybe(
     http_archive,
     name = "remotejdk10_macos",
@@ -162,6 +169,7 @@
     ],
 )
 
+# This must be kept in sync with the top-level WORKSPACE file.
 maybe(
     http_archive,
     name = "remotejdk10_win",
@@ -175,6 +183,7 @@
 
 # The source-code for this OpenJDK can be found at:
 # https://openjdk.linaro.org/releases/jdk10-src-1804.tar.xz
+# This must be kept in sync with the top-level WORKSPACE file.
 maybe(
     http_archive,
     name = "remotejdk10_linux_aarch64",
@@ -188,6 +197,7 @@
     ],
 )
 
+# This must be kept in sync with the top-level WORKSPACE file.
 maybe(
     http_archive,
     name = "remotejdk11_linux",
@@ -199,6 +209,7 @@
     ],
 )
 
+# This must be kept in sync with the top-level WORKSPACE file.
 maybe(
     http_archive,
     name = "remotejdk11_linux_aarch64",
@@ -210,6 +221,7 @@
     ],
 )
 
+# This must be kept in sync with the top-level WORKSPACE file.
 maybe(
     http_archive,
     name = "remotejdk11_macos",
@@ -221,6 +233,7 @@
     ],
 )
 
+# This must be kept in sync with the top-level WORKSPACE file.
 maybe(
     http_archive,
     name = "remotejdk11_win",
@@ -232,6 +245,7 @@
     ],
 )
 
+# This must be kept in sync with the top-level WORKSPACE file.
 maybe(
     http_archive,
     name = "remote_java_tools_linux",
@@ -242,6 +256,7 @@
     ],
 )
 
+# This must be kept in sync with the top-level WORKSPACE file.
 maybe(
     http_archive,
     name = "remote_java_tools_windows",
@@ -252,6 +267,7 @@
     ],
 )
 
+# This must be kept in sync with the top-level WORKSPACE file.
 maybe(
     http_archive,
     name = "remote_java_tools_darwin",
diff --git a/src/test/shell/bazel/testdata/jdk_http_archives b/src/test/shell/bazel/testdata/jdk_http_archives
index 69f93fc..1367315 100644
--- a/src/test/shell/bazel/testdata/jdk_http_archives
+++ b/src/test/shell/bazel/testdata/jdk_http_archives
@@ -1,4 +1,5 @@
 ################### Remote java_tools with embedded javac 9 ####################
+# This must be kept in sync with the top-level WORKSPACE file.
 http_archive(
     name = "remote_java_tools_javac9_test_linux",
     sha256 = "e120f4a17365e7fbfc8ef0c1c24ece6668f1db295924bfe0c1b8d52caf8ad3a1",
@@ -6,6 +7,7 @@
         "https://mirror.bazel.build/bazel_java_tools/releases/javac9/v4.0/java_tools_javac9_linux-v4.0.zip",
     ],
 )
+# This must be kept in sync with the top-level WORKSPACE file.
 http_archive(
     name = "remote_java_tools_javac9_test_windows",
     sha256 = "5d1caf08482b72cbea9a5b1530125bc4943daa70da0345ac0a630f51c1d11c6b",
@@ -13,6 +15,7 @@
         "https://mirror.bazel.build/bazel_java_tools/releases/javac9/v4.0/java_tools_javac9_windows-v4.0.zip",
     ],
 )
+# This must be kept in sync with the top-level WORKSPACE file.
 http_archive(
     name = "remote_java_tools_javac9_test_darwin",
     sha256 = "03fd111111cc74b44984fb1eb945eec8ab4a91037538975bc403c26b501ee75f",
@@ -22,6 +25,7 @@
 )
 
 ################### Remote java_tools with embedded javac 10 ###################
+# This must be kept in sync with the top-level WORKSPACE file.
 http_archive(
     name = "remote_java_tools_javac10_test_linux",
     sha256 = "d4fbed2bb22634835e42568c2d26df34fdd7281d9a7061c537f32c9970316e38",
@@ -29,6 +33,7 @@
         "https://mirror.bazel.build/bazel_java_tools/releases/javac10/v5.0/java_tools_javac10_linux-v5.0.zip",
     ],
 )
+# This must be kept in sync with the top-level WORKSPACE file.
 http_archive(
     name = "remote_java_tools_javac10_test_windows",
     sha256 = "ee3192ca33c1249ed785c755f84b5a989c22b4a6ca4cb1d7a37dd94104a9999d",
@@ -36,6 +41,7 @@
         "https://mirror.bazel.build/bazel_java_tools/releases/javac10/v5.0/java_tools_javac10_windows-v5.0.zip",
     ],
 )
+# This must be kept in sync with the top-level WORKSPACE file.
 http_archive(
     name = "remote_java_tools_javac10_test_darwin",
     sha256 = "d9311bdccb5cfcc8783b70b81a50ca72029fb35a19295dd056a7f7050d71033f",
@@ -45,6 +51,7 @@
 )
 
 ################### Remote java_tools with embedded javac 11 ###################
+# This must be kept in sync with the top-level WORKSPACE file.
 http_archive(
     name = "remote_java_tools_javac11_test_linux",
     sha256 = "3ff465e82954a70f49982610dd63f6f651beaa83c707dd637870b0e41cdcd2f0",
@@ -52,6 +59,7 @@
          "https://mirror.bazel.build/bazel_java_tools/releases/javac11/v7.0/java_tools_javac11_linux-v7.0.zip",
     ],
 )
+# This must be kept in sync with the top-level WORKSPACE file.
 http_archive(
     name = "remote_java_tools_javac11_test_windows",
     sha256 = "11d90a147919e74d11870cdd58c4ee5de3062c08d11b16aa72d3f3bbfa9497a0",
@@ -59,6 +67,7 @@
         "https://mirror.bazel.build/bazel_java_tools/releases/javac11/v7.0/java_tools_javac11_windows-v7.0.zip",
     ],
 )
+# This must be kept in sync with the top-level WORKSPACE file.
 http_archive(
     name = "remote_java_tools_javac11_test_darwin",
     sha256 = "373a4226906ae9ba908550da16e133c4cd1f01b8973af82b9a2eb6903cb4d645",
@@ -68,12 +77,13 @@
 )
 
 ################### Remote java_tools with embedded javac 12 ###################
+# This must be kept in sync with the top-level WORKSPACE file.
 http_archive(
     name = "remote_java_tools_javac12_test_linux",
     sha256 = "3997ee9a57b095748f1c0d084839fab2fbc72504aeb7b37b1f71c31738d330e3",
     urls = ["https://mirror.bazel.build/bazel_java_tools/releases/javac12/v3.0/java_tools_javac12_linux-v3.0.zip"],
 )
-
+# This must be kept in sync with the top-level WORKSPACE file.
 http_archive(
     name = "remote_java_tools_javac12_test_windows",
     sha256 = "cfad1718dad1fed12816748eed27ab30b9ea1268c8ce9940acf3b5b7d82d483d",
@@ -81,6 +91,7 @@
         "https://mirror.bazel.build/bazel_java_tools/releases/javac12/v3.0/java_tools_javac12_windows-v3.0.zip",
     ],
 )
+# This must be kept in sync with the top-level WORKSPACE file.
 http_archive(
     name = "remote_java_tools_javac12_test_darwin",
     sha256 = "54df966e7583bafe659e39b4103a4ce934201d969de638d071ada07d8e0c1a3a",
@@ -90,6 +101,7 @@
 )
 
 #################################### JDK 9 #####################################
+# This must be kept in sync with the top-level WORKSPACE file.
 http_archive(
     name = "openjdk9_linux_archive",
     build_file_content = "java_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])",
@@ -99,6 +111,7 @@
         "https://mirror.bazel.build/openjdk/azul-zulu-9.0.7.1-jdk9.0.7/zulu9.0.7.1-jdk9.0.7-linux_x64.tar.gz",
     ],
 )
+# This must be kept in sync with the top-level WORKSPACE file.
 http_archive(
     name = "openjdk9_darwin_archive",
     build_file_content = "java_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])",
@@ -107,6 +120,7 @@
         "https://mirror.bazel.build/openjdk/azul-zulu-9.0.7.1-jdk9.0.7/zulu9.0.7.1-jdk9.0.7-macosx_x64.tar.gz",
     ],
 )
+# This must be kept in sync with the top-level WORKSPACE file.
 http_archive(
     name = "openjdk9_windows_archive",
     build_file_content = "java_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])",
@@ -117,6 +131,7 @@
 )
 
 #################################### JDK 10 ####################################
+# This must be kept in sync with the top-level WORKSPACE file.
 http_archive(
     name = "openjdk10_linux_archive",
     build_file_content = "java_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])",
@@ -126,6 +141,7 @@
         "https://mirror.bazel.build/openjdk/azul-zulu10.2+3-jdk10.0.1/zulu10.2+3-jdk10.0.1-linux_x64.tar.gz",
     ],
 )
+# This must be kept in sync with the top-level WORKSPACE file.
 http_archive(
     name = "openjdk10_darwin_archive",
     build_file_content = "java_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])",
@@ -134,6 +150,7 @@
         "https://mirror.bazel.build/openjdk/azul-zulu10.2+3-jdk10.0.1/zulu10.2+3-jdk10.0.1-macosx_x64.tar.gz",
     ],
 )
+# This must be kept in sync with the top-level WORKSPACE file.
 http_archive(
     name = "openjdk10_windows_archive",
     build_file_content = "java_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])",
@@ -144,6 +161,7 @@
 )
 
 #################################### JDK 11 ####################################
+# This must be kept in sync with the top-level WORKSPACE file.
 http_archive(
     name = "openjdk11_linux_archive",
     build_file_content = "java_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])",
@@ -152,6 +170,7 @@
         "https://mirror.bazel.build/openjdk/azul-zulu11.31.11-ca-jdk11.0.3/zulu11.31.11-ca-jdk11.0.3-linux_x64.tar.gz",
     ],
 )
+# This must be kept in sync with the top-level WORKSPACE file.
 http_archive(
     name = "openjdk11_darwin_archive",
     build_file_content = "java_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])",
@@ -160,6 +179,7 @@
         "https://mirror.bazel.build/openjdk/azul-zulu11.31.11-ca-jdk11.0.3/zulu11.31.11-ca-jdk11.0.3-macosx_x64.tar.gz",
     ],
 )
+# This must be kept in sync with the top-level WORKSPACE file.
 http_archive(
     name = "openjdk11_windows_archive",
     build_file_content = "java_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])",
@@ -170,6 +190,7 @@
 )
 
 #################################### JDK 12 ####################################
+# This must be kept in sync with the top-level WORKSPACE file.
 http_archive(
     name = "openjdk12_linux_archive",
     build_file_content = "java_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])",
@@ -178,6 +199,7 @@
         "https://mirror.bazel.build/openjdk/azul-zulu12.2.3-ca-jdk12.0.1/zulu12.2.3-ca-jdk12.0.1-linux_x64.tar.gz",
     ],
 )
+# This must be kept in sync with the top-level WORKSPACE file.
 http_archive(
     name = "openjdk12_darwin_archive",
     build_file_content = "java_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])",
@@ -186,6 +208,7 @@
         "https://mirror.bazel.build/openjdk/azul-zulu12.2.3-ca-jdk12.0.1/zulu12.2.3-ca-jdk12.0.1-macosx_x64.tar.gz",
     ],
 )
+# This must be kept in sync with the top-level WORKSPACE file.
 http_archive(
     name = "openjdk12_windows_archive",
     build_file_content = "java_runtime(name = 'runtime', srcs =  glob(['**']), visibility = ['//visibility:public'])",