diff --git a/src/main/cpp/BUILD b/src/main/cpp/BUILD
index 6f96b6f..8fe3e77 100644
--- a/src/main/cpp/BUILD
+++ b/src/main/cpp/BUILD
@@ -4,6 +4,8 @@
     default_visibility = ["//visibility:public"],
 )
 
+load("@rules_cc//cc:defs.bzl", "cc_binary", "cc_library")
+
 WIN_LINK_OPTS = [
     "-DEFAULTLIB:advapi32.lib",  # GetUserNameW
     "-DEFAULTLIB:ole32.lib",  # CoTaskMemFree
diff --git a/src/main/cpp/util/BUILD b/src/main/cpp/util/BUILD
index dede1a8..4b4b448 100644
--- a/src/main/cpp/util/BUILD
+++ b/src/main/cpp/util/BUILD
@@ -8,6 +8,7 @@
 )
 
 load("//tools/build_defs/pkg:pkg.bzl", "pkg_tar")
+load("@rules_cc//cc:defs.bzl", "cc_library")
 
 cc_library(
     name = "util",
diff --git a/src/main/java/com/google/devtools/build/lib/bazel/rules/java/jdk.WORKSPACE b/src/main/java/com/google/devtools/build/lib/bazel/rules/java/jdk.WORKSPACE
index 195bd4f..1af34ca 100644
--- a/src/main/java/com/google/devtools/build/lib/bazel/rules/java/jdk.WORKSPACE
+++ b/src/main/java/com/google/devtools/build/lib/bazel/rules/java/jdk.WORKSPACE
@@ -243,8 +243,23 @@
     http_archive,
     "rules_java",
     sha256 = "bc81f1ba47ef5cc68ad32225c3d0e70b8c6f6077663835438da8d5733f917598",
-    urls = ["https://github.com/bazelbuild/rules_java/archive/7cf3cefd652008d0a64a419c34c13bdca6c8f178.zip"],
+    urls = [
+      "https://mirror.bazel.build/github.com/bazelbuild/rules_java/archive/7cf3cefd652008d0a64a419c34c13bdca6c8f178.zip",
+      "https://github.com/bazelbuild/rules_java/archive/7cf3cefd652008d0a64a419c34c13bdca6c8f178.zip"
+    ],
     strip_prefix = "rules_java-7cf3cefd652008d0a64a419c34c13bdca6c8f178"
 )
 
+# Needed only because of java_tools.
+maybe(
+    http_archive,
+    "rules_cc",
+    sha256 = "36fa66d4d49debd71d05fba55c1353b522e8caef4a20f8080a3d17cdda001d89",
+    urls = [
+      "https://mirror.bazel.build/github.com/bazelbuild/rules_cc/archive/0d5f3f2768c6ca2faca0079a997a97ce22997a0c.zip",
+      "https://github.com/bazelbuild/rules_cc/archive/0d5f3f2768c6ca2faca0079a997a97ce22997a0c.zip"
+    ],
+    strip_prefix = "rules_cc-0d5f3f2768c6ca2faca0079a997a97ce22997a0c",
+)
+
 register_toolchains("@bazel_tools//tools/jdk:all")
diff --git a/src/main/native/BUILD b/src/main/native/BUILD
index 91e0768..7813537 100644
--- a/src/main/native/BUILD
+++ b/src/main/native/BUILD
@@ -1,3 +1,5 @@
+load("@rules_cc//cc:defs.bzl", "cc_binary", "cc_library")
+
 genrule(
     name = "copy_link_jni_md_header",
     srcs = select({
diff --git a/src/main/native/windows/BUILD b/src/main/native/windows/BUILD
index acfebe2..7b9c273 100644
--- a/src/main/native/windows/BUILD
+++ b/src/main/native/windows/BUILD
@@ -1,3 +1,5 @@
+load("@rules_cc//cc:defs.bzl", "cc_binary", "cc_library")
+
 package(default_visibility = ["//visibility:private"])
 
 filegroup(
diff --git a/src/main/protobuf/BUILD b/src/main/protobuf/BUILD
index 8056e19..066fc5e 100644
--- a/src/main/protobuf/BUILD
+++ b/src/main/protobuf/BUILD
@@ -4,6 +4,7 @@
 load("//tools/build_rules:utilities.bzl", "java_library_srcs")
 load("//third_party/protobuf/3.6.1:protobuf.bzl", "py_proto_library")
 load("//third_party/grpc:build_defs.bzl", "java_grpc_library")
+load("@rules_cc//cc:defs.bzl", "cc_proto_library")
 
 exports_files(
     ["execution_statitics.proto"],
diff --git a/src/main/tools/BUILD b/src/main/tools/BUILD
index d7e518e..aa29cd4 100644
--- a/src/main/tools/BUILD
+++ b/src/main/tools/BUILD
@@ -1,5 +1,7 @@
 package(default_visibility = ["//src:__subpackages__"])
 
+load("@rules_cc//cc:defs.bzl", "cc_binary", "cc_library")
+
 cc_binary(
     name = "daemonize",
     srcs = ["daemonize.c"],
diff --git a/src/test/cpp/BUILD b/src/test/cpp/BUILD
index 881f94e..6a93788 100644
--- a/src/test/cpp/BUILD
+++ b/src/test/cpp/BUILD
@@ -2,6 +2,8 @@
 #   C++ utility tests for Bazel
 package(default_visibility = ["//visibility:public"])
 
+load("@rules_cc//cc:defs.bzl", "cc_library", "cc_test")
+
 filegroup(
     name = "srcs",
     srcs = glob(["**"]) + ["//src/test/cpp/util:srcs"],
diff --git a/src/test/cpp/util/BUILD b/src/test/cpp/util/BUILD
index 7183c2a..03341ad 100644
--- a/src/test/cpp/util/BUILD
+++ b/src/test/cpp/util/BUILD
@@ -2,6 +2,8 @@
 #   C++ utility tests for Bazel
 package(default_visibility = ["//visibility:public"])
 
+load("@rules_cc//cc:defs.bzl", "cc_library", "cc_test")
+
 filegroup(
     name = "srcs",
     srcs = glob(["**"]),
diff --git a/src/test/java/com/google/devtools/build/lib/BUILD b/src/test/java/com/google/devtools/build/lib/BUILD
index fbf4d42..1b55b3c 100644
--- a/src/test/java/com/google/devtools/build/lib/BUILD
+++ b/src/test/java/com/google/devtools/build/lib/BUILD
@@ -5,6 +5,8 @@
     ],
 )
 
+load("@rules_cc//cc:defs.bzl", "cc_binary")
+
 # Tests for Windows-specific functionality that can run cross-platform.
 CROSS_PLATFORM_WINDOWS_TESTS = [
     "util/DependencySetWindowsTest.java",
diff --git a/src/test/java/com/google/devtools/build/lib/blackbox/bazel/BlackBoxTestEnvironmentImpl.java b/src/test/java/com/google/devtools/build/lib/blackbox/bazel/BlackBoxTestEnvironmentImpl.java
index 8d63017..22a672b 100644
--- a/src/test/java/com/google/devtools/build/lib/blackbox/bazel/BlackBoxTestEnvironmentImpl.java
+++ b/src/test/java/com/google/devtools/build/lib/blackbox/bazel/BlackBoxTestEnvironmentImpl.java
@@ -40,7 +40,7 @@
         new BlackBoxTestContext(
             testName, "bazel", binaryPath, Collections.emptyMap(), executorService);
     // Any Bazel command requires that workspace is already set up.
-    testContext.write("WORKSPACE", "workspace(name = 'main')");
+    testContext.write("WORKSPACE", "workspace(name = 'main')", getWorkspaceWithDefaultRepos());
 
     List<ToolsSetup> allTools = Lists.newArrayList(new DefaultToolsSetup());
     allTools.addAll(tools);
diff --git a/src/test/java/com/google/devtools/build/lib/blackbox/framework/BlackBoxTestEnvironment.java b/src/test/java/com/google/devtools/build/lib/blackbox/framework/BlackBoxTestEnvironment.java
index 638cd85..78a4fa0 100644
--- a/src/test/java/com/google/devtools/build/lib/blackbox/framework/BlackBoxTestEnvironment.java
+++ b/src/test/java/com/google/devtools/build/lib/blackbox/framework/BlackBoxTestEnvironment.java
@@ -14,6 +14,7 @@
 
 package com.google.devtools.build.lib.blackbox.framework;
 
+import com.google.common.base.Joiner;
 import com.google.common.base.Preconditions;
 import com.google.common.collect.ImmutableList;
 import com.google.common.util.concurrent.MoreExecutors;
@@ -73,4 +74,21 @@
     MoreExecutors.shutdownAndAwaitTermination(executorService, 1, TimeUnit.SECONDS);
     executorService = null;
   }
+
+  public static String getWorkspaceWithDefaultRepos() {
+    return Joiner.on("\n")
+        .join(
+            "load('@bazel_tools//tools/build_defs/repo:http.bzl', 'http_archive')",
+            "http_archive(",
+            "    name = 'rules_cc',",
+            "    sha256 = '36fa66d4d49debd71d05fba55c1353b522e8caef4a20f8080a3d17cdda001d89',",
+            "    strip_prefix = 'rules_cc-0d5f3f2768c6ca2faca0079a997a97ce22997a0c',",
+            "    urls = [",
+            "        'https://mirror.bazel.build/github.com/bazelbuild/rules_cc/archive/"
+                + "0d5f3f2768c6ca2faca0079a997a97ce22997a0c.zip',",
+            "        'https://github.com/bazelbuild/rules_cc/archive/"
+                + "0d5f3f2768c6ca2faca0079a997a97ce22997a0c.zip',",
+            "    ],",
+            ")");
+  }
 }
diff --git a/src/test/java/com/google/devtools/build/lib/blackbox/tests/PythonBlackBoxTest.java b/src/test/java/com/google/devtools/build/lib/blackbox/tests/PythonBlackBoxTest.java
index b344d57..6f8c1b0 100644
--- a/src/test/java/com/google/devtools/build/lib/blackbox/tests/PythonBlackBoxTest.java
+++ b/src/test/java/com/google/devtools/build/lib/blackbox/tests/PythonBlackBoxTest.java
@@ -18,6 +18,7 @@
 
 import com.google.common.collect.ImmutableList;
 import com.google.devtools.build.lib.blackbox.bazel.PythonToolsSetup;
+import com.google.devtools.build.lib.blackbox.framework.BlackBoxTestEnvironment;
 import com.google.devtools.build.lib.blackbox.framework.BuilderRunner;
 import com.google.devtools.build.lib.blackbox.framework.ProcessResult;
 import com.google.devtools.build.lib.blackbox.framework.ToolsSetup;
@@ -51,6 +52,7 @@
   }
 
   private void writeHelloWorldFiles() throws IOException {
+    context().write("WORKSPACE", BlackBoxTestEnvironment.getWorkspaceWithDefaultRepos());
     context().write("python/hello/BUILD", "py_binary(name = 'hello', srcs = ['hello.py'])");
     context().write("python/hello/hello.py", String.format("print ('%s')", HELLO));
   }
diff --git a/src/test/java/com/google/devtools/build/lib/blackbox/tests/workspace/BazelEmbeddedSkylarkBlackBoxTest.java b/src/test/java/com/google/devtools/build/lib/blackbox/tests/workspace/BazelEmbeddedSkylarkBlackBoxTest.java
index 04101f5c..6dd37a2 100644
--- a/src/test/java/com/google/devtools/build/lib/blackbox/tests/workspace/BazelEmbeddedSkylarkBlackBoxTest.java
+++ b/src/test/java/com/google/devtools/build/lib/blackbox/tests/workspace/BazelEmbeddedSkylarkBlackBoxTest.java
@@ -18,6 +18,7 @@
 
 import com.google.devtools.build.lib.bazel.repository.DecompressorDescriptor;
 import com.google.devtools.build.lib.bazel.repository.TarFunction;
+import com.google.devtools.build.lib.blackbox.framework.BlackBoxTestEnvironment;
 import com.google.devtools.build.lib.blackbox.framework.BuilderRunner;
 import com.google.devtools.build.lib.blackbox.framework.PathUtils;
 import com.google.devtools.build.lib.blackbox.junit.AbstractBlackBoxTest;
@@ -44,7 +45,7 @@
 
   @Test
   public void testPkgTar() throws Exception {
-    context().write("main/WORKSPACE");
+    context().write("main/WORKSPACE", BlackBoxTestEnvironment.getWorkspaceWithDefaultRepos());
     context().write("main/foo.txt", "Hello World");
     context().write("main/bar.txt", "Hello World, again");
     context()
@@ -83,7 +84,7 @@
     context()
         .write(
             "WORKSPACE",
-            "load(\"@bazel_tools//tools/build_defs/repo:http.bzl\", \"http_archive\")\n",
+            BlackBoxTestEnvironment.getWorkspaceWithDefaultRepos(),
             String.format(
                 "local_repository(name=\"ext_local\", path=\"%s\",)",
                 PathUtils.pathForStarlarkFile(repo)),
diff --git a/src/test/java/com/google/devtools/build/lib/blackbox/tests/workspace/WorkspaceBlackBoxTest.java b/src/test/java/com/google/devtools/build/lib/blackbox/tests/workspace/WorkspaceBlackBoxTest.java
index 93d353b..9ced4f3 100644
--- a/src/test/java/com/google/devtools/build/lib/blackbox/tests/workspace/WorkspaceBlackBoxTest.java
+++ b/src/test/java/com/google/devtools/build/lib/blackbox/tests/workspace/WorkspaceBlackBoxTest.java
@@ -16,6 +16,7 @@
 
 import static com.google.common.truth.Truth.assertThat;
 
+import com.google.devtools.build.lib.blackbox.framework.BlackBoxTestEnvironment;
 import com.google.devtools.build.lib.blackbox.framework.BuilderRunner;
 import com.google.devtools.build.lib.blackbox.framework.PathUtils;
 import com.google.devtools.build.lib.blackbox.framework.ProcessResult;
@@ -241,6 +242,7 @@
     PathUtils.writeFile(
         tempWorkspace,
         "workspace(name = 'abc')",
+        BlackBoxTestEnvironment.getWorkspaceWithDefaultRepos(),
         String.format(
             "local_repository(name = 'ext', path = '%s',)", PathUtils.pathForStarlarkFile(repo)));
     Files.createSymbolicLink(workspaceFile, tempWorkspace);
diff --git a/src/test/java/com/google/devtools/build/lib/shell/BUILD b/src/test/java/com/google/devtools/build/lib/shell/BUILD
index 42a7a84..8221c81 100644
--- a/src/test/java/com/google/devtools/build/lib/shell/BUILD
+++ b/src/test/java/com/google/devtools/build/lib/shell/BUILD
@@ -7,6 +7,8 @@
 
 licenses(["notice"])  # Apache 2.0
 
+load("@rules_cc//cc:defs.bzl", "cc_binary")
+
 filegroup(
     name = "srcs",
     testonly = 0,
diff --git a/src/test/native/BUILD b/src/test/native/BUILD
index a00458a..868270d 100644
--- a/src/test/native/BUILD
+++ b/src/test/native/BUILD
@@ -2,6 +2,8 @@
 #   C++ utility tests for Bazel
 package(default_visibility = ["//visibility:public"])
 
+load("@rules_cc//cc:defs.bzl", "cc_test")
+
 filegroup(
     name = "srcs",
     srcs = glob(["**"]),
diff --git a/src/test/py/bazel/BUILD b/src/test/py/bazel/BUILD
index 81e240b..f500a1d 100644
--- a/src/test/py/bazel/BUILD
+++ b/src/test/py/bazel/BUILD
@@ -1,5 +1,7 @@
 package(default_visibility = ["//visibility:private"])
 
+load("@rules_cc//cc:defs.bzl", "cc_binary")
+
 filegroup(
     name = "srcs",
     srcs = glob(["**"]),
diff --git a/src/test/py/bazel/bazel_external_repository_test.py b/src/test/py/bazel/bazel_external_repository_test.py
index ad75b07..0f0e82b 100644
--- a/src/test/py/bazel/bazel_external_repository_test.py
+++ b/src/test/py/bazel/bazel_external_repository_test.py
@@ -77,6 +77,7 @@
         '  srcs = ["six.py"],',
         ')',
     ]
+    rule_definition.extend(self.GetDefaultRepoRules())
     self.ScratchFile('WORKSPACE', rule_definition)
     self.ScratchFile('BUILD')
     self.ScratchFile('third_party/BUILD')
@@ -109,14 +110,16 @@
 
   def testNewHttpArchiveWithSymlinks(self):
     ip, port = self._http_server.server_address
-    self.ScratchFile('WORKSPACE', [
+    rule_definition = [
         'load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")',
         'http_archive(',
         '    name = "archive_with_symlink",',
         '    urls = ["http://%s:%s/archive_with_symlink.zip"],' % (ip, port),
         '    build_file = "@//:archive_with_symlink.BUILD",',
         ')',
-    ])
+    ]
+    rule_definition.extend(self.GetDefaultRepoRules())
+    self.ScratchFile('WORKSPACE', rule_definition)
     # In the archive, A is a symlink pointing to B
     self.ScratchFile('archive_with_symlink.BUILD', [
         'filegroup(',
@@ -149,14 +152,17 @@
 
   def testNewLocalRepositoryNoticesFileChangeInRepoRoot(self):
     """Regression test for https://github.com/bazelbuild/bazel/issues/7063."""
-    self.ScratchFile('WORKSPACE', [
+    rule_definition = [
+        'load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")',
         'new_local_repository(',
         '    name = "r",',
         '    path = "./repo",',
         '    build_file_content = "exports_files([\'foo.bzl\'])",',
         ')',
-    ])
-    self.ScratchFile('repo/WORKSPACE')
+    ]
+    rule_definition.extend(self.GetDefaultRepoRules())
+    self.ScratchFile('WORKSPACE', rule_definition)
+    self.CreateWorkspaceWithDefaultRepos('repo/WORKSPACE')
     self._CreatePyWritingStarlarkRule('hello!')
     self.ScratchFile('BUILD', [
         'load("@r//:foo.bzl", "gen_py")',
diff --git a/src/test/py/bazel/bazel_windows_cpp_test.py b/src/test/py/bazel/bazel_windows_cpp_test.py
index 038148e..3ca5be0 100644
--- a/src/test/py/bazel/bazel_windows_cpp_test.py
+++ b/src/test/py/bazel/bazel_windows_cpp_test.py
@@ -20,7 +20,7 @@
 class BazelWindowsCppTest(test_base.TestBase):
 
   def createProjectFiles(self):
-    self.ScratchFile('WORKSPACE')
+    self.CreateWorkspaceWithDefaultRepos('WORKSPACE')
     self.ScratchFile('BUILD', [
         'package(',
         '  default_visibility = ["//visibility:public"],',
@@ -462,7 +462,7 @@
         self.fail('File "%s" does contain "%s"' % (file_path, entry))
 
   def testWinDefFileAttribute(self):
-    self.ScratchFile('WORKSPACE')
+    self.CreateWorkspaceWithDefaultRepos('WORKSPACE')
     self.ScratchFile('lib.cc', ['void hello() {}'])
     self.ScratchFile('my_lib.def', [
         'EXPORTS',
@@ -505,7 +505,7 @@
       self.assertIn('/DEF:my_lib.def', param_file.read())
 
   def testCcImportRule(self):
-    self.ScratchFile('WORKSPACE')
+    self.CreateWorkspaceWithDefaultRepos('WORKSPACE')
     self.ScratchFile('BUILD', [
         'cc_import(',
         '  name = "a_import",',
@@ -522,7 +522,7 @@
     self.AssertExitCode(exit_code, 0, stderr)
 
   def testCppErrorShouldBeVisible(self):
-    self.ScratchFile('WORKSPACE')
+    self.CreateWorkspaceWithDefaultRepos('WORKSPACE')
     self.ScratchFile('BUILD', [
         'cc_binary(',
         '  name = "bad",',
diff --git a/src/test/py/bazel/bazel_windows_test.py b/src/test/py/bazel/bazel_windows_test.py
index 850f45f..e87c6d5 100644
--- a/src/test/py/bazel/bazel_windows_test.py
+++ b/src/test/py/bazel/bazel_windows_test.py
@@ -20,7 +20,7 @@
 class BazelWindowsTest(test_base.TestBase):
 
   def createProjectFiles(self):
-    self.ScratchFile('WORKSPACE')
+    self.CreateWorkspaceWithDefaultRepos('WORKSPACE')
     self.ScratchFile('foo/BUILD', ['cc_binary(name="x", srcs=["x.cc"])'])
     self.ScratchFile('foo/x.cc', [
         '#include <stdio.h>',
@@ -63,7 +63,7 @@
         os.path.exists(os.path.join(bazel_bin, 'foo\\_objs\\x\\x.obj.params')))
 
   def testWindowsCompilesAssembly(self):
-    self.ScratchFile('WORKSPACE')
+    self.CreateWorkspaceWithDefaultRepos('WORKSPACE')
     exit_code, stdout, stderr = self.RunBazel(['info', 'bazel-bin'])
     self.AssertExitCode(exit_code, 0, stderr)
     bazel_bin = stdout[0]
@@ -121,10 +121,13 @@
 
   def testWindowsEnvironmentVariablesSetting(self):
     self.ScratchFile('BUILD')
-    self.ScratchFile('WORKSPACE', [
+    rule_definition = [
+        'load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")',
         'load(":repo.bzl", "my_repo")',
         'my_repo(name = "env_test")',
-    ])
+    ]
+    rule_definition.extend(self.GetDefaultRepoRules())
+    self.ScratchFile('WORKSPACE', rule_definition)
     self.ScratchFile('repo.bzl', [
         'def my_repo_impl(repository_ctx):',
         '  repository_ctx.file("env.bat", "set FOO\\n")',
@@ -152,7 +155,7 @@
     self.assertIn('foo=bar3', result_in_lower_case)
 
   def testRunPowershellInAction(self):
-    self.ScratchFile('WORKSPACE')
+    self.CreateWorkspaceWithDefaultRepos('WORKSPACE')
     self.ScratchFile('BUILD', [
         'load(":execute.bzl", "run_powershell")',
         'run_powershell(name = "powershell_test", out = "out.txt")',
@@ -190,7 +193,7 @@
     self.AssertExitCode(exit_code, 0, stderr)
 
   def testAnalyzeCcRuleWithoutVCInstalled(self):
-    self.ScratchFile('WORKSPACE')
+    self.CreateWorkspaceWithDefaultRepos('WORKSPACE')
     self.ScratchFile('BUILD', [
         'cc_binary(',
         '  name = "bin",',
@@ -215,7 +218,7 @@
     self.AssertExitCode(exit_code, 0, stderr)
 
   def testBuildNonCcRuleWithoutVCInstalled(self):
-    self.ScratchFile('WORKSPACE')
+    self.CreateWorkspaceWithDefaultRepos('WORKSPACE')
     self.ScratchFile('BUILD', [
         'genrule(',
         '  name="gen",',
diff --git a/src/test/py/bazel/cc_import_test.py b/src/test/py/bazel/cc_import_test.py
index b204799..843773f 100644
--- a/src/test/py/bazel/cc_import_test.py
+++ b/src/test/py/bazel/cc_import_test.py
@@ -26,7 +26,7 @@
                          system_provided=0,
                          linkstatic=1,
                          provide_header=True):
-    self.ScratchFile('WORKSPACE')
+    self.CreateWorkspaceWithDefaultRepos('WORKSPACE')
 
     # We use the outputs of cc_binary and cc_library as precompiled
     # libraries for cc_import
diff --git a/src/test/py/bazel/first_time_use_test.py b/src/test/py/bazel/first_time_use_test.py
index 5710744..3d05f3b 100644
--- a/src/test/py/bazel/first_time_use_test.py
+++ b/src/test/py/bazel/first_time_use_test.py
@@ -24,7 +24,7 @@
 
   def testNoPythonRequirement(self):
     """Regression test for https://github.com/bazelbuild/bazel/issues/6463."""
-    self.ScratchFile('WORKSPACE')
+    self.CreateWorkspaceWithDefaultRepos('WORKSPACE')
     exit_code, stdout, stderr = self.RunBazel(['info', 'release'])
     self.AssertExitCode(exit_code, 0, stderr)
     for line in stdout + stderr:
@@ -49,7 +49,7 @@
 
   def testNoBashRequiredForSimpleBazelRun(self):
     """Regression test for https://github.com/bazelbuild/bazel/issues/8229."""
-    self.ScratchFile('WORKSPACE')
+    self.CreateWorkspaceWithDefaultRepos('WORKSPACE')
     self.ScratchFile('foo/BUILD', [
         'py_binary(',
         '    name = "x",'
diff --git a/src/test/py/bazel/launcher_test.py b/src/test/py/bazel/launcher_test.py
index dfab59f..41f4332 100644
--- a/src/test/py/bazel/launcher_test.py
+++ b/src/test/py/bazel/launcher_test.py
@@ -205,7 +205,7 @@
     self.assertEqual(stdout, arguments)
 
   def testJavaBinaryLauncher(self):
-    self.ScratchFile('WORKSPACE')
+    self.CreateWorkspaceWithDefaultRepos('WORKSPACE')
     self.ScratchFile('foo/BUILD', [
         'java_binary(',
         '  name = "foo",',
@@ -236,7 +236,7 @@
     self._buildJavaTargets(bazel_bin, '.exe' if self.IsWindows() else '')
 
   def testJavaBinaryArgumentPassing(self):
-    self.ScratchFile('WORKSPACE')
+    self.CreateWorkspaceWithDefaultRepos('WORKSPACE')
     self.ScratchFile('foo/BUILD', [
         'java_binary(',
         '  name = "bin",',
@@ -257,7 +257,7 @@
     self._buildAndCheckArgumentPassing('foo', 'bin')
 
   def testShBinaryLauncher(self):
-    self.ScratchFile('WORKSPACE')
+    self.CreateWorkspaceWithDefaultRepos('WORKSPACE')
     self.ScratchFile(
         'foo/BUILD',
         [
@@ -301,7 +301,7 @@
     self._buildShBinaryTargets(bazel_bin, '.exe' if self.IsWindows() else '')
 
   def testShBinaryArgumentPassing(self):
-    self.ScratchFile('WORKSPACE')
+    self.CreateWorkspaceWithDefaultRepos('WORKSPACE')
     self.ScratchFile('foo/BUILD', [
         'sh_binary(',
         '  name = "bin",',
@@ -324,7 +324,7 @@
     self._buildAndCheckArgumentPassing('foo', 'bin')
 
   def testPyBinaryLauncher(self):
-    self.ScratchFile('WORKSPACE')
+    self.CreateWorkspaceWithDefaultRepos('WORKSPACE')
     self.ScratchFile('foo/foo.bzl', [
         'def _impl(ctx):',
         '  ctx.actions.run(',
@@ -379,7 +379,7 @@
     self._buildPyTargets(bazel_bin, '.exe' if self.IsWindows() else '')
 
   def testPyBinaryArgumentPassing(self):
-    self.ScratchFile('WORKSPACE')
+    self.CreateWorkspaceWithDefaultRepos('WORKSPACE')
     self.ScratchFile('foo/BUILD', [
         'py_binary(',
         '  name = "bin",',
@@ -398,7 +398,7 @@
     # Skip this test on non-Windows platforms
     if not self.IsWindows():
       return
-    self.ScratchFile('WORKSPACE')
+    self.CreateWorkspaceWithDefaultRepos('WORKSPACE')
     self.ScratchFile('foo/BUILD', [
         'java_binary(',
         '  name = "foo",',
@@ -518,7 +518,7 @@
   def testWindowsNativeLauncherInNonEnglishPath(self):
     if not self.IsWindows():
       return
-    self.ScratchFile('WORKSPACE')
+    self.CreateWorkspaceWithDefaultRepos('WORKSPACE')
     self.ScratchFile('bin/BUILD', [
         'java_binary(',
         '  name = "bin_java",',
@@ -571,7 +571,7 @@
   def testWindowsNativeLauncherInLongPath(self):
     if not self.IsWindows():
       return
-    self.ScratchFile('WORKSPACE')
+    self.CreateWorkspaceWithDefaultRepos('WORKSPACE')
     self.ScratchFile('bin/BUILD', [
         'java_binary(',
         '  name = "bin_java",',
diff --git a/src/test/py/bazel/py_test.py b/src/test/py/bazel/py_test.py
index d2269ad..085ec2b 100644
--- a/src/test/py/bazel/py_test.py
+++ b/src/test/py/bazel/py_test.py
@@ -22,7 +22,7 @@
   """Integration tests for the Python rules of Bazel."""
 
   def createSimpleFiles(self):
-    self.ScratchFile('WORKSPACE')
+    self.CreateWorkspaceWithDefaultRepos('WORKSPACE')
 
     self.ScratchFile(
         'a/BUILD',
@@ -69,7 +69,7 @@
 class TestInitPyFiles(test_base.TestBase):
 
   def createSimpleFiles(self, create_init=True):
-    self.ScratchFile('WORKSPACE')
+    self.CreateWorkspaceWithDefaultRepos('WORKSPACE')
 
     self.ScratchFile('src/a/BUILD', [
         'py_binary(name="a", srcs=["a.py"], deps=[":b"], legacy_create_init=%s)'
diff --git a/src/test/py/bazel/test_base.py b/src/test/py/bazel/test_base.py
index a9e318f..ca6f792 100644
--- a/src/test/py/bazel/test_base.py
+++ b/src/test/py/bazel/test_base.py
@@ -115,6 +115,27 @@
         actual_exit_code, lambda x: x != not_expected_exit_code,
         '(against expectations)', stderr_lines, stdout_lines)
 
+  def CreateWorkspaceWithDefaultRepos(self, path):
+    rule_definition = [
+        'load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")'
+    ]
+    rule_definition.extend(self.GetDefaultRepoRules())
+    self.ScratchFile(path, rule_definition)
+
+  def GetDefaultRepoRules(self):
+    return self.GetCcRulesRepoRule()
+
+  def GetCcRulesRepoRule(self):
+    return [
+        'http_archive(', '    name = "rules_cc",', '    sha256 = '
+        '"36fa66d4d49debd71d05fba55c1353b522e8caef4a20f8080a3d17cdda001d89",',
+        '    strip_prefix = "rules_cc-0d5f3f2768c6ca2faca0079a997a97ce22997a0c",',
+        '    urls = [',
+        '        "https://mirror.bazel.build/github.com/bazelbuild/rules_cc/archive/0d5f3f2768c6ca2faca0079a997a97ce22997a0c.zip",',
+        '        "https://github.com/bazelbuild/rules_cc/archive/0d5f3f2768c6ca2faca0079a997a97ce22997a0c.zip",',
+        '    ],', ')'
+    ]
+
   @staticmethod
   def GetEnv(name, default=None):
     """Returns environment variable `name`.
diff --git a/src/test/py/bazel/test_wrapper_test.py b/src/test/py/bazel/test_wrapper_test.py
index 9a756d4..0e8f36f 100644
--- a/src/test/py/bazel/test_wrapper_test.py
+++ b/src/test/py/bazel/test_wrapper_test.py
@@ -33,7 +33,7 @@
     self.fail('FAIL:\n | %s\n---' % '\n | '.join(output))
 
   def _CreateMockWorkspace(self):
-    self.ScratchFile('WORKSPACE')
+    self.CreateWorkspaceWithDefaultRepos('WORKSPACE')
     self.ScratchFile('foo/BUILD', [
         'load(":native_test.bzl", "bat_test", "exe_test")',
         'bat_test(',
@@ -538,8 +538,13 @@
   # has this bug, but I (@laszlocsomor) work on enabling the native test wrapper
   # by default so fixing the legacy one seems to make little sense.
   def testRunningTestFromExternalRepo(self):
-    self.ScratchFile('WORKSPACE', ['local_repository(name = "a", path = "a")'])
-    self.ScratchFile('a/WORKSPACE')
+    rule_definition = [
+        'load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")',
+        'local_repository(name = "a", path = "a")'
+    ]
+    rule_definition.extend(self.GetDefaultRepoRules())
+    self.ScratchFile('WORKSPACE', rule_definition)
+    self.CreateWorkspaceWithDefaultRepos('a/WORKSPACE')
     self.ScratchFile('BUILD', ['py_test(name = "x", srcs = ["x.py"])'])
     self.ScratchFile('a/BUILD', ['py_test(name = "x", srcs = ["x.py"])'])
     self.ScratchFile('x.py')
diff --git a/src/test/py/bazel/testdata/runfiles_test/WORKSPACE.mock b/src/test/py/bazel/testdata/runfiles_test/WORKSPACE.mock
index e7c8745..d27ab8f 100644
--- a/src/test/py/bazel/testdata/runfiles_test/WORKSPACE.mock
+++ b/src/test/py/bazel/testdata/runfiles_test/WORKSPACE.mock
@@ -1 +1,13 @@
 workspace(name = "foo_ws")
+
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
+http_archive(
+  name = "rules_cc",
+  sha256 = "36fa66d4d49debd71d05fba55c1353b522e8caef4a20f8080a3d17cdda001d89",
+  strip_prefix = "rules_cc-0d5f3f2768c6ca2faca0079a997a97ce22997a0c",
+  urls = [
+      "https://mirror.bazel.build/github.com/bazelbuild/rules_cc/archive/0d5f3f2768c6ca2faca0079a997a97ce22997a0c.zip",
+      "https://github.com/bazelbuild/rules_cc/archive/0d5f3f2768c6ca2faca0079a997a97ce22997a0c.zip",
+  ],
+)
diff --git a/src/test/py/bazel/windows_remote_test.py b/src/test/py/bazel/windows_remote_test.py
index a378f65..a067c66 100644
--- a/src/test/py/bazel/windows_remote_test.py
+++ b/src/test/py/bazel/windows_remote_test.py
@@ -52,7 +52,7 @@
   # this means the runfiles manifest, which is not present remotely, must exist
   # locally.
   def testBinaryRunsLocally(self):
-    self.ScratchFile('WORKSPACE')
+    self.CreateWorkspaceWithDefaultRepos('WORKSPACE')
     self.ScratchFile('foo/BUILD', [
         'sh_binary(',
         '  name = "foo",',
@@ -84,7 +84,7 @@
     self.assertEqual(stdout, ['hello shell'])
 
   def testShTestRunsLocally(self):
-    self.ScratchFile('WORKSPACE')
+    self.CreateWorkspaceWithDefaultRepos('WORKSPACE')
     self.ScratchFile('foo/BUILD', [
         'sh_test(',
         '  name = "foo_test",',
@@ -114,7 +114,7 @@
 
   # Remotely, the runfiles manifest does not exist.
   def testShTestRunsRemotely(self):
-    self.ScratchFile('WORKSPACE')
+    self.CreateWorkspaceWithDefaultRepos('WORKSPACE')
     self.ScratchFile('foo/BUILD', [
         'sh_test(',
         '  name = "foo_test",',
@@ -141,7 +141,7 @@
   # The Java launcher uses Rlocation which has differing behavior for local and
   # remote.
   def testJavaTestRunsRemotely(self):
-    self.ScratchFile('WORKSPACE')
+    self.CreateWorkspaceWithDefaultRepos('WORKSPACE')
     self.ScratchFile('foo/BUILD', [
         'java_test(',
         '  name = "foo_test",',
@@ -174,7 +174,7 @@
   # test.
   def testJavaTestWithRuntimeRunsRemotely(self):
     java_home = os.getenv('JAVA_HOME', 'c:/openjdk')
-    self.ScratchFile('WORKSPACE')
+    self.CreateWorkspaceWithDefaultRepos('WORKSPACE')
     self.ScratchFile('foo/BUILD', [
         'package(default_visibility = ["//visibility:public"])',
         'java_test(',
@@ -212,7 +212,7 @@
   # for genrule tool launchers, so the runfiles directory is discovered based on
   # the executable path.
   def testGenruleWithToolRunsRemotely(self):
-    self.ScratchFile('WORKSPACE')
+    self.CreateWorkspaceWithDefaultRepos('WORKSPACE')
     # TODO(jsharpe): Replace sh_binary with py_binary once
     # https://github.com/bazelbuild/bazel/issues/5087 resolved.
     self.ScratchFile('foo/BUILD', [
diff --git a/src/test/shell/bazel/BUILD b/src/test/shell/bazel/BUILD
index 559c742..6675f7458 100644
--- a/src/test/shell/bazel/BUILD
+++ b/src/test/shell/bazel/BUILD
@@ -374,6 +374,15 @@
 )
 
 sh_test(
+    name = "bazel_rules_cc_test",
+    srcs = ["bazel_rules_cc_test.sh"],
+    data = [
+        ":test-deps",
+        "@bazel_tools//tools/bash/runfiles",
+    ],
+)
+
+sh_test(
     name = "bazel_test_test",
     timeout = "long",
     srcs = ["bazel_test_test.sh"],
diff --git a/src/test/shell/bazel/android/android_sdk_integration_test.sh b/src/test/shell/bazel/android/android_sdk_integration_test.sh
index 27f1905..56231a1 100755
--- a/src/test/shell/bazel/android/android_sdk_integration_test.sh
+++ b/src/test/shell/bazel/android/android_sdk_integration_test.sh
@@ -38,7 +38,8 @@
   setup_android_sdk_support
   # Overwrite WORKSPACE that was created by setup_android_sdk_support with one
   # that does not set the path attribute of android_sdk_repository.
-  cat > WORKSPACE <<EOF
+  rm WORKSPACE
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 android_sdk_repository(
     name = "androidsdk",
 )
@@ -50,7 +51,7 @@
 
 function test_android_sdk_repository_no_path_or_android_home() {
   create_new_workspace
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 android_sdk_repository(
     name = "androidsdk",
     api_level = 25,
@@ -63,7 +64,7 @@
 function test_android_sdk_repository_wrong_path() {
   create_new_workspace
   mkdir "$TEST_SRCDIR/some_dir"
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 android_sdk_repository(
     name = "androidsdk",
     api_level = 25,
@@ -80,7 +81,7 @@
   create_new_workspace
   setup_android_sdk_support
   create_android_binary
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 android_sdk_repository(
     name = "a",
 )
diff --git a/src/test/shell/bazel/bazel_embedded_skylark_test.sh b/src/test/shell/bazel/bazel_embedded_skylark_test.sh
index df96046..8bff2ef 100755
--- a/src/test/shell/bazel/bazel_embedded_skylark_test.sh
+++ b/src/test/shell/bazel/bazel_embedded_skylark_test.sh
@@ -42,7 +42,7 @@
   rm -rf main
   mkdir main
   cd main
-  touch WORKSPACE
+  create_workspace_with_default_repos WORKSPACE
   echo Hello World > foo.txt
   echo Hello World, again > bar.txt
   cat > BUILD <<'EOF'
@@ -65,7 +65,7 @@
   rm -rf main out
   mkdir main
   cd main
-  touch WORKSPACE
+  create_workspace_with_default_repos WORKSPACE
   mkdir data
   echo 'with equal' > data/'foo=bar'
   echo 'like an option' > data/--foo
@@ -94,7 +94,7 @@
   rm -rf main out
   mkdir main
   cd main
-  touch WORKSPACE
+  create_workspace_with_default_repos WORKSPACE
   cat > BUILD <<'EOF'
 load(":apple.bzl", "create_banana_directory")
 
@@ -148,7 +148,7 @@
   EXTREPODIR=`pwd`
   mkdir main
   cd main
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
   name="ext",
@@ -191,7 +191,7 @@
 
   mkdir main
   cd main
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:git.bzl", "new_git_repository")
 new_git_repository(
   name="ext",
diff --git a/src/test/shell/bazel/bazel_example_test.sh b/src/test/shell/bazel/bazel_example_test.sh
index 1bf5339..c8516ed 100755
--- a/src/test/shell/bazel/bazel_example_test.sh
+++ b/src/test/shell/bazel/bazel_example_test.sh
@@ -54,6 +54,7 @@
   cat > WORKSPACE <<EOF
 workspace(name = "io_bazel")
 EOF
+  add_rules_cc_to_workspace WORKSPACE
 }
 
 #
diff --git a/src/test/shell/bazel/bazel_java_tools_test.sh b/src/test/shell/bazel/bazel_java_tools_test.sh
index 75584d4..28c026a 100755
--- a/src/test/shell/bazel/bazel_java_tools_test.sh
+++ b/src/test/shell/bazel/bazel_java_tools_test.sh
@@ -179,7 +179,7 @@
   if "$is_windows"; then
         java_tools_zip_file_url="file:///${java_tools_rlocation}"
   fi
-  cat >WORKSPACE <<EOF
+  cat > WORKSPACE <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
     name = "local_java_tools",
diff --git a/src/test/shell/bazel/bazel_repository_cache_test.sh b/src/test/shell/bazel/bazel_repository_cache_test.sh
index fdc031f..076bd33 100755
--- a/src/test/shell/bazel/bazel_repository_cache_test.sh
+++ b/src/test/shell/bazel/bazel_repository_cache_test.sh
@@ -38,7 +38,8 @@
 
   # Test with the extension
   serve_file $repo2_zip
-  cat > WORKSPACE <<EOF
+  rm WORKSPACE
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
 http_archive(
@@ -57,7 +58,7 @@
 
   zip_file="${server_dir}/zip_file.zip"
 
-  touch "${server_dir}"/WORKSPACE
+  create_workspace_with_default_repos "${server_dir}"/WORKSPACE
   echo "some content" > "${server_dir}"/file
   zip -0 -ry $zip_file "${server_dir}"/WORKSPACE "${server_dir}"/file >& $TEST_log
 
@@ -66,7 +67,7 @@
   # Start HTTP server with Python
   startup_server "${server_dir}"
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load('//:test.bzl', 'repo')
 repo(name = 'foo')
 EOF
@@ -96,7 +97,7 @@
 
   serve_artifact com.example.carnivore carnivore 1.23
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 maven_jar(
     name = 'endangered',
     artifact = "com.example.carnivore:carnivore:1.23",
@@ -166,7 +167,7 @@
   mkdir -p zoo
 
   if [[ $write_workspace = 0 ]]; then
-    cat > WORKSPACE <<EOF
+    cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
 http_archive(
@@ -286,7 +287,8 @@
   setup_repository
 
   # Have a WORKSPACE file without the specified sha256
-  cat > WORKSPACE <<EOF
+  rm WORKSPACE
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
 http_archive(
@@ -312,7 +314,8 @@
     && fail "expected failure" || :
 
   # However, if we add the hash, the value is taken from cache
-  cat > WORKSPACE <<EOF
+  rm WORKSPACE
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
 http_archive(
diff --git a/src/test/shell/bazel/bazel_rules_cc_test.sh b/src/test/shell/bazel/bazel_rules_cc_test.sh
new file mode 100755
index 0000000..00e83e0
--- /dev/null
+++ b/src/test/shell/bazel/bazel_rules_cc_test.sh
@@ -0,0 +1,87 @@
+#!/bin/bash
+#
+# Copyright 2019 The Bazel Authors. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# Tests the examples provided in Bazel
+#
+
+# --- begin runfiles.bash initialization ---
+if [[ ! -d "${RUNFILES_DIR:-/dev/null}" && ! -f "${RUNFILES_MANIFEST_FILE:-/dev/null}" ]]; then
+    if [[ -f "$0.runfiles_manifest" ]]; then
+      export RUNFILES_MANIFEST_FILE="$0.runfiles_manifest"
+    elif [[ -f "$0.runfiles/MANIFEST" ]]; then
+      export RUNFILES_MANIFEST_FILE="$0.runfiles/MANIFEST"
+    elif [[ -f "$0.runfiles/bazel_tools/tools/bash/runfiles/runfiles.bash" ]]; then
+      export RUNFILES_DIR="$0.runfiles"
+    fi
+fi
+if [[ -f "${RUNFILES_DIR:-/dev/null}/bazel_tools/tools/bash/runfiles/runfiles.bash" ]]; then
+  source "${RUNFILES_DIR}/bazel_tools/tools/bash/runfiles/runfiles.bash"
+elif [[ -f "${RUNFILES_MANIFEST_FILE:-/dev/null}" ]]; then
+  source "$(grep -m1 "^bazel_tools/tools/bash/runfiles/runfiles.bash " \
+            "$RUNFILES_MANIFEST_FILE" | cut -d ' ' -f 2-)"
+else
+  echo >&2 "ERROR: cannot find @bazel_tools//tools/bash/runfiles:runfiles.bash"
+  exit 1
+fi
+# --- end runfiles.bash initialization ---
+
+source "$(rlocation "io_bazel/src/test/shell/integration_test_setup.sh")" \
+  || { echo "integration_test_setup.sh not found!" >&2; exit 1; }
+
+case "$(uname -s | tr [:upper:] [:lower:])" in
+msys*|mingw*|cygwin*)
+  declare -r is_windows=true
+  ;;
+*)
+  declare -r is_windows=false
+  ;;
+esac
+
+if "$is_windows"; then
+  export MSYS_NO_PATHCONV=1
+  export MSYS2_ARG_CONV_EXCL="*"
+fi
+
+function test_rules_cc_can_be_overridden() {
+  # We test that a custom repository can override @rules_cc in their
+  # WORKSPACE file.
+  mkdir -p rules_cc_can_be_overridden || fail "couldn't create directory"
+  touch rules_cc_can_be_overridden/BUILD || \ fail "couldn't touch BUILD file"
+  cat > rules_cc_can_be_overridden/WORKSPACE <<EOF
+local_repository(
+  name = 'rules_cc',
+  path = '../override',
+)
+EOF
+
+  mkdir -p override || fail "couldn't create override directory"
+  touch override/WORKSPACE || fail "couldn't touch override/WORKSPACE"
+  cat > override/BUILD <<EOF
+filegroup(name = 'yolo')
+EOF
+
+  cd rules_cc_can_be_overridden || fail "couldn't cd into workspace"
+  bazel build @rules_cc//:yolo &> $TEST_log || \
+    fail "Bazel failed to build @rules_cc"
+}
+
+function test_rules_cc_repository_builds_itself() {
+  # We test that a built-in @rules_cc repository is buildable.
+  bazel build @rules_cc//cc/... &> $TEST_log \
+      || fail "Build failed unexpectedly"
+}
+
+run_suite "rules_cc tests"
diff --git a/src/test/shell/bazel/bazel_rules_test.sh b/src/test/shell/bazel/bazel_rules_test.sh
index a129030..ca94833 100755
--- a/src/test/shell/bazel/bazel_rules_test.sh
+++ b/src/test/shell/bazel/bazel_rules_test.sh
@@ -324,7 +324,7 @@
 }
 
 function test_genrule_remote() {
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 local_repository(
     name = "r",
     path = __workspace_dir__,
@@ -355,7 +355,7 @@
 }
 
 function test_genrule_remote_d() {
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 local_repository(
     name = "r",
     path = __workspace_dir__,
@@ -429,8 +429,8 @@
 
  cd ${WORKSPACE_DIR}
  mkdir -p {module1,module2}
- cat > WORKSPACE <<EOF
-workspace(name = "foobar")
+ rm WORKSPACE
+ cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 local_repository(name="remote", path="${remote_path}")
 EOF
  cat > module1/BUILD <<EOF
diff --git a/src/test/shell/bazel/bazel_sandboxing_test.sh b/src/test/shell/bazel/bazel_sandboxing_test.sh
index 93f096e..959c821 100755
--- a/src/test/shell/bazel/bazel_sandboxing_test.sh
+++ b/src/test/shell/bazel/bazel_sandboxing_test.sh
@@ -598,7 +598,7 @@
 }
 
 function test_experimental_symlinked_sandbox_uses_expanded_tree_artifacts_in_runfiles_tree() {
-  touch WORKSPACE
+  create_workspace_with_default_repos WORKSPACE
 
   cat > def.bzl <<'EOF'
 def _mkdata_impl(ctx):
@@ -657,7 +657,7 @@
 
 # regression test for https://github.com/bazelbuild/bazel/issues/6262
 function test_create_tree_artifact_inputs() {
-  touch WORKSPACE
+  create_workspace_with_default_repos WORKSPACE
 
   cat > def.bzl <<'EOF'
 def _r(ctx):
diff --git a/src/test/shell/bazel/bazel_test_test.sh b/src/test/shell/bazel/bazel_test_test.sh
index 30ce4f3..4cc34be 100755
--- a/src/test/shell/bazel/bazel_test_test.sh
+++ b/src/test/shell/bazel/bazel_test_test.sh
@@ -122,6 +122,7 @@
   cat > WORKSPACE <<EOF
 workspace(name = "bar")
 EOF
+  add_rules_cc_to_workspace WORKSPACE
   mkdir -p foo
   cat > foo/testenv.sh <<'EOF'
 #!/bin/sh
@@ -525,9 +526,7 @@
 
 function test_detailed_test_summary() {
   copy_examples
-  cat > WORKSPACE <<EOF
-workspace(name = "io_bazel")
-EOF
+  create_workspace_with_default_repos WORKSPACE
   setup_javatest_support
 
   local java_native_tests=//examples/java-native/src/test/java/com/example/myproject
diff --git a/src/test/shell/bazel/bazel_toolchain_test.sh b/src/test/shell/bazel/bazel_toolchain_test.sh
index 70fe5d5..a4ecdf8 100755
--- a/src/test/shell/bazel/bazel_toolchain_test.sh
+++ b/src/test/shell/bazel/bazel_toolchain_test.sh
@@ -42,6 +42,7 @@
 # (Did not include the file WORKSPACE in the test because source tree under
 # directories that contain this file is not parsed)
 mv WORKSPACE.linaro WORKSPACE
+create_workspace_with_default_repos WORKSPACE
 
 # Rename BUILD.linaro files
 for i in $(find . -name BUILD.linaro); do
diff --git a/src/test/shell/bazel/bazel_windows_example_test.sh b/src/test/shell/bazel/bazel_windows_example_test.sh
index 5a9736e..fff045a 100755
--- a/src/test/shell/bazel/bazel_windows_example_test.sh
+++ b/src/test/shell/bazel/bazel_windows_example_test.sh
@@ -309,7 +309,6 @@
 
 function test_python_test_with_data() {
   touch BUILD
-  touch WORKSPACE
 
   mkdir data
   cat >data/BUILD <<EOF
diff --git a/src/test/shell/bazel/bazelignore_test.sh b/src/test/shell/bazel/bazelignore_test.sh
index abd575b..a294a38 100755
--- a/src/test/shell/bazel/bazelignore_test.sh
+++ b/src/test/shell/bazel/bazelignore_test.sh
@@ -27,7 +27,7 @@
 
 test_broken_BUILD_files_ignored() {
     rm -rf work && mkdir work && cd work
-    touch WORKSPACE
+    create_workspace_with_default_repos WORKSPACE
     mkdir -p ignoreme/deep/reallydep/stillignoreme
     echo This is a broken BUILD file > ignoreme/BUILD
     echo This is a broken BUILD file > ignoreme/deep/BUILD
@@ -44,7 +44,7 @@
 
 test_symlink_loop_ignored() {
     rm -rf work && mkdir work && cd work
-    touch WORKSPACE
+    create_workspace_with_default_repos WORKSPACE
     mkdir -p ignoreme/deep
     (cd ignoreme/deep && ln -s . loop)
     touch BUILD
@@ -58,7 +58,7 @@
 
 test_build_specific_target() {
     rm -rf work && mkdir work && cd work
-    touch WORKSPACE
+    create_workspace_with_default_repos WORKSPACE
     mkdir -p ignoreme
     echo Not a valid BUILD file > ignoreme/BUILD
     mkdir -p foo/bar
@@ -75,7 +75,7 @@
 
 test_aquery_specific_target() {
     rm -rf work && mkdir work && cd work
-    touch WORKSPACE
+    create_workspace_with_default_repos WORKSPACE
     mkdir -p foo/ignoreme
     cat > foo/ignoreme/BUILD <<'EOI'
 genrule(
diff --git a/src/test/shell/bazel/cc_integration_test.sh b/src/test/shell/bazel/cc_integration_test.sh
index 5b21c80..71f717e 100755
--- a/src/test/shell/bazel/cc_integration_test.sh
+++ b/src/test/shell/bazel/cc_integration_test.sh
@@ -50,7 +50,7 @@
 function test_cc_library_include_prefix_external_repository() {
   r="$TEST_TMPDIR/r"
   mkdir -p "$TEST_TMPDIR/r/foo/v1"
-  touch "$TEST_TMPDIR/r/WORKSPACE"
+  create_workspace_with_default_repos "$TEST_TMPDIR/r/WORKSPACE"
   echo "#define FOO 42" > "$TEST_TMPDIR/r/foo/v1/foo.h"
   cat > "$TEST_TMPDIR/r/foo/BUILD" <<EOF
 cc_library(
@@ -61,8 +61,7 @@
   visibility = ["//visibility:public"],
 )
 EOF
-
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 local_repository(
   name = "foo",
   path = "$TEST_TMPDIR/r",
@@ -281,7 +280,7 @@
 function setup_cc_starlark_api_test() {
   local pkg="$1"
 
-  touch "$pkg"/WORKSPACE
+  create_workspace_with_default_repos "$pkg"/WORKSPACE
 
   mkdir "$pkg"/include_dir
   touch "$pkg"/include_dir/include.h
@@ -600,6 +599,4 @@
   bazel-bin/"$pkg"/g | grep a1a2bcddcb2a1a || fail "output is incorrect"
 }
 
-
-
-run_suite "cc_integration_test"
\ No newline at end of file
+run_suite "cc_integration_test"
diff --git a/src/test/shell/bazel/client_test.sh b/src/test/shell/bazel/client_test.sh
index ff8b7a3..23e6540 100755
--- a/src/test/shell/bazel/client_test.sh
+++ b/src/test/shell/bazel/client_test.sh
@@ -40,7 +40,7 @@
 function test_server_process_name_has_workspace_name() {
   mkdir foobarspace
   cd foobarspace
-  touch WORKSPACE BUILD
+  create_workspace_with_default_repos WORKSPACE
   ps -o cmd= "$(bazel info server_pid)" &>"$TEST_log"
   expect_log "^bazel(foobarspace)"
   bazel shutdown
diff --git a/src/test/shell/bazel/disk_cache_test.sh b/src/test/shell/bazel/disk_cache_test.sh
index a7598f2..3031340 100755
--- a/src/test/shell/bazel/disk_cache_test.sh
+++ b/src/test/shell/bazel/disk_cache_test.sh
@@ -32,7 +32,7 @@
   rm -rf $cache
   mkdir $cache
 
-  touch WORKSPACE
+  create_workspace_with_default_repos WORKSPACE
   # No sandboxing, side effect is needed to detect action execution
   cat > BUILD <<EOF
 genrule(
diff --git a/src/test/shell/bazel/empty_package.sh b/src/test/shell/bazel/empty_package.sh
index 867fb01..3a1268c 100755
--- a/src/test/shell/bazel/empty_package.sh
+++ b/src/test/shell/bazel/empty_package.sh
@@ -47,7 +47,7 @@
 function test_empty_external() {
   mkdir foo
   cd foo
-  touch WORKSPACE
+  create_workspace_with_default_repos WORKSPACE
   # Create a dummy BUILD file, otherwise `bazel build` will complain that there
   # were no targets to build.
   cat > BUILD <<EOF
diff --git a/src/test/shell/bazel/external_integration_test.sh b/src/test/shell/bazel/external_integration_test.sh
index 8c52b22..069dde5 100755
--- a/src/test/shell/bazel/external_integration_test.sh
+++ b/src/test/shell/bazel/external_integration_test.sh
@@ -94,7 +94,7 @@
     rm -rf $repo2
     mkdir -p $repo2/fox
     cd $repo2
-    touch WORKSPACE
+    create_workspace_with_default_repos WORKSPACE
     cat > fox/BUILD <<EOF
 filegroup(
     name = "fox",
@@ -122,8 +122,7 @@
 
   cd ${WORKSPACE_DIR}
   if [[ $write_workspace = 0 ]]; then
-    cat > WORKSPACE <<EOF
-load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+    cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 http_archive(
     name = 'endangered',
     url = 'http://127.0.0.1:$nc_port/$repo2_name',
@@ -181,7 +180,7 @@
 
   # Test with the extension
   serve_file $repo2_zip
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
     name = 'endangered',
@@ -207,7 +206,7 @@
 }
 
 function test_http_archive_no_server() {
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(name = 'endangered', url = 'http://bad.example/repo.zip',
     sha256 = '2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9826')
@@ -237,14 +236,14 @@
   rm -rf $repo2
   mkdir -p $repo2
   cd $repo2
-  touch WORKSPACE
+  create_workspace_with_default_repos WORKSPACE
   repo2_zip=$TEST_TMPDIR/fox.zip
   zip -r $repo2_zip WORKSPACE
   serve_file $repo2_zip
   wrong_sha256=0000000000000000000000000000000000000000
 
   cd ${WORKSPACE_DIR}
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
     name = 'endangered',
@@ -309,7 +308,7 @@
 function test_jar_download() {
   serve_jar
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_jar")
 http_jar(name = 'endangered', url = 'http://127.0.0.1:$nc_port/lib.jar')
 EOF
@@ -343,7 +342,7 @@
   serve_redirect https://127.0.0.1:123456789/bad-port-shouldnt-work
 
   cd ${WORKSPACE_DIR}
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_file")
 http_file(
     name = 'toto',
@@ -362,7 +361,7 @@
   serve_not_found "Help, I'm lost!"
 
   cd ${WORKSPACE_DIR}
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_file")
 http_file(
     name = 'toto',
@@ -386,7 +385,7 @@
   serve_file $test_file
   cd ${WORKSPACE_DIR}
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_file")
 http_file(name = 'toto', urls = ['http://127.0.0.1:$nc_port/toto'],
     sha256 = '$sha256', executable = True)
@@ -417,7 +416,7 @@
   serve_timeout
 
   cd ${WORKSPACE_DIR}
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_file")
 http_file(
     name = 'toto',
@@ -443,7 +442,7 @@
   cd ${WORKSPACE_DIR}
   serve_redirect "http://127.0.0.1:$nc_port/toto"
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_file")
 http_file(name = 'toto', urls = ['http://127.0.0.1:$redirect_port/toto'],
     sha256 = '$sha256')
@@ -477,7 +476,7 @@
   local sha256=$(sha256sum x.tar.gz | cut -f 1 -d ' ')
   serve_file x.tar.gz
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
     name = "x",
@@ -568,7 +567,7 @@
     workspace_file_attr="workspace_file_content = 'workspace(name=\"endangered-fox\")'"
   fi
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
     name = 'endangered',
@@ -603,7 +602,7 @@
 function test_fetch() {
   serve_jar
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 maven_jar(
     name = 'endangered',
     artifact = "com.example.carnivore:carnivore:1.23",
@@ -642,7 +641,7 @@
   local sha256=$(sha256sum x.tar.gz | cut -f 1 -d ' ')
   serve_file x.tar.gz
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
     name = "x",
@@ -673,7 +672,7 @@
   local sha256=$(sha256sum x.zip | cut -f 1 -d ' ')
   serve_file x.zip
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
     name = "x",
@@ -713,7 +712,7 @@
   local sha256=$(sha256sum x.zip | cut -f 1 -d ' ')
   serve_file x.zip
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
     name = "x",
@@ -733,7 +732,7 @@
   local sha256=$(sha256sum x.tar.gz | cut -f 1 -d ' ')
   serve_file x.tar.gz
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
     name = "x",
@@ -770,7 +769,7 @@
   local sha256=$(sha256sum x.tar.gz | cut -f 1 -d ' ')
   serve_file x.tar.gz
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
     name = "x",
@@ -823,7 +822,7 @@
 }
 
 function test_use_bind_as_repository() {
-  cat > WORKSPACE <<'EOF'
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<'EOF'
 local_repository(name = 'foobar', path = 'foo')
 bind(name = 'foo', actual = '@foobar//:test')
 EOF
@@ -847,7 +846,8 @@
   REPO_PATH=$TEST_TMPDIR/repo
   mkdir -p "$REPO_PATH"
   cd "$REPO_PATH"
-  touch WORKSPACE BUILD foo
+  create_workspace_with_default_repos WORKSPACE
+  touch BUILD foo
   zip -r repo.zip *
   startup_server $PWD
   # Make the remote repo and local repo slightly different.
@@ -887,12 +887,12 @@
   REPO_PATH=$TEST_TMPDIR/repo
   mkdir -p "$REPO_PATH"
   cd "$REPO_PATH"
-  touch WORKSPACE BUILD foo
+  create_workspace_with_default_repos WORKSPACE
   zip -r repo.zip *
   startup_server $PWD
   cd -
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
     name = "repo",
@@ -909,12 +909,12 @@
   REPO_PATH=$TEST_TMPDIR/repo
   mkdir -p "$REPO_PATH"
   cd "$REPO_PATH"
-  touch WORKSPACE BUILD foo
+  create_workspace_with_default_repos WORKSPACE
   zip -r repo.zip *
   startup_server $PWD
   cd -
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
     name = "repo",
@@ -940,7 +940,7 @@
   rm -rf main
   mkdir main
   cd main
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
   name="ext",
@@ -973,7 +973,7 @@
   rm -rf main
   mkdir main
   cd main
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
   name="ext",
@@ -1032,7 +1032,7 @@
   rm -rf main
   mkdir main
   cd main
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
   name="ext",
@@ -1045,7 +1045,7 @@
 }
 
 function test_failing_fetch_with_keep_going() {
-  touch WORKSPACE
+  create_workspace_with_default_repos WORKSPACE
   cat > BUILD <<'EOF'
 package(default_visibility = ["//visibility:public"])
 
@@ -1087,7 +1087,7 @@
   rm -rf main
   mkdir main
   cd main
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
   name="ext",
@@ -1138,7 +1138,7 @@
   rm -rf main
   mkdir main
   cd main
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
   name="ext",
@@ -1166,7 +1166,7 @@
   bazel clean --expunge
   # Even with a different source URL, the cache should be consulted.
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
   name="ext",
@@ -1209,7 +1209,7 @@
   rm -rf main
   mkdir main
   cd main
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
   name="ext",
@@ -1233,7 +1233,7 @@
   bazel clean --expunge
   # Even with a different source URL, the cache should be consulted.
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
   name="ext",
@@ -1267,7 +1267,7 @@
   rm -rf main
   mkdir main
   cd main
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
   name="ext",
@@ -1306,7 +1306,7 @@
 
   mkdir main
   cd main
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
   name="ext",
@@ -1367,7 +1367,7 @@
   rm -rf main
   mkdir main
   cd main
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
   name="ext",
@@ -1426,7 +1426,7 @@
   rm -rf main
   mkdir main
   cd main
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
   name="ext",
@@ -1454,7 +1454,7 @@
   bazel clean --expunge
   # Even with a different source URL, the cache should be consulted.
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
   name="ext",
@@ -1489,7 +1489,7 @@
 
   mkdir main
   cd main
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 load("//:rule.bzl", "probe")
 
@@ -1680,7 +1680,7 @@
 
   mkdir main
   cd main
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
   name="ext",
@@ -1724,7 +1724,7 @@
 
   mkdir main
   cd main
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
   name="ext",
@@ -1768,7 +1768,7 @@
 
   mkdir main
   cd main
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
   name="ext",
@@ -1805,7 +1805,7 @@
 
   mkdir main
   cd main
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
   name="ext",
@@ -1850,7 +1850,7 @@
 
   mkdir main
   cd main
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
   name="ext",
@@ -1894,7 +1894,7 @@
 
   mkdir main
   cd main
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
   name="ext",
@@ -1939,7 +1939,7 @@
 )
 EOF
 
-  cat > WORKSPACE <<'EOF'
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<'EOF'
 load("//:rule.bzl", "with_progress")
 with_progress(name="foo")
 EOF
@@ -1967,7 +1967,7 @@
 
   mkdir main
   cd main
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
   name = "ext",
@@ -2004,7 +2004,7 @@
 
   mkdir main
   cd main
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
   name="ext",
@@ -2037,7 +2037,7 @@
 
   mkdir main
   cd main
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
   name="ext",
@@ -2068,7 +2068,7 @@
 
   mkdir main
   cd main
-  cat > WORKSPACE <<'EOF'
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<'EOF'
 load("@nonexistent//path/to/package:file/to/import.bzl", "foo")
 foo()
 EOF
@@ -2092,7 +2092,7 @@
 
   mkdir -p path/to/workspace
   cd path/to/workspace
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
   name="ext",
@@ -2124,7 +2124,7 @@
 
   mkdir -p path/to/workspace
   cd path/to/workspace
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
   name="ext",
@@ -2158,7 +2158,7 @@
   mkdir -p path/to/main
   cd path/to/main
   touch BUILD
-  cat > WORKSPACE <<'EOF'
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<'EOF'
 load("//:repos.bzl", "repos")
 repos()
 EOF
@@ -2292,7 +2292,7 @@
 )
 EOF
   touch BUILD
-  cat > WORKSPACE <<'EOF'
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<'EOF'
 load("//:withimplicit.bzl", "data_repo")
 
 data_repo(
diff --git a/src/test/shell/bazel/external_path_test.sh b/src/test/shell/bazel/external_path_test.sh
index 735c68c..c17c233 100755
--- a/src/test/shell/bazel/external_path_test.sh
+++ b/src/test/shell/bazel/external_path_test.sh
@@ -29,7 +29,7 @@
   # Generate a repository, in the current working directory, with a target
   # //src:hello that includes a file via a local path.
 
-  touch WORKSPACE
+  create_workspace_with_default_repos WORKSPACE
   mkdir src
   cat > src/main.c <<'EOF'
 #include <stdio.h>
@@ -57,7 +57,7 @@
   # is a library with headers that include via paths relative to the root of
   # that repository
 
-  touch WORKSPACE
+  create_workspace_with_default_repos WORKSPACE
   mkdir lib
   cat > lib/lib.h <<'EOF'
 #include "lib/constants.h"
@@ -113,7 +113,7 @@
 
   mkdir main
   cd main
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
   name="remote",
@@ -140,7 +140,7 @@
   cd main
   library_with_local_include
 
-  touch WORKSPACE
+  create_workspace_with_default_repos WORKSPACE
   cat > main.c <<'EOF'
 #include "lib/lib.h"
 
@@ -178,7 +178,7 @@
 
   mkdir main
   cd main
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
   name="remote",
@@ -244,7 +244,7 @@
 
   mkdir main
   cd main
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
   name="remotelib",
@@ -293,7 +293,7 @@
 
   mkdir main
   cd main
-  touch WORKSPACE
+  create_workspace_with_default_repos WORKSPACE
   repo_with_local_path_reference
 
   bazel build //withpath:it || fail "Expected success"
@@ -312,7 +312,7 @@
 
   mkdir main
   cd main
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
   name="remote",
@@ -366,7 +366,7 @@
 
   mkdir main
   cd main
-  touch WORKSPACE
+  create_workspace_with_default_repos WORKSPACE
   repo_with_local_implicit_dependencies
   mkdir call
   echo hello world > call/hello.txt
@@ -395,7 +395,7 @@
 
   mkdir main
   cd main
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
   name="r",
@@ -444,7 +444,7 @@
 
   mkdir main
   cd main
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
   name="a",
@@ -524,7 +524,7 @@
   cd "${WRKDIR}"
 
   mkdir main
-  touch WORKSPACE
+  create_workspace_with_default_repos WORKSPACE
   repo_with_embedded_paths
   mkdir call
   cat > call/plain.txt <<'EOF'
@@ -556,7 +556,7 @@
 
   mkdir main
   cd main
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
   name="r",
@@ -609,7 +609,7 @@
 
   mkdir main
   cd main
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
   name="r",
diff --git a/src/test/shell/bazel/git_repository_test.sh b/src/test/shell/bazel/git_repository_test.sh
index 59a83ce..b3ad02d 100755
--- a/src/test/shell/bazel/git_repository_test.sh
+++ b/src/test/shell/bazel/git_repository_test.sh
@@ -110,7 +110,7 @@
 
   # Create a workspace that clones the repository at the first commit.
   cd $WORKSPACE_DIR
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository")
 git_repository(
     name = "pluto",
@@ -172,7 +172,7 @@
   cd $WORKSPACE_DIR
 
   if [ "$1" == "build_file" ] ; then
-    cat > WORKSPACE <<EOF
+    cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:git.bzl", "new_git_repository")
 new_git_repository(
     name = "pluto",
@@ -181,7 +181,6 @@
     build_file = "//:pluto.BUILD",
 )
 EOF
-
   cat > BUILD <<EOF
 exports_files(['pluto.BUILD'])
 EOF
@@ -193,7 +192,7 @@
 )
 EOF
   else
-    cat > WORKSPACE <<EOF
+    cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:git.bzl", "new_git_repository")
 new_git_repository(
     name = "pluto",
@@ -257,7 +256,7 @@
 
   # Create a workspace that clones the outer_planets repository.
   cd $WORKSPACE_DIR
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:git.bzl", "new_git_repository")
 new_git_repository(
     name = "outer_planets",
@@ -314,7 +313,7 @@
   local repo_dir=$TEST_TMPDIR/repos/refetch
 
   cd $WORKSPACE_DIR
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository")
 git_repository(name='g', remote='$repo_dir', commit='22095302abaf776886879efa5129aa4d44c53017')
 EOF
@@ -328,7 +327,8 @@
   assert_contains "GIT 1" bazel-genfiles/external/g/go
 
   # Change the commit id, which should cause the checkout to be re-cloned.
-  cat > WORKSPACE <<EOF
+  rm WORKSPACE
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository")
 git_repository(name='g', remote='$repo_dir', commit='db134ae9b644d8237954a8e6f1ef80fcfd85d521')
 EOF
@@ -337,7 +337,8 @@
   assert_contains "GIT 2" bazel-genfiles/external/g/go
 
   # Change the WORKSPACE but not the commit id, which should not cause the checkout to be re-cloned.
-  cat > WORKSPACE <<EOF
+  rm WORKSPACE
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 # This comment line is to change the line numbers, which should not cause Bazel
 # to refetch the repository
 load("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository")
@@ -352,7 +353,7 @@
   local repo_dir=$TEST_TMPDIR/repos/refetch
 
   cd $WORKSPACE_DIR
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository")
 git_repository(name='g', remote='$repo_dir', commit='22095302abaf776886879efa5129aa4d44c53017')
 EOF
@@ -361,12 +362,12 @@
   assert_contains "GIT 1" bazel-genfiles/external/g/go
 
   # Change the commit id, which should cause the checkout to be re-cloned.
-  cat > WORKSPACE <<EOF
+  rm WORKSPACE
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository")
 git_repository(name='g', remote='$repo_dir', commit='db134ae9b644d8237954a8e6f1ef80fcfd85d521')
 EOF
 
-
   bazel build @g//:g >& $TEST_log || fail "Build failed"
   assert_contains "GIT 2" bazel-genfiles/external/g/go
 }
@@ -375,7 +376,7 @@
   local repo_dir=$TEST_TMPDIR/repos/refetch
 
   cd $WORKSPACE_DIR
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository")
 git_repository(name='g', remote='$repo_dir', commit='22095302abaf776886879efa5129aa4d44c53017')
 EOF
@@ -385,7 +386,8 @@
   bazel build @g//:g >& $TEST_log || fail "Build failed"
   assert_contains "GIT 1" bazel-genfiles/external/g/go
 
-  cat > WORKSPACE <<EOF
+  rm WORKSPACE
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository")
 git_repository(name='g', remote='$repo_dir', commit='db134ae9b644d8237954a8e6f1ef80fcfd85d521')
 EOF
@@ -437,7 +439,7 @@
   local commit_hash="52f9a3f87a2dd17ae0e5847bbae9734f09354afd"
 
   cd $WORKSPACE_DIR
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository")
 git_repository(
     name = "pluto",
@@ -466,7 +468,7 @@
   local pluto_repo_dir=$TEST_TMPDIR/pluto
 
   cd $WORKSPACE_DIR
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository")
 git_repository(
     name = "pluto",
diff --git a/src/test/shell/bazel/local_repository_test.sh b/src/test/shell/bazel/local_repository_test.sh
index 8c266ae..23c4f5d 100755
--- a/src/test/shell/bazel/local_repository_test.sh
+++ b/src/test/shell/bazel/local_repository_test.sh
@@ -27,7 +27,7 @@
   r=$TEST_TMPDIR/r
   rm -fr $r
   mkdir -p $r
-  touch $r/WORKSPACE
+  create_workspace_with_default_repos $r/WORKSPACE
   cat > $r/BUILD <<EOF
 filegroup(name='fg', srcs=glob(["fg/**"]), visibility=["//visibility:public"])
 EOF
@@ -36,7 +36,7 @@
   ln -s /doesnotexist $r/fg/symlink
   touch $r/fg/file
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 local_repository(name="r", path="$r")
 bind(name="e", actual="@r//:fg")
 EOF
@@ -82,7 +82,7 @@
 
   cd ${WORKSPACE_DIR}
   mkdir -p {zoo,red}
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 local_repository(name = 'pandas', path = '${repo2}')
 EOF
 
@@ -141,7 +141,7 @@
 EOF
 
   cd ${WORKSPACE_DIR}
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 local_repository(name = 'endangered', path = '$repo2')
 EOF
 
@@ -231,7 +231,7 @@
       build_file_str="//:${build_file}"
       cat > BUILD
     fi
-    cat > WORKSPACE <<EOF
+    cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 new_local_repository(
     name = 'endangered',
     path = '$project_dir',
@@ -247,7 +247,7 @@
 )
 EOF
   else
-    cat > WORKSPACE <<EOF
+    cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 new_local_repository(
     name = 'endangered',
     path = '$project_dir',
@@ -309,7 +309,7 @@
 function test_external_hdrs() {
   local external_ws=$TEST_TMPDIR/path/to/my/lib
   mkdir -p $external_ws
-  touch $external_ws/WORKSPACE
+  create_workspace_with_default_repos $external_ws/WORKSPACE
   cat > $external_ws/greet_lib.h <<EOF
 void greet();
 EOF
@@ -346,7 +346,7 @@
     deps = ["@greet_ws//:greet_lib"],
 )
 EOF
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 local_repository(
     name = "greet_ws",
     path = "$external_ws",
@@ -361,7 +361,7 @@
 function test_external_includes() {
   clib=$TEST_TMPDIR/clib
   mkdir -p $clib/include
-  touch $clib/WORKSPACE
+  create_workspace_with_default_repos $clib/WORKSPACE
   cat > $clib/include/clib.h <<EOF
 int x();
 EOF
@@ -381,7 +381,7 @@
 )
 EOF
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 local_repository(
     name = "clib_repo",
     path = "$clib",
@@ -415,8 +415,8 @@
 function test_external_query() {
   local external_dir=$TEST_TMPDIR/x
   mkdir -p $external_dir
-  touch $external_dir/WORKSPACE
-  cat > WORKSPACE <<EOF
+  create_workspace_with_default_repos $external_dir/WORKSPACE
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 local_repository(
     name = "my_repo",
     path = "$external_dir",
@@ -431,7 +431,7 @@
   mkdir a b b/b
   echo "local_repository(name='b', path='b')" > WORKSPACE
   echo "sh_library(name='a', deps=['@b//b'])" > a/BUILD
-  touch b/WORKSPACE
+  create_workspace_with_default_repos b/WORKSPACE
   echo "sh_library(name='b')" > b/b/BUILD
   bazel query --output package "deps(//a)" >& $TEST_log || fail "query failed"
   expect_log "a"
@@ -463,7 +463,7 @@
 workspace(name = "foo")
 EOF
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 new_local_repository(
     name = "bar",
     path = "$bar",
@@ -479,8 +479,8 @@
 function test_overlaid_build_file() {
   local mutant=$TEST_TMPDIR/mutant
   mkdir $mutant
-  touch $mutant/WORKSPACE
-  cat > WORKSPACE <<EOF
+  create_workspace_with_default_repos $mutant/WORKSPACE
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 new_local_repository(
     name = "mutant",
     path = "$mutant",
@@ -520,8 +520,8 @@
   local r=$TEST_TMPDIR/r
   rm -fr $r
   mkdir -p $r
-  touch $r/WORKSPACE
-  cat > WORKSPACE <<EOF
+  create_workspace_with_default_repos $r/WORKSPACE
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 local_repository(
     name = "r",
     path = "$r",
@@ -558,7 +558,7 @@
   local r=$TEST_TMPDIR/r
   rm -fr $r
   mkdir -p $r
-  touch $r/WORKSPACE
+  create_workspace_with_default_repos $r/WORKSPACE
 
   mkdir -p $r/a
   cat > $r/a/BUILD <<'EOF'
@@ -581,7 +581,7 @@
 )
 EOF
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 local_repository(
     name = "r",
     path = "$r",
@@ -595,7 +595,7 @@
   local r=$TEST_TMPDIR/r
   rm -fr $r
   mkdir -p $r
-  touch $r/WORKSPACE
+  create_workspace_with_default_repos $r/WORKSPACE
 
   cat > $r/BUILD <<EOF
 filegroup(
@@ -608,7 +608,7 @@
   mkdir -p $r/b
   touch $r/b/{BUILD,b}
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 local_repository(
     name = "r",
     path = "$r",
@@ -623,7 +623,7 @@
   local r=$TEST_TMPDIR/r
   rm -fr $r
   mkdir $r
-  touch $r/WORKSPACE
+  create_workspace_with_default_repos $r/WORKSPACE
   cat > $r/BUILD <<EOF
 cc_binary(
     name = "bin",
@@ -634,7 +634,7 @@
 int main() { return 0; };
 EOF
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 local_repository(
     name = "r",
     path = "$r",
@@ -648,7 +648,7 @@
   local r=$TEST_TMPDIR/r
   rm -fr $r
   mkdir $r
-  touch $r/WORKSPACE
+  create_workspace_with_default_repos $r/WORKSPACE
   cat > $r/BUILD <<'EOF'
 genrule(
     name="r",
@@ -658,7 +658,7 @@
     visibility=["//visibility:public"])
 EOF
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 local_repository(name="r", path="$r")
 EOF
 
@@ -672,14 +672,14 @@
 function test_remote_pkg_boundaries() {
   other_ws=$TEST_TMPDIR/ws
   mkdir -p $other_ws/a
-  touch $other_ws/WORKSPACE
+  create_workspace_with_default_repos $other_ws/WORKSPACE
   cat > $other_ws/a/b <<EOF
 abcxyz
 EOF
   cat > $other_ws/BUILD <<EOF
 exports_files(["a/b"])
 EOF
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 local_repository(
     name = "other",
     path = "$other_ws",
@@ -722,7 +722,7 @@
   rm -fr $r
   mkdir $r
 
-  touch $r/WORKSPACE
+  create_workspace_with_default_repos $r/WORKSPACE
   cat > $r/BUILD <<EOF
 genrule(
     name = "public",
@@ -739,7 +739,7 @@
 )
 EOF
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 local_repository(
     name = "r",
     path = "$r",
@@ -782,7 +782,7 @@
   local r=$TEST_TMPDIR/r
   rm -fr $r
   mkdir -p $r
-  touch $r/WORKSPACE
+  create_workspace_with_default_repos $r/WORKSPACE
   cat > $r/BUILD <<EOF
 package(default_visibility=["//visibility:public"])
 load(":r.bzl", "r_filegroup")
@@ -796,7 +796,7 @@
 
   touch $r/rfgf
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 local_repository(name="r", path="$r")
 EOF
 
@@ -811,7 +811,7 @@
   local r=$TEST_TMPDIR/r
   rm -fr $r
   mkdir -p $r/bin
-  touch $r/WORKSPACE
+  create_workspace_with_default_repos $r/WORKSPACE
   cat > $r/bin/BUILD <<EOF
 package(default_visibility=["//visibility:public"])
 py_binary(name="bin", srcs=["bin.py"], deps=["//lib:lib"])
@@ -836,7 +836,7 @@
   return "User"
 EOF
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 local_repository(name="r", path="$r")
 EOF
 
@@ -848,7 +848,7 @@
   local r=$TEST_TMPDIR/r
   rm -fr $r
   mkdir -p $r/a
-  touch $r/WORKSPACE
+  create_workspace_with_default_repos $r/WORKSPACE
   touch $r/{x,y,a/g,a/h}
   cat > $r/BUILD <<EOF
 exports_files(["x", "y"])
@@ -858,7 +858,7 @@
 exports_files(["g", "h"])
 EOF
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 local_repository(name="r", path="$r")
 EOF
 
@@ -873,7 +873,7 @@
   local r=$TEST_TMPDIR/r
   rm -fr $r
   mkdir -p $r/a/{x,y/z}
-  touch $r/WORKSPACE
+  create_workspace_with_default_repos $r/WORKSPACE
   touch $r/a/{x,y/z}/{m,n}
 
   echo 'exports_files(["m", "n"])' > $r/a/x/BUILD
@@ -897,7 +897,7 @@
   local r=$TEST_TMPDIR/r
   rm -fr $r
   mkdir -p $r/a
-  touch $r/WORKSPACE
+  create_workspace_with_default_repos $r/WORKSPACE
   cat > $r/a/BUILD <<'EOF'
 genrule(
   name = 'b',
@@ -906,7 +906,7 @@
   cmd = 'echo ' + repository_name() + ' ' + package_name() + ' > $@')
 EOF
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 local_repository(name='r', path='$r')
 EOF
 
@@ -920,7 +920,7 @@
   rm -fr $r
   mkdir -p $r/a
 
-  touch $r/a/WORKSPACE
+  create_workspace_with_default_repos $r/a/WORKSPACE
   cat > $r/a/BUILD <<EOF
 cc_binary(
     name = "bin",
@@ -931,7 +931,7 @@
 int main() { return 0; };
 EOF
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 local_repository(
     name = "r/a",
     path = "$r/a",
@@ -947,7 +947,7 @@
   rm -fr $remote
   mkdir -p $remote/inc
 
-  touch $remote/WORKSPACE
+  create_workspace_with_default_repos $remote/WORKSPACE
   cat > $remote/BUILD <<EOF
 cc_library(
     name = "bar",
@@ -966,7 +966,7 @@
 int getNum();
 EOF
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 local_repository(
     name = "r",
     path = "$remote",
@@ -1001,7 +1001,7 @@
 int b() { return 42; }
 EOF
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 new_local_repository(
     name="r",
     path="$r",
@@ -1027,7 +1027,7 @@
   local r=$TEST_TMPDIR/r
   rm -rf $r
   mkdir -p $r
-  touch $r/WORKSPACE
+  create_workspace_with_default_repos $r/WORKSPACE
   cat > $r/BUILD <<'EOF'
 genrule(
   name = "dummy1",
@@ -1037,7 +1037,7 @@
 )
 EOF
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 local_repository(
     name="r",
     path="$r",
@@ -1058,7 +1058,7 @@
 
 function test_local_repository_path_does_not_exist() {
   rm -rf $TEST_TMPDIR/r
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 local_repository(
     name = "r",
     path = "$TEST_TMPDIR/r",
@@ -1081,7 +1081,7 @@
 )
 EOF
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 local_repository(
     name = "r",
     path = "$TEST_TMPDIR/r",
@@ -1092,7 +1092,7 @@
   expect_log "No WORKSPACE file found"
 
   # Create the workspace and verify it now succeeds.
-  touch $r/WORKSPACE
+  create_workspace_with_default_repos $r/WORKSPACE
   bazel build @r//... &> $TEST_log || fail "Build failed unexpectedly"
   expect_not_log "No WORKSPACE file found"
 
@@ -1107,7 +1107,7 @@
   local r=$TEST_TMPDIR/r
   rm -rf $r
   mkdir -p $r
-  touch $r/WORKSPACE
+  create_workspace_with_default_repos $r/WORKSPACE
   cat > $r/BUILD <<'EOF'
 genrule(
     name = "orig",
@@ -1116,7 +1116,7 @@
 )
 EOF
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 new_local_repository(
     name = "r",
     path = "$TEST_TMPDIR/r",
@@ -1136,7 +1136,7 @@
 function test_new_local_repository_path_not_existing() {
   local r=$TEST_TMPDIR/r
   rm -rf $r
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 new_local_repository(
     name = "r",
     path = "$TEST_TMPDIR/r",
@@ -1157,7 +1157,7 @@
   local r=$TEST_TMPDIR/r
   rm -rf $r
   touch $r
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 new_local_repository(
     name = "r",
     path = "$TEST_TMPDIR/r",
@@ -1182,7 +1182,7 @@
   mkdir -p $s
   ln -s $s $r
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 new_local_repository(
     name = "r",
     path = "$TEST_TMPDIR/r",
@@ -1206,7 +1206,7 @@
   touch $s
   ln -s $s $r
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 new_local_repository(
     name = "r",
     path = "$TEST_TMPDIR/r",
@@ -1269,7 +1269,7 @@
 
   cp -r a b $external_dir
 
-  touch $external_dir/WORKSPACE
+  create_workspace_with_default_repos $external_dir/WORKSPACE
   cat > $external_dir/x/X.java <<EOF
 package x;
 
@@ -1287,7 +1287,7 @@
 )
 EOF
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 local_repository(
     name = "x_repo",
     path = "$external_dir",
@@ -1335,7 +1335,7 @@
 
   cd ${WORKSPACE_DIR}
   mkdir -p green
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 local_repository(name = 'blue', path = "${repo2}")
 EOF
   cat > green/BUILD <<EOF
@@ -1364,7 +1364,7 @@
 
   cd ${WORKSPACE_DIR}
   mkdir -p green
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 local_repository(name = 'blue', path = "${repo2}")
 EOF
   cat > green/BUILD <<EOF
diff --git a/src/test/shell/bazel/maven_test.sh b/src/test/shell/bazel/maven_test.sh
index 7948985..0c625ad 100755
--- a/src/test/shell/bazel/maven_test.sh
+++ b/src/test/shell/bazel/maven_test.sh
@@ -56,7 +56,7 @@
   setup_zoo
   serve_artifact com.example.carnivore carnivore 1.23
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 maven_jar(
     name = 'endangered',
     artifact = "com.example.carnivore:carnivore:1.23",
@@ -74,7 +74,7 @@
   setup_zoo
   serve_artifact com.example.carnivore carnivore 1.23
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 maven_jar(
     name = 'endangered',
     artifact = "com.example.carnivore:carnivore:1.23",
@@ -92,7 +92,7 @@
   setup_zoo
   serve_artifact com.example.carnivore carnivore 1.23
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 maven_jar(
     name = 'endangered',
     artifact = "com.example.carnivore:carnivore:1.23",
@@ -109,7 +109,7 @@
   setup_zoo
   serve_artifact com.example.carnivore carnivore 1.23
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 maven_jar(
     name = 'endangered',
     artifact = "com.example.carnivore:carnivore:1.23",
@@ -129,7 +129,7 @@
   setup_zoo
   serve_not_found
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 maven_jar(
     name = 'endangered',
     artifact = "com.example.carnivore:carnivore:1.23",
@@ -148,7 +148,7 @@
   serve_artifact com.example.carnivore carnivore 1.23
 
   wrong_sha1="0123456789012345678901234567890123456789"
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 maven_jar(
     name = 'endangered',
     artifact = "com.example.carnivore:carnivore:1.23",
@@ -163,7 +163,7 @@
 
 function test_default_repository() {
   serve_artifact thing amabop 1.9
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 maven_server(
     name = "default",
     url = "http://127.0.0.1:$fileserver_port/",
@@ -181,7 +181,7 @@
 
 function test_settings() {
   serve_artifact thing amabop 1.9
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 maven_server(
     name = "x",
     url = "http://127.0.0.1:$fileserver_port/",
@@ -251,7 +251,7 @@
 function test_auth() {
   startup_auth_server
   create_artifact thing amabop 1.9
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 maven_server(
     name = "x",
     url = "http://127.0.0.1:$fileserver_port/",
diff --git a/src/test/shell/bazel/runfiles_test.sh b/src/test/shell/bazel/runfiles_test.sh
index e0ac79b..97f1ebd 100755
--- a/src/test/shell/bazel/runfiles_test.sh
+++ b/src/test/shell/bazel/runfiles_test.sh
@@ -29,8 +29,8 @@
   name=blorp_malorp
   cat > WORKSPACE <<EOF
 workspace(name = "$name")
-
 EOF
+  create_workspace_with_default_repos WORKSPACE
 
   mkdir foo
   cat > foo/BUILD <<EOF
@@ -64,7 +64,7 @@
     build_file = "BUILD",
 )
 EOF
-
+  create_workspace_with_default_repos WORKSPACE
   cat > BUILD <<EOF
 exports_files(glob(["*"]))
 
diff --git a/src/test/shell/bazel/skylark_git_repository_test.sh b/src/test/shell/bazel/skylark_git_repository_test.sh
index e4645b3..40012f2 100755
--- a/src/test/shell/bazel/skylark_git_repository_test.sh
+++ b/src/test/shell/bazel/skylark_git_repository_test.sh
@@ -132,7 +132,7 @@
   [ $# -eq 3 ] && shallow_since="shallow_since=\"$3\","
   # Create a workspace that clones the repository at the first commit.
   cd $WORKSPACE_DIR
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load('@bazel_tools//tools/build_defs/repo:git.bzl', 'git_repository')
 git_repository(
     name = "pluto",
@@ -227,7 +227,7 @@
   cd $WORKSPACE_DIR
 
   if [ "$2" == "build_file" ] ; then
-    cat > WORKSPACE <<EOF
+    cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load('@bazel_tools//tools/build_defs/repo:git.bzl', 'new_git_repository')
 new_git_repository(
     name = "pluto",
@@ -249,7 +249,7 @@
 )
 EOF
   else
-    cat > WORKSPACE <<EOF
+    cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load('@bazel_tools//tools/build_defs/repo:git.bzl', 'new_git_repository')
 new_git_repository(
     name = "pluto",
@@ -318,7 +318,7 @@
 
   # Create a workspace that clones the outer_planets repository.
   cd $WORKSPACE_DIR
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load('@bazel_tools//tools/build_defs/repo:git.bzl', 'new_git_repository')
 new_git_repository(
     name = "outer_planets",
@@ -375,7 +375,7 @@
   local repo_dir=$TEST_TMPDIR/repos/refetch
 
   cd $WORKSPACE_DIR
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load('@bazel_tools//tools/build_defs/repo:git.bzl', 'git_repository')
 git_repository(name='g', remote='$repo_dir', commit='22095302abaf776886879efa5129aa4d44c53017', verbose=True)
 EOF
@@ -391,7 +391,8 @@
   assert_contains "GIT 1" bazel-genfiles/external/g/go
 
   # Change the commit id, which should cause the checkout to be re-cloned.
-  cat > WORKSPACE <<EOF
+  rm WORKSPACE
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load('@bazel_tools//tools/build_defs/repo:git.bzl', 'git_repository')
 git_repository(name='g', remote='$repo_dir', commit='db134ae9b644d8237954a8e6f1ef80fcfd85d521', verbose=True)
 EOF
@@ -401,7 +402,8 @@
   assert_contains "GIT 2" bazel-genfiles/external/g/go
 
   # Change the WORKSPACE but not the commit id, which should not cause the checkout to be re-cloned.
-  cat > WORKSPACE <<EOF
+  rm WORKSPACE
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 # This comment line is to change the line numbers, which should not cause Bazel
 # to refetch the repository
 load('@bazel_tools//tools/build_defs/repo:git.bzl', 'git_repository')
@@ -416,7 +418,7 @@
 function test_git_repository_not_refetched_on_server_restart_strip_prefix() {
   local repo_dir=$TEST_TMPDIR/repos/refetch
   # Change the strip_prefix which should cause a new checkout
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load('@bazel_tools//tools/build_defs/repo:git.bzl', 'git_repository')
 git_repository(name='g', remote='$repo_dir', commit='17ea13b242e4cbcc27a6ef745939ebb7dcccea10', verbose=True)
 EOF
@@ -424,7 +426,8 @@
   expect_log "Cloning"
   assert_contains "GIT 2" bazel-genfiles/external/g/gdir/go
 
-  cat > WORKSPACE <<EOF
+  rm WORKSPACE
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load('@bazel_tools//tools/build_defs/repo:git.bzl', 'git_repository')
 git_repository(name='g', remote='$repo_dir', commit='17ea13b242e4cbcc27a6ef745939ebb7dcccea10', verbose=True, strip_prefix="gdir")
 EOF
@@ -438,7 +441,7 @@
   local repo_dir=$TEST_TMPDIR/repos/refetch
 
   cd $WORKSPACE_DIR
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load('@bazel_tools//tools/build_defs/repo:git.bzl', 'git_repository')
 git_repository(name='g', remote='$repo_dir', commit='22095302abaf776886879efa5129aa4d44c53017', verbose=True)
 EOF
@@ -448,7 +451,8 @@
   assert_contains "GIT 1" bazel-genfiles/external/g/go
 
   # Change the commit id, which should cause the checkout to be re-cloned.
-  cat > WORKSPACE <<EOF
+  rm WORKSPACE
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load('@bazel_tools//tools/build_defs/repo:git.bzl', 'git_repository')
 git_repository(name='g', remote='$repo_dir', commit='db134ae9b644d8237954a8e6f1ef80fcfd85d521', verbose=True)
 EOF
@@ -462,7 +466,7 @@
   local repo_dir=$TEST_TMPDIR/repos/refetch
 
   cd $WORKSPACE_DIR
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load('@bazel_tools//tools/build_defs/repo:git.bzl', 'git_repository')
 git_repository(name='g', remote='$repo_dir', commit='22095302abaf776886879efa5129aa4d44c53017')
 EOF
@@ -472,19 +476,20 @@
   bazel build @g//:g >& $TEST_log || fail "Build failed"
   assert_contains "GIT 1" bazel-genfiles/external/g/go
 
-  cat > WORKSPACE <<EOF
+  rm WORKSPACE
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load('@bazel_tools//tools/build_defs/repo:git.bzl', 'git_repository')
 git_repository(name='g', remote='$repo_dir', commit='db134ae9b644d8237954a8e6f1ef80fcfd85d521')
 EOF
 
-
   bazel build --nofetch @g//:g >& $TEST_log || fail "Build failed"
   expect_log "External repository 'g' is not up-to-date"
   assert_contains "GIT 1" bazel-genfiles/external/g/go
   bazel build  @g//:g >& $TEST_log || fail "Build failed"
   assert_contains "GIT 2" bazel-genfiles/external/g/go
 
-  cat > WORKSPACE <<EOF
+  rm WORKSPACE
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load('@bazel_tools//tools/build_defs/repo:git.bzl', 'git_repository')
 git_repository(name='g', remote='$repo_dir', commit='17ea13b242e4cbcc27a6ef745939ebb7dcccea10', strip_prefix="gdir")
 EOF
@@ -536,7 +541,7 @@
   local commit_hash="52f9a3f87a2dd17ae0e5847bbae9734f09354afd"
 
   cd $WORKSPACE_DIR
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load('@bazel_tools//tools/build_defs/repo:git.bzl', 'git_repository')
 git_repository(
     name = "pluto",
@@ -565,7 +570,7 @@
   local pluto_repo_dir=$(get_pluto_repo)
 
   cd $WORKSPACE_DIR
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load('@bazel_tools//tools/build_defs/repo:git.bzl', 'git_repository')
 git_repository(
     name = "pluto",
@@ -585,7 +590,7 @@
   local pluto_repo_dir=$(get_pluto_repo)
 
   cd $WORKSPACE_DIR
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load('@bazel_tools//tools/build_defs/repo:git.bzl', 'git_repository')
 git_repository(
     name = "pluto",
@@ -608,7 +613,7 @@
   local pluto_repo_dir=$(get_pluto_repo)
 
   cd $WORKSPACE_DIR
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load('@bazel_tools//tools/build_defs/repo:git.bzl', 'git_repository')
 git_repository(
     name = "pluto",
diff --git a/src/test/shell/bazel/skylark_repository_test.sh b/src/test/shell/bazel/skylark_repository_test.sh
index bf4bc0e..afc84c3 100755
--- a/src/test/shell/bazel/skylark_repository_test.sh
+++ b/src/test/shell/bazel/skylark_repository_test.sh
@@ -84,7 +84,7 @@
 EOF
 
   cd ${WORKSPACE_DIR}
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load('//:test.bzl', 'macro')
 
 macro('$repo2')
@@ -169,7 +169,7 @@
 function test_load_from_symlink_to_outside_of_workspace() {
   OTHER=$TEST_TMPDIR/other
 
-  cat > WORKSPACE<<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE)<<EOF
 load("//a/b:c.bzl", "c")
 EOF
 
@@ -215,7 +215,7 @@
 EOF
 
   cd ${WORKSPACE_DIR}
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 local_repository(name='proxy', path='$repo3')
 load('@proxy//:test.bzl', 'macro')
 macro('$repo2')
@@ -248,7 +248,7 @@
 EOF
 
   cd ${WORKSPACE_DIR}
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 local_repository(name='foo', path='$repo2')
 load("@foo//:ext.bzl", "macro")
 macro()
@@ -282,7 +282,7 @@
   cat >WORKSPACE
 
   cd ${WORKSPACE_DIR}
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@foo//:ext.bzl", "macro")
 macro()
 local_repository(name='foo', path='$repo2')
@@ -334,7 +334,7 @@
 EOF
 
   cd ${WORKSPACE_DIR}
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load('//:test.bzl', 'repo')
 repo(name='foo', path='$repo2')
 EOF
@@ -367,7 +367,7 @@
   echo "filegroup(name='bar', srcs=['bar.txt'])" > BUILD
 
   cd "${WORKSPACE_DIR}"
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load('//:test.bzl', 'repo')
 repo(name = 'foo')
 EOF
@@ -1053,7 +1053,7 @@
   cat > bar.txt
   echo "filegroup(name='bar', srcs=['bar.txt'])" > BUILD
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load('//:test.bzl', 'repo')
 repo(name = 'foo',
      urls = [
@@ -1171,7 +1171,7 @@
 EOF
 
   cd ${WORKSPACE_DIR}
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load('//:test.bzl', 'macro')
 
 macro('$repo2')
@@ -1235,7 +1235,7 @@
 
 
 function test_timeout_tunable() {
-  cat > WORKSPACE <<'EOF'
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<'EOF'
 load("//:repo.bzl", "with_timeout")
 
 with_timeout(name="maytimeout")
@@ -1292,7 +1292,7 @@
   )
 
 EOF
-  cat > WORKSPACE <<'EOF'
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<'EOF'
 load("//:root.bzl", "root_cause")
 load("//:repo.bzl", "trivial_repo")
 
@@ -1369,7 +1369,7 @@
 }
 
 function test_circular_load_error_message() {
-  cat > WORKSPACE <<'EOF'
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<'EOF'
 load("//:a.bzl", "total")
 EOF
   touch BUILD
@@ -1397,7 +1397,7 @@
 }
 
 function test_ciruclar_load_error_with_path_message() {
-  cat > WORKSPACE <<'EOF'
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<'EOF'
 load("//:x.bzl", "x")
 EOF
   touch BUILD
@@ -1442,7 +1442,7 @@
   echo 'Hello World' > x/file.txt
   tar cvf x.tar x
   serve_file_auth x.tar
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("//:auth.bzl", "with_auth")
 with_auth(
   name="ext",
@@ -1504,7 +1504,7 @@
   attrs = {"path": attr.string()},
 )
 EOF
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("//:def.bzl", "netrcrepo")
 
 netrcrepo(name = "netrc", path="$(pwd)/.netrc")
@@ -1592,7 +1592,7 @@
   },
 )
 EOF
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("//:def.bzl", "authrepo")
 
 authrepo(
diff --git a/src/test/shell/bazel/testdata/bazel_toolchain_test_data/BUILD b/src/test/shell/bazel/testdata/bazel_toolchain_test_data/BUILD
index 9162ef2..3ad4e43 100644
--- a/src/test/shell/bazel/testdata/bazel_toolchain_test_data/BUILD
+++ b/src/test/shell/bazel/testdata/bazel_toolchain_test_data/BUILD
@@ -1,3 +1,5 @@
+load("@rules_cc//cc:defs.bzl", "cc_binary")
+
 filegroup(
     name = "srcs",
     srcs = glob(["**"]),
diff --git a/src/test/shell/bazel/toolchain_test.sh b/src/test/shell/bazel/toolchain_test.sh
index b995325..5c385ed 100755
--- a/src/test/shell/bazel/toolchain_test.sh
+++ b/src/test/shell/bazel/toolchain_test.sh
@@ -731,7 +731,7 @@
   write_test_rule
   write_register_toolchain
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 register_toolchains('//demo:not_a_target')
 EOF
 
@@ -824,7 +824,7 @@
     visibility = ['//visibility:public'])
 EOF
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 register_toolchains('//invalid:invalid_toolchain')
 EOF
 
diff --git a/src/test/shell/bazel/workspace_resolved_test.sh b/src/test/shell/bazel/workspace_resolved_test.sh
index 116ba53..cd10e1a 100755
--- a/src/test/shell/bazel/workspace_resolved_test.sh
+++ b/src/test/shell/bazel/workspace_resolved_test.sh
@@ -506,7 +506,7 @@
 )
 EOF
   touch BUILD
-  cat > WORKSPACE <<'EOF'
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<'EOF'
 load("//:rule.bzl", "broken_rule")
 
 broken_rule(name = "broken")
@@ -647,7 +647,8 @@
 EOF
 
   bazel sync --distdir=${EXTREPODIR}/test_WORKSPACE/distdir --experimental_repository_resolved_file=resolved.bzl
-  rm WORKSPACE; touch WORKSPACE
+  rm WORKSPACE
+  touch WORKSPACE
   echo; cat resolved.bzl; echo
 
   bazel build --experimental_resolved_file_instead_of_workspace=resolved.bzl \
@@ -812,7 +813,7 @@
   attrs = {},
 )
 EOF
-    cat > WORKSPACE <<'EOF'
+  cat > WORKSPACE <<'EOF'
 load("//:rule.bzl", "time_rule")
 
 time_rule(name="timestamprepo")
@@ -1095,7 +1096,7 @@
 
   mkdir main
   cd main
-  cat > WORKSPACE <<EOF
+  cat >> WORKSPACE <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
   name="ext",
diff --git a/src/test/shell/bazel/workspace_test.sh b/src/test/shell/bazel/workspace_test.sh
index fe53406..1783aa4 100755
--- a/src/test/shell/bazel/workspace_test.sh
+++ b/src/test/shell/bazel/workspace_test.sh
@@ -23,7 +23,7 @@
 
 function setup_repo() {
   mkdir -p $1
-  touch $1/WORKSPACE
+  create_workspace_with_default_repos $1/WORKSPACE
   echo $2 > $1/thing
   cat > $1/BUILD <<EOF
 genrule(
@@ -67,7 +67,7 @@
   ws="a b"
   mkdir "$ws"
   cd "$ws"
-  touch WORKSPACE
+  create_workspace_with_default_repos WORKSPACE
 
   bazel info &> $TEST_log && fail "Info succeeeded"
   bazel help &> $TEST_log || fail "Help failed"
@@ -86,10 +86,10 @@
     >$test_repo1/BUILD
   echo 'filegroup(name="test", srcs=["test.in"], visibility=["//visibility:public"])' \
     >$test_repo2/BUILD
-  touch $test_repo1/WORKSPACE
-  touch $test_repo2/WORKSPACE
+  create_workspace_with_default_repos $test_repo1/WORKSPACE
+  create_workspace_with_default_repos $test_repo2/WORKSPACE
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 local_repository(name = 'repo1', path='$test_repo1')
 local_repository(name = 'repo2', path='$test_repo2')
 EOF
@@ -122,7 +122,7 @@
 }
 
 function test_no_select() {
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 new_local_repository(
     name = "foo",
     path = "/path/to/foo",
@@ -131,17 +131,15 @@
         "//conditions:default" : "BUILD.2"}),
 )
 EOF
-
   bazel build @foo//... &> $TEST_log && fail "Failure expected" || true
   expect_log "select() cannot be used in WORKSPACE files"
 }
 
 function test_macro_select() {
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load('//:foo.bzl', 'foo_repo')
 foo_repo()
 EOF
-
   touch BUILD
   cat > foo.bzl <<EOF
 def foo_repo():
@@ -174,7 +172,7 @@
 }
 
 function test_skylark_flags_affect_workspace() {
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("//:macro.bzl", "macro")
 print("In workspace: ")
 macro()
@@ -240,7 +238,7 @@
 
 function test_workspace_override() {
   mkdir -p original
-  touch original/WORKSPACE
+  create_workspace_with_default_repos original/WORKSPACE
   cat > original/BUILD <<'EOF'
 genrule(
     name = "gen",
@@ -250,7 +248,7 @@
 EOF
 
   mkdir -p override
-  touch override/WORKSPACE
+  create_workspace_with_default_repos override/WORKSPACE
   cat > override/BUILD <<'EOF'
 genrule(
     name = "gen",
@@ -259,7 +257,7 @@
 )
 EOF
 
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 local_repository(
     name = "o",
     path = "original",
@@ -297,7 +295,7 @@
 )
 EOF
 
-  touch WORKSPACE
+  create_workspace_with_default_repos WORKSPACE
   cat > repo_one/WORKSPACE <<EOF
 workspace(name = "new_repo")
 EOF
@@ -394,7 +392,7 @@
 
   # Repository y is a substitute for x
   mkdir -p y
-  touch y/WORKSPACE
+  create_workspace_with_default_repos y/WORKSPACE
   touch y/BUILD
   cat > y/symbol.bzl <<EOF
 Y_SYMBOL = "y_symbol"
@@ -402,7 +400,7 @@
 
   # Repository a refers to @x
   mkdir -p a
-  touch a/WORKSPACE
+  create_workspace_with_default_repos a/WORKSPACE
   cat > a/BUILD<<EOF
 load("@x//:symbol.bzl", "Y_SYMBOL")
 genrule(name = "a",
@@ -431,7 +429,7 @@
 
   # Repository y is a substitute for x
   mkdir -p y
-  touch y/WORKSPACE
+  create_workspace_with_default_repos y/WORKSPACE
   touch y/BUILD
   cat > y/symbol.bzl <<EOF
 Y_SYMBOL = "y_symbol"
@@ -439,7 +437,7 @@
 
   # Repository a refers to @x
   mkdir -p a
-  touch a/WORKSPACE
+  create_workspace_with_default_repos a/WORKSPACE
   cat > a/BUILD<<EOF
 load("//:foo.bzl", "foo_symbol")
 genrule(name = "a",
@@ -461,7 +459,7 @@
 function test_repository_reassignment_label_in_build() {
   # Repository a refers to @x
   mkdir -p a
-  touch a/WORKSPACE
+  create_workspace_with_default_repos a/WORKSPACE
   cat > a/BUILD<<EOF
 genrule(name = "a",
         srcs = ["@x//:x.txt"],
@@ -472,7 +470,7 @@
 
   # Repository b is a substitute for x
   mkdir -p b
-  touch b/WORKSPACE
+  create_workspace_with_default_repos b/WORKSPACE
   cat >b/BUILD <<EOF
 exports_files(srcs = ["x.txt"])
 EOF
@@ -496,7 +494,7 @@
 function test_repository_reassignment_location() {
   # Repository a refers to @x
   mkdir -p a
-  touch a/WORKSPACE
+  create_workspace_with_default_repos a/WORKSPACE
   cat > a/BUILD<<EOF
 genrule(name = "a",
         srcs = ["@x//:x.txt"],
@@ -508,7 +506,7 @@
 
   # Repository b is a substitute for x
   mkdir -p b
-  touch b/WORKSPACE
+  create_workspace_with_default_repos b/WORKSPACE
   cat >b/BUILD <<EOF
 exports_files(srcs = ["x.txt"])
 EOF
@@ -534,7 +532,7 @@
   EXTREPODIR=`pwd`
 
   mkdir -p a
-  touch a/WORKSPACE
+  create_workspace_with_default_repos a/WORKSPACE
   cat > a/BUILD<<EOF
 genrule(name = "a",
         srcs = ["@x//:x.txt"],
@@ -547,7 +545,7 @@
   rm -rf a
 
   mkdir -p b
-  touch b/WORKSPACE
+  create_workspace_with_default_repos b/WORKSPACE
   cat >b/BUILD <<EOF
 exports_files(srcs = ["x.txt"])
 EOF
@@ -577,7 +575,7 @@
 function test_remapping_with_label_relative() {
   # create foo repository
   mkdir foo
-  touch foo/WORKSPACE
+  create_workspace_with_default_repos foo/WORKSPACE
   cat >foo/foo.bzl <<EOF
 x = Label("//blah:blah").relative("@a//:baz")
 print(x)
@@ -611,7 +609,7 @@
 function test_remapping_label_constructor() {
   # create foo repository
   mkdir foo
-  touch foo/WORKSPACE
+  create_workspace_with_default_repos foo/WORKSPACE
   cat >foo/foo.bzl <<EOF
 x = Label("@a//blah:blah")
 print(x)
@@ -655,7 +653,7 @@
 )
 EOF
 
-  touch WORKSPACE
+  create_workspace_with_default_repos WORKSPACE
   touch repo_one/BUILD
   touch repo_two/BUILD
 
@@ -748,7 +746,7 @@
 EOF
 
   mkdir -p a
-  touch a/WORKSPACE
+  create_workspace_with_default_repos a/WORKSPACE
   echo "load('@mainrepo//:def.bzl', 'x')"> a/BUILD
 
   # the bzl file should be loaded from the main workspace and
@@ -808,10 +806,10 @@
   rm -rf true
   mkdir extref
   echo 'cc_binary(name="it", deps=["//external:true"])' > extref/BUILD
-  touch extref/WORKSPACE
+  create_workspace_with_default_repos extref/WORKSPACE
   mkdir main
   cd main
-  cat > WORKSPACE <<EOF
+  cat >> $(create_workspace_with_default_repos WORKSPACE) <<EOF
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
 http_archive(
diff --git a/src/test/shell/integration/BUILD b/src/test/shell/integration/BUILD
index 0e197a1..bbc329f 100644
--- a/src/test/shell/integration/BUILD
+++ b/src/test/shell/integration/BUILD
@@ -1,5 +1,7 @@
 package(default_visibility = ["//visibility:private"])
 
+load("@rules_cc//cc:defs.bzl", "cc_binary")
+
 filegroup(
     name = "srcs",
     srcs = glob(["**"]),
diff --git a/src/test/shell/integration/discard_graph_edges_test.sh b/src/test/shell/integration/discard_graph_edges_test.sh
index 3bf1f9b..ec9145c 100755
--- a/src/test/shell/integration/discard_graph_edges_test.sh
+++ b/src/test/shell/integration/discard_graph_edges_test.sh
@@ -271,7 +271,7 @@
   package_count="$(extract_histogram_count "$histo_file" \
       'devtools\.build\.lib\..*\.Package$')"
   # A few packages aren't cleared.
-  [[ "$package_count" -le 18 ]] \
+  [[ "$package_count" -le 20 ]] \
       || fail "package count $package_count too high"
   glob_count="$(extract_histogram_count "$histo_file" "GlobValue$")"
   [[ "$glob_count" -le 1 ]] \
diff --git a/src/test/shell/integration/implicit_dependency_reporting_test.sh b/src/test/shell/integration/implicit_dependency_reporting_test.sh
index 07a826e..da91e9b 100755
--- a/src/test/shell/integration/implicit_dependency_reporting_test.sh
+++ b/src/test/shell/integration/implicit_dependency_reporting_test.sh
@@ -62,7 +62,7 @@
   mkdir custommessage
   cd custommessage
 
-  touch WORKSPACE
+  create_workspace_with_default_repos WORKSPACE
   cat > rule.bzl <<'EOF'
 def _rule_impl(ctx):
   out = ctx.actions.declare_file(ctx.label.name + ".txt")
diff --git a/src/test/shell/integration/prelude_test.sh b/src/test/shell/integration/prelude_test.sh
index de4e1e4..30aae9b 100755
--- a/src/test/shell/integration/prelude_test.sh
+++ b/src/test/shell/integration/prelude_test.sh
@@ -28,7 +28,7 @@
 #### TESTS #############################################################
 
 function test_prelude() {
-  touch WORKSPACE
+  create_workspace_with_default_repos WORKSPACE
 
   mkdir -p tools/build_rules
   touch tools/build_rules/BUILD
diff --git a/src/test/shell/integration/py_args_escaping_test.sh b/src/test/shell/integration/py_args_escaping_test.sh
index 79b0cf8..8c6a075 100755
--- a/src/test/shell/integration/py_args_escaping_test.sh
+++ b/src/test/shell/integration/py_args_escaping_test.sh
@@ -245,7 +245,7 @@
 function test_args_escaping_disabled_on_windows() {
   local -r ws="$TEST_TMPDIR/${FUNCNAME[0]}"  # unique workspace for this test
   mkdir -p "$ws"
-  touch "$ws/WORKSPACE"
+  create_workspace_with_default_repos "$ws/WORKSPACE"
 
   create_py_file_that_prints_args "$ws"
   create_build_file_with_many_args "$ws"
@@ -266,7 +266,7 @@
 function test_args_escaping() {
   local -r ws="$TEST_TMPDIR/${FUNCNAME[0]}"  # unique workspace for this test
   mkdir -p "$ws"
-  touch "$ws/WORKSPACE"
+  create_workspace_with_default_repos "$ws/WORKSPACE"
 
   create_py_file_that_prints_args "$ws"
   create_build_file_with_many_args "$ws"
@@ -282,7 +282,7 @@
 function test_untokenizable_args_when_escaping_is_disabled() {
   local -r ws="$TEST_TMPDIR/${FUNCNAME[0]}"  # unique workspace for this test
   mkdir -p "$ws"
-  touch "$ws/WORKSPACE"
+  create_workspace_with_default_repos "$ws/WORKSPACE"
 
   create_py_file_that_prints_args "$ws"
   create_build_file_for_untokenizable_args "$ws"
@@ -300,7 +300,7 @@
 function test_untokenizable_args_when_escaping_is_enabled() {
   local -r ws="$TEST_TMPDIR/${FUNCNAME[0]}"  # unique workspace for this test
   mkdir -p "$ws"
-  touch "$ws/WORKSPACE"
+  create_workspace_with_default_repos "$ws/WORKSPACE"
 
   create_py_file_that_prints_args "$ws"
   create_build_file_for_untokenizable_args "$ws"
@@ -316,7 +316,7 @@
 function test_host_config() {
   local -r ws="$TEST_TMPDIR/${FUNCNAME[0]}"  # unique workspace for this test
   mkdir -p "$ws"
-  touch "$ws/WORKSPACE"
+  create_workspace_with_default_repos "$ws/WORKSPACE"
 
   cat >"$ws/BUILD" <<'eof'
 load("//:rule.bzl", "run_host_configured")
diff --git a/src/test/shell/testenv.sh b/src/test/shell/testenv.sh
index 25ecb73..9180a99 100755
--- a/src/test/shell/testenv.sh
+++ b/src/test/shell/testenv.sh
@@ -448,11 +448,34 @@
 EOF
 }
 
+function add_rules_cc_to_workspace() {
+  cat >> "$1"<<EOF
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
+http_archive(
+    name = "rules_cc",
+    sha256 = "36fa66d4d49debd71d05fba55c1353b522e8caef4a20f8080a3d17cdda001d89",
+    strip_prefix = "rules_cc-0d5f3f2768c6ca2faca0079a997a97ce22997a0c",
+    urls = [
+        "https://mirror.bazel.build/github.com/bazelbuild/rules_cc/archive/0d5f3f2768c6ca2faca0079a997a97ce22997a0c.zip",
+        "https://github.com/bazelbuild/rules_cc/archive/0d5f3f2768c6ca2faca0079a997a97ce22997a0c.zip",
+    ],
+)
+EOF
+}
+
+function create_workspace_with_default_repos() {
+  touch "$1"
+  add_rules_cc_to_workspace $1
+  echo "$1"
+}
+
 # Write the default WORKSPACE file, wiping out any custom WORKSPACE setup.
 function write_workspace_file() {
   cat > WORKSPACE << EOF
 workspace(name = '$WORKSPACE_NAME')
 EOF
+  add_rules_cc_to_workspace "WORKSPACE"
 
   maybe_setup_python_windows_workspace
 }
diff --git a/src/tools/launcher/win_rules.bzl b/src/tools/launcher/win_rules.bzl
index 869b7473..ca54a8b 100644
--- a/src/tools/launcher/win_rules.bzl
+++ b/src/tools/launcher/win_rules.bzl
@@ -1,23 +1,27 @@
-# Copyright 2017 The Bazel Authors. All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
+"""
+Copyright 2017 The Bazel Authors. All rights reserved.
 
-# This is a quick and dirty rule to make Bazel compile itself.  It
-# only supports Java.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+This is a quick and dirty rule to make Bazel compile itself.  It
+only supports Java.
+"""
+
+load("@rules_cc//cc:defs.bzl", macro_cc_bin = "cc_binary", macro_cc_lib = "cc_library", macro_cc_test = "cc_test")
 
 def cc_library(srcs = [], hdrs = [], **kwargs):
     """Replace srcs and hdrs with a dummy.cc on non-Windows platforms."""
-    native.cc_library(
+    macro_cc_lib(
         srcs = select({
             "//conditions:default": ["dummy.cc"],
             "//src/conditions:windows": srcs,
@@ -31,7 +35,7 @@
 
 def cc_binary(srcs = [], **kwargs):
     """Replace srcs with a dummy.cc on non-Windows platforms."""
-    native.cc_binary(
+    macro_cc_bin(
         srcs = select({
             "//conditions:default": ["dummy.cc"],
             "//src/conditions:windows": srcs,
@@ -41,7 +45,7 @@
 
 def cc_test(srcs = [], **kwargs):
     """Replace srcs with a dummy.cc on non-Windows platforms."""
-    native.cc_test(
+    macro_cc_test(
         srcs = select({
             "//conditions:default": ["dummy.cc"],
             "//src/conditions:windows": srcs,
diff --git a/src/tools/package_printer/java/com/google/devtools/build/packageprinter/bazel_package_printer_test.sh b/src/tools/package_printer/java/com/google/devtools/build/packageprinter/bazel_package_printer_test.sh
index babecfe..6beb701 100755
--- a/src/tools/package_printer/java/com/google/devtools/build/packageprinter/bazel_package_printer_test.sh
+++ b/src/tools/package_printer/java/com/google/devtools/build/packageprinter/bazel_package_printer_test.sh
@@ -27,7 +27,7 @@
 sh_library(name='brighton', deps=[':harken'])
 sh_library(name='harken')
 EOF
-  touch WORKSPACE
+  create_workspace_with_default_repos WORKSPACE
 
   bazel info > /dev/null # unpack and create install and output roots.
   ${BAZEL_RUNFILES}/src/tools/package_printer/java/com/google/devtools/build/packageprinter/BazelPackagePrinter --workspace_root=. --install_base=$(bazel info install_base) --output_base=$(bazel info output_base) peach > $TEST_log
diff --git a/src/tools/singlejar/BUILD b/src/tools/singlejar/BUILD
index e969cee..deb9159 100644
--- a/src/tools/singlejar/BUILD
+++ b/src/tools/singlejar/BUILD
@@ -2,6 +2,8 @@
 #   singlejar C++ implementation.
 package(default_visibility = ["//src:__subpackages__"])
 
+load("@rules_cc//cc:defs.bzl", "cc_binary", "cc_library", "cc_test")
+
 filegroup(
     name = "srcs",
     srcs = glob(["**"]),