Merge branch 'main' into add-return-typehint

.bazelignore

@@ -1,4 +1 @@
-# These are fetched as external repositories.
-third_party/abseil-cpp
-third_party/googletest
 _build/

.bazelrc

@@ -1,5 +1,8 @@
 build --cxxopt=-std=c++17 --host_cxxopt=-std=c++17
 
+# TODO: ErrorProne's SelfAssertions are violated in protobuf's test
+build --javacopt=-Xep:SelfAssertion:WARN
+
 build:dbg --compilation_mode=dbg
 
 build:opt --compilation_mode=opt
@@ -22,6 +25,8 @@ build:ubsan --action_env=UBSAN_OPTIONS=halt_on_error=1:print_stacktrace=1
 # Workaround for the fact that Bazel links with $CC, not $CXX
 # https://github.com/bazelbuild/bazel/issues/11122#issuecomment-613746748
 build:ubsan --copt=-fno-sanitize=function --copt=-fno-sanitize=vptr
+# Abseil passes nullptr to memcmp with 0 size
+build:ubsan --copt=-fno-sanitize=nonnull-attribute
 
 # TODO: migrate all dependencies from WORKSPACE to MODULE.bazel
 # https://github.com/protocolbuffers/protobuf/issues/14313

.bcr/metadata.template.json

@@ -1,6 +1,11 @@
 {
   "homepage": "https://github.com/protocolbuffers/protobuf",
   "maintainers": [
+    {
+      "email": "[email protected]",
+      "github": "protobuf-team-bot",
+      "name": "Protobuf Team"
+    },
     {
       "email": "[email protected]",
       "github": "zhangskz",
@@ -15,6 +20,78 @@
       "email": "[email protected]",
       "github": "googleberg",
       "name": "Jerry Berg"
+    },
+    {
+      "email": "[email protected]",
+      "github": "acozzette",
+      "name": "Adam Cozzette",
+      "do_not_notify": true
+    },
+    {
+      "email": "[email protected]",
+      "github": "deannagarcia",
+      "name": "Deanna Garcia",
+      "do_not_notify": true
+    },
+    {
+      "email": "[email protected]",
+      "github": "esrauchg",
+      "name": "Em Rauch",
+      "do_not_notify": true
+    },
+    {
+      "email": "[email protected]",
+      "github": "haberman",
+      "name": "Josh Haberman",
+      "do_not_notify": true
+    },
+    {
+      "email": "[email protected]",
+      "github": "honglooker",
+      "name": "Hong Shin",
+      "do_not_notify": true
+    },
+    {
+      "email": "[email protected]",
+      "github": "JasonLunn",
+      "name": "Jason Lunn",
+      "do_not_notify": true
+    },
+    {
+      "email": "[email protected]",
+      "github": "anandolee",
+      "name": "Jie Luo",
+      "do_not_notify": true
+    },
+    {
+      "email": "[email protected]",
+      "github": "salo",
+      "name": "Eric Salo",
+      "do_not_notify": true
+    },
+    {
+      "email": "[email protected]",
+      "github": "sbenza",
+      "name": "Samuel Benzaquen",
+      "do_not_notify": true
+    },
+    {
+      "email": "[email protected]",
+      "github": "shaod2",
+      "name": "Dennis Shao",
+      "do_not_notify": true
+    },
+    {
+      "email": "[email protected]",
+      "github": "theodorerose",
+      "name": "Theodore Rose",
+      "do_not_notify": true
+    },
+    {
+      "email": "[email protected]",
+      "github": "tonyliaoss",
+      "name": "Tony Liao",
+      "do_not_notify": true
     }
   ],
   "repository": ["github:protocolbuffers/protobuf"],

.bcr/presubmit.yml

@@ -1,25 +1,36 @@
 matrix:
   platform: ["debian10", "macos", "ubuntu2004", "windows"]
+  bazel: [7.x]
 
 tasks:
   verify_targets:
     name: "Verify build targets"
     platform: ${{ platform }}
+    bazel: ${{ bazel }}
+    build_flags:
+    - '--host_cxxopt=-std=c++17'
+    - '--cxxopt=-std=c++17'
     build_targets:
     - '@protobuf//:protobuf'
     - '@protobuf//:protobuf_lite'
+    - '@protobuf//:protobuf_python'
+    - '@protobuf//:protobuf_java'
     - '@protobuf//:protoc'
     - '@protobuf//:test_messages_proto2_cc_proto'
     - '@protobuf//:test_messages_proto3_cc_proto'
 
 bcr_test_module:
   module_path: "examples"
   matrix:
-
     platform: ["debian10", "macos", "ubuntu2004", "windows"]
+    bazel: [7.x]
   tasks:
     run_test_module:
       name: "Run test module"
       platform: ${{ platform }}
+      bazel: ${{ bazel }}
+      build_flags:
+      - '--host_cxxopt=-std=c++17'
+      - '--cxxopt=-std=c++17'
       build_targets:
       - "//..."

.github/BUILD.bazel

@@ -1,5 +1,5 @@
 # This information is extracted from the MacOS runner specs located at:
-# https://github.com/actions/runner-images/blob/main/images/macos/macos-12-Readme.md
+# https://github.com/actions/runner-images/blob/main/images/macos/macos-13-Readme.md
 #
 # When updating, also ensure the "xcode_destination" entries in
 # `.github/workflows/test_objectivec.yml` are supported for the given versions

.github/dependabot.yml

@@ -4,5 +4,5 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
-    # Allow up to 3 opened pull requests for github-actions versions
-    open-pull-requests-limit: 3
+    # Don't allow non-security PRs to be opened.
+    open-pull-requests-limit: 0

.github/scripts/validate_yaml.py

@@ -0,0 +1,75 @@
+"""Validate the YAML files for GitHub Actions workflows.
+
+TODO: b/359303016 - convert to use unittest
+"""
+
+import os
+import re
+
+import yaml
+
+# Ensure every job is in the list of blocking jobs.
+with open(
+    os.path.join(os.path.dirname(__file__), '../workflows/test_runner.yml'), 'r'
+) as f:
+  data = yaml.safe_load(f)
+
+  # List of all YAML files that are used by jobs in the test_runner.yml file.
+  yaml_files = []
+
+  # Get a list of all jobs in the test_runner, except for the blocking job and
+  # the tag removal job, which is not always run.
+  all_jobs = list(data['jobs'].keys())
+  all_jobs.remove('all-blocking-tests')
+  all_jobs.remove('remove-tag')
+
+  passed = True
+  blocking_jobs = data['jobs']['all-blocking-tests']['needs']
+
+  for job in all_jobs:
+    if 'uses' in data['jobs'][job]:
+      yaml_files.append(
+          os.path.join(
+              os.path.dirname(__file__),
+              '../workflows',
+              os.path.basename(data['jobs'][job]['uses']),
+          )
+      )
+    if job not in blocking_jobs:
+      passed = False
+      raise ValueError('Job %s is not in the list of blocking jobs.' % job)
+
+  print('PASSED: All jobs are in the list of blocking jobs.')
+
+# Ensure every job with a continuous prefix conditions every step on whether we
+# are in a continuous run.
+for file in yaml_files:
+  with open(file, 'r') as f:
+    data = yaml.safe_load(f)
+    jobs = data['jobs']
+    for job in jobs:
+      if 'steps' not in jobs[job]:
+        continue
+      continuous_condition = 'inputs.continuous-prefix' in jobs[job]['name']
+      steps = jobs[job]['steps']
+      for step in steps:
+        if 'name' in step:
+          name = step['name']
+        elif 'with' in step and 'name' in step['with']:
+          name = step['with']['name']
+        else:
+          raise ValueError(
+              'Step in job %s from file %s does not have a name.' % (job, file)
+          )
+        if continuous_condition and 'continuous-run' not in step.get('if', ''):
+          raise ValueError(
+              'Step %s in job %s from file %s does not check the continuous-run'
+              ' condition' % (name, job, file)
+          )
+        if not continuous_condition and 'continuous-run' in step.get('if', ''):
+          raise ValueError(
+              'Step %s in job %s from file %s checks the continuous-run'
+              ' condition but the job does not contain the continuous-prefix'
+              % (name, job, file)
+          )
+print('PASSED: All steps in all jobs check the continuous-run condition.')

.github/scripts/validate_yaml_test.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+
+source googletest.sh || exit 1
+
+script=${TEST_SRCDIR}/google3/third_party/protobuf/github/validate_yaml
+
+$script || die "Failed to execute $script"
+
+echo "PASS"

.github/workflows/janitor.yml

@@ -45,7 +45,8 @@ jobs:
 
 
             This issue is labeled `inactive` because the last activity was over
-            90 days ago.
+            90 days ago. This issue will be closed and archived after 14
+            additional days without activity.
           close-issue-message: >
             We triage inactive PRs and issues in order to make it easier to find
             active work. If this issue should remain active or becomes active

.github/workflows/scorecard.yml

@@ -47,7 +47,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # v3.1.0
+        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
         with:
           name: SARIF file
           path: results.sarif

.github/workflows/staleness_check.yml

@@ -6,6 +6,11 @@ on:
     - cron: 0 10 * * *
   workflow_call:
     inputs:
+      continuous-run:
+        required: true
+        description: "Boolean string denoting whether this run is continuous --
+          empty string for presubmit, non-empty string for continuous."
+        type: string
       safe-checkout:
         required: false
         description: "The SHA key for the commit we want to run over"
@@ -15,20 +20,14 @@ on:
 permissions: {}
 jobs:
   test:
-    strategy:
-      fail-fast: false
-      matrix:
-        branch: [main, 22.x, 23.x, 24.x, 25.x, 26.x]
-        os: [{ name: Linux, value: ubuntu-latest}]
-
-    name: Test staleness ${{ matrix.os.name }} ${{ github.head_ref && 'PR' || matrix.branch }}
-    runs-on: ${{ matrix.os.value }}
+    name: Test staleness
+    runs-on: ubuntu-latest
     if: ${{ github.event.repository.full_name == 'protocolbuffers/protobuf' }}
     steps:
-      - name: Checkout ${{ github.head_ref && 'PR' || matrix.branch }}
+      - name: Checkout
         uses: protocolbuffers/protobuf-ci/checkout@v3
         with:
-          ref: ${{ inputs.safe-checkout || github.head_ref || matrix.branch }}
+          ref: ${{ inputs.safe-checkout || github.head_ref || github.ref }}
 
       - name: Mark runs associated with commits
         if: ${{ github.event_name != 'schedule' && github.event_name != 'workflow_dispatch' }}

.github/workflows/test_bazel.yml

@@ -3,10 +3,20 @@ name: Bazel Tests
 on:
   workflow_call:
     inputs:
+      continuous-run:
+        required: true
+        description: "Boolean string denoting whether this run is continuous --
+          empty string for presubmit, non-empty string for continuous."
+        type: string
       safe-checkout:
         required: true
         description: "The SHA key for the commit we want to run over"
         type: string
+      continuous-prefix:
+        required: true
+        description: "The string continuous-only tests should be prefixed with when displaying test
+        results."
+        type: string
 
 permissions:
   contents: read
@@ -17,40 +27,46 @@ jobs:
       fail-fast: false
       matrix:
         runner: [ ubuntu, windows, macos ]
-        bazelversion: [ '7.1.1' ]
-        bzlmod: [true, false ]
+        bazelversion: [ '7.1.2' ]
+        bzlmod: [ true, false ]
+        toolchain_resolution: [ "" ]
         include:
           - runner: ubuntu
             bazelversion: '6.4.0'
-            bzlmod: true
+            # Not running Bazel 6 with bzlmod, because it doesn't support use_repo_rule in rules_jvm_external
+            bzlmod: false
           - runner: ubuntu
-            bazelversion: '6.4.0'
             bzlmod: false
+            toolchain_resolution: --incompatible_enable_proto_toolchain_resolution=true
+          - runner: ubuntu
+            bzlmod: true
+            toolchain_resolution: --incompatible_enable_proto_toolchain_resolution=true
     runs-on: ${{ matrix.runner }}-latest
-    name: Examples ${{ matrix.runner }} ${{ matrix.bazelversion }}${{ matrix.bzlmod && ' (bzlmod)' || '' }}
+    name: ${{ matrix.continuous-only && inputs.continuous-prefix || '' }} Examples ${{ matrix.runner }} ${{ matrix.bazelversion }}${{ matrix.bzlmod && ' (bzlmod)' || '' }} ${{ matrix.toolchain_resolution && ' (toolchain resolution)' || '' }}
     steps:
       - name: Checkout pending changes
+        if: ${{ !matrix.continuous-only || inputs.continuous-run }}
         uses: protocolbuffers/protobuf-ci/checkout@v3
         with:
           ref: ${{ inputs.safe-checkout }}
 
       - name: Windows startup flags
-        if: runner.os == 'Windows'
+        if: ${{ runner.os == 'Windows' && (!matrix.continuous-only || inputs.continuous-run) }}
         working-directory: examples
         shell: bash
         run: echo "startup --output_user_root=C:/ --windows_enable_symlinks" >> .bazelrc
 
       - name: Configure Bazel version
+        if: ${{ !matrix.continuous-only || inputs.continuous-run }}
         working-directory: examples
         shell: bash
         run: echo "${{ matrix.bazelversion }}" > .bazelversion
 
       - name: Run tests
+        if: ${{ !matrix.continuous-only || inputs.continuous-run }}
         uses: protocolbuffers/protobuf-ci/bazel@v3
-        # TODO Silence this until we have a fix.
-        if: runner.os != 'Windows' || matrix.bzlmod
         with:
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: examples
           version: ${{ matrix.bazelversion }}
-          bash: cd examples && bazel build //... $BAZEL_FLAGS --enable_bzlmod=${{ matrix.bzlmod }}
+          bash: cd examples && bazel build //... $BAZEL_FLAGS --enable_bzlmod=${{ matrix.bzlmod }} ${{ matrix.toolchain_resolution }}