Merge remote-tracking branch 'upstream/master' into canonical-id-docs

.bazelci/postsubmit.yml

@@ -157,6 +157,7 @@ tasks:
       - build
       - test
   macos:
+    shards: 20
     shell_commands:
       - sed -i.bak -e 's/^# android_sdk_repository/android_sdk_repository/' -e 's/^#
         android_ndk_repository/android_ndk_repository/' WORKSPACE.bzlmod
@@ -173,7 +174,7 @@ tasks:
     test_flags:
       - "--config=ci-macos"
       # Fine tune the number of test jobs running in parallel to avoid timeout
-      - "--local_test_jobs=8"
+      - "--local_test_jobs=2"
     test_targets:
       - "//scripts/..."
       - "//src/main/starlark/tests/builtins_bzl/..."
@@ -200,15 +201,21 @@ tasks:
       - "-//src/test/shell/bazel:jdeps_test"
       # https://github.com/bazelbuild/bazel/issues/21495
       - "-//src/test/shell/bazel:srcs_test"
-      # Macs can't find python, so these fail: https://github.com/bazelbuild/bazel/issues/18776
-      - "-//src/test/shell/bazel/android:android_instrumentation_test_integration_test"
-      - "-//src/test/shell/bazel/android:android_instrumentation_test_integration_test_with_head_android_tools"
-      - "-//src/test/shell/bazel/android:aapt_integration_test"
-      - "-//src/test/shell/bazel/android:aapt_integration_test_with_head_android_tools"
+      # Disable android tests since we are moving Android rules out of Bazel repo.
+      - "-//src/test/shell/bazel/android/..."
+      - "-//src/tools/android/java/com/google/devtools/build/android/..."
+      - "-//src/test/java/com/google/devtools/build/android/dexer:AllTests"
+      # ServerTests frequently runs into deadlocks on Intel Macs
+      - "-//src/test/java/com/google/devtools/build/lib/server:ServerTests"
+      # bazel_proto_library_test is timeout flaky on Intel Macs, which usually means a runtime of 2 hours or more
+      - "-//src/test/shell/bazel:bazel_proto_library_test"
+      # Takes too long on Intel VMs
+      - "-//src/test/shell/bazel:bazel_bootstrap_distfile_test"
     include_json_profile:
       - build
       - test
   macos_arm64:
+    shards: 5
     shell_commands:
       - sed -i.bak -e 's/^# android_sdk_repository/android_sdk_repository/' -e 's/^#
         android_ndk_repository/android_ndk_repository/' WORKSPACE.bzlmod
@@ -238,7 +245,7 @@ tasks:
       - "//tools/bash/..."
       # https://github.com/bazelbuild/bazel/issues/17410
       - "-//src/test/java/com/google/devtools/build/lib/platform:SystemMemoryPressureEventTest"
-      # https://github.com/bazelbuild/bazel/issues/16521 & https://github.com/bazelbuild/bazel/issues/18776
+      # Disable android tests since we are moving Android rules out of Bazel repo.
       - "-//src/test/shell/bazel/android/..."
       - "-//src/tools/android/java/com/google/devtools/build/android/..."
       - "-//src/test/java/com/google/devtools/build/android/dexer:AllTests"

.bazelci/presubmit.yml

@@ -163,7 +163,7 @@ tasks:
       - build
       - test
   macos:
-    shards: 4
+    shards: 20
     shell_commands:
       - sed -i.bak -e 's/^# android_sdk_repository/android_sdk_repository/' -e 's/^#
         android_ndk_repository/android_ndk_repository/' WORKSPACE.bzlmod
@@ -180,7 +180,7 @@ tasks:
     test_flags:
       - "--config=ci-macos"
       # Fine tune the number of test jobs running in parallel to avoid timeout
-      - "--local_test_jobs=8"
+      - "--local_test_jobs=2"
     test_targets:
       - "//scripts/..."
       - "//src/main/starlark/tests/builtins_bzl/..."
@@ -208,26 +208,21 @@ tasks:
       - "-//src/test/shell/bazel:jdeps_test"
       # https://github.com/bazelbuild/bazel/issues/21495
       - "-//src/test/shell/bazel:srcs_test"
-      # Macs can't find python, so these fail: https://github.com/bazelbuild/bazel/issues/18776
-      - "-//src/test/shell/bazel/android:android_instrumentation_test_integration_test"
-      - "-//src/test/shell/bazel/android:android_instrumentation_test_integration_test_with_head_android_tools"
-      - "-//src/test/shell/bazel/android:aapt_integration_test"
-      - "-//src/test/shell/bazel/android:aapt_integration_test_with_head_android_tools"
+      # Disable android tests since we are moving Android rules them out of Bazel repo.
+      - "-//src/test/shell/bazel/android/..."
+      - "-//src/tools/android/java/com/google/devtools/build/android/..."
+      - "-//src/test/java/com/google/devtools/build/android/dexer:AllTests"
       # Disable the top 50 most time-consuming tests on macOS Intel platform in presubmit.
       # Those tests are still covered in postsubmit and by macOS arm64 platform in presubmit.
       # To run any of the following test in presubmit, just comment out the corresponding line.
-      # TODO(pcloudy): Disable the android tests after enabling them on Apple Silicon platform.
       - "-//src/test/shell/bazel:bazel_bootstrap_distfile_test"
-      # - "-//src/test/shell/bazel/android:android_integration_test"
-      # - "-//src/test/shell/bazel/android:android_integration_test_with_head_android_tools"
       - "-//src/test/shell/bazel:bazel_proto_library_test"
       - "-//src/test/py/bazel:runfiles_test"
       - "-//src/test/shell/integration:loading_phase_tests"
       - "-//src/test/py/bazel:bazel_module_test"
       - "-//src/test/shell/integration:target_compatible_with_test"
       - "-//src/test/shell/integration:bazel_json_worker_test"
       - "-//src/test/shell/bazel:bazel_coverage_java_jdk21_toolchain_head_test"
-      # - "-//src/test/shell/bazel/android:aar_integration_test"
       - "-//src/test/shell/bazel:bazel_coverage_java_test"
       - "-//src/test/shell/bazel:bazel_java_test_jdk21_toolchain_head"
       - "-//src/test/shell/bazel:starlark_git_repository_test"
@@ -244,11 +239,7 @@ tasks:
       - "-//src/test/shell/integration:sandboxing_test"
       - "-//src/test/shell/bazel:bazel_java_test"
       - "-//src/test/py/bazel:bzlmod_query_test"
-      # - "-//src/test/shell/bazel/android:desugarer_integration_test"
-      # - "-//src/test/shell/bazel/android:desugarer_integration_test_with_head_android_tools"
       - "-//src/test/py/bazel:bazel_external_repository_test"
-      # - "-//src/test/shell/bazel/android:resource_processing_integration_test"
-      # - "-//src/test/shell/bazel/android:aar_integration_test_with_head_android_tools"
       - "-//src/tools/singlejar:zip64_test"
       - "-//src/test/py/bazel:launcher_test"
       - "-//src/test/shell/integration:bazel_worker_test"
@@ -258,14 +249,20 @@ tasks:
       - "-//src/test/shell/bazel:path_mapping_test"
       - "-//src/test/shell/integration:toolchain_test"
       - "-//src/test/shell/integration:execution_phase_tests"
-      # - "-//src/test/shell/bazel/android:resource_processing_integration_test_with_head_android_tools"
       - "-//src/test/shell/integration:aquery_test"
       - "-//src/test/py/bazel:mod_command_test"
+      # ServerTests frequently runs into deadlocks on Intel Macs
+      - "-//src/test/java/com/google/devtools/build/lib/server:ServerTests"
+      # bazel_proto_library_test is timeout flaky on Intel Macs, which usually means a runtime of 2 hours or more
+      - "-//src/test/shell/bazel:bazel_proto_library_test"
+      # Takes too long on Intel VMs
+      - "-//src/test/shell/bazel:bazel_bootstrap_distfile_test"
+      - "-//src/test/shell/bazel:bazel_bootstrap_distfile_tar_test"
     include_json_profile:
       - build
       - test
   macos_arm64:
-    shards: 2
+    shards: 5
     shell_commands:
       - sed -i.bak -e 's/^# android_sdk_repository/android_sdk_repository/' -e 's/^#
         android_ndk_repository/android_ndk_repository/' WORKSPACE.bzlmod
@@ -296,7 +293,7 @@ tasks:
       - "//tools/bash/..."
       # https://github.com/bazelbuild/bazel/issues/17410
       - "-//src/test/java/com/google/devtools/build/lib/platform:SystemMemoryPressureEventTest"
-      # https://github.com/bazelbuild/bazel/issues/16521 & https://github.com/bazelbuild/bazel/issues/18776
+      # Disable android tests since we are moving Android rules out of Bazel repo.
       - "-//src/test/shell/bazel/android/..."
       - "-//src/tools/android/java/com/google/devtools/build/android/..."
       - "-//src/test/java/com/google/devtools/build/android/dexer:AllTests"

.gitattributes

@@ -2,6 +2,13 @@
 BUILD linguist-language=Python
 site/* linguist-documentation
 
+# Github excludes files in 'build' directory from their search by default.
+# This negates the exclusion.
+#
+# For more information, see:
+#   https://docs.github.com/en/search-github/searching-on-github/finding-files-on-github#customizing-excluded-files
+**/build/** linguist-generated=false
+
 # Files that should not use CRLF line endings, even on Windows.
 tools/genrule/genrule-setup.sh -text
 

.github/ISSUE_TEMPLATE/incompatible_change.yml

@@ -0,0 +1,92 @@
+name: Incompatible Change
+description: Use this template to track the rollout of an incompatible change in Bazel
+title: '[Incompatible Flag] OR [Incompatible Change Title]'
+labels: ["untriaged", "incompatible-change"]
+assignees:
+  - sgowroji
+  - iancha1992
+  - satyanandak
+body:
+  - type: markdown
+    attributes:
+      value: >
+        **Attention:**
+        Please read https://bazel.build/release/backward-compatibility
+        and https://bazel.build/contribute/breaking-changes for best practices of rolling out
+        incompatible changes in Bazel.
+
+  - type: textarea
+    id: motivation
+    attributes:
+      label: Motivation
+      description: Describe the motivation behind this change. Why is this change needed? What problem does it solve?
+    validations:
+      required: true
+
+  - type: textarea
+    id: description
+    attributes:
+      label: Description
+      description: Provide a clear and concise description of the incompatible change. Explain what the incompatible change is and what impact it will have.
+    validations:
+      required: true
+
+  - type: input
+    id: incompatible_flag
+    attributes:
+      label: Incompatible Flag
+      description: The incompatible flag used to guard this change. If no incompatible flag is used, briefly explain why (e.g. minor incompatible change that's trivial to migrate for).
+    validations:
+      required: true
+
+  - type: textarea
+    id: migration
+    attributes:
+      label: Migration Guide
+      description: Provide guidance on how users can migrate to the new behavior. Include examples, code snippets, or links to relevant documentation.
+    validations:
+      required: true
+
+  - type: dropdown
+    id: bazel_version
+    attributes:
+      label: In which Bazel LTS version will this incompatible change be enabled?
+      multiple: false
+      options:
+        - Bazel 8
+        - Bazel 9
+        - Bazel 10
+
+  - type: textarea
+    id: additional_context
+    attributes:
+      label: Additional Context
+      description: Add any other context about the incompatible change here.
+
+  - type: textarea
+    id: todo_list
+    attributes:
+      label: TODO List
+      description: >
+        Choose a todo list based on whether incompatible flag is used, feel free to edit based on your needs.
+
+
+        With incompatible flag (highly recommend for incompatible changes having large impact):
+
+        \- \[ \] Implement the incompatible change at Bazel HEAD and guard it behind a flag.
+
+        \- \[ \] Backport the incompatible flag to the latest LTS release.
+
+        \- \[ \] Test the incompatible change with [downstream projects](https://github.com/bazelbuild/continuous-integration/blob/master/docs/downstream-testing.md#bazel-downstream-testing) and inform broken projects.
+
+        \- \[ \] Flip the incompatible flag at Bazel HEAD.
+
+        \- \[ \] Delete the incompatible flag and the old behavior at Bazel HEAD.
+
+
+        Without incompatible flag (good for minor incompatible changes that are trivial to migrate for):
+
+        \- \[ \] Implement the incompatible change at Bazel HEAD.
+
+        \- \[ \] Check the [downstream pipeline](https://github.com/bazelbuild/continuous-integration/blob/master/docs/downstream-testing.md#bazel-downstream-testing) result and inform broken projects.
+

.github/workflows/cherry-picker.yml

@@ -18,19 +18,19 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10
+        uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6
         with:
           egress-policy: audit
       - if: github.event.pull_request
         name: Run cherrypicker on closed PR
-        uses: bazelbuild/continuous-integration/actions/cherry_picker@fcd3cdd216acf5b78449ae6c05da1c789f5ef76c
+        uses: bazelbuild/continuous-integration/actions/cherry_picker@ee5ea988681e086afabfe6677eef2dc1292f6b9d
         with:
           triggered-on: closed
           pr-number: ${{ github.event.number }}
           is-prod: True
       - if: github.event.issue
         name: Run cherrypicker on closed issue
-        uses: bazelbuild/continuous-integration/actions/cherry_picker@fcd3cdd216acf5b78449ae6c05da1c789f5ef76c
+        uses: bazelbuild/continuous-integration/actions/cherry_picker@ee5ea988681e086afabfe6677eef2dc1292f6b9d
         with:
           triggered-on: closed
           pr-number: ${{ github.event.issue.number }}
@@ -40,12 +40,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10
+        uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6
         with:
           egress-policy: audit
       - if: startsWith(github.event.issue.body, 'Forked from')
         name: Run cherrypicker on comment
-        uses: bazelbuild/continuous-integration/actions/cherry_picker@fcd3cdd216acf5b78449ae6c05da1c789f5ef76c
+        uses: bazelbuild/continuous-integration/actions/cherry_picker@ee5ea988681e086afabfe6677eef2dc1292f6b9d
         with:
           triggered-on: commented
           pr-number: ${{ github.event.issue.body }}
@@ -54,7 +54,7 @@ jobs:
           is-prod: True
       - if: startsWith(github.event.issue.body, '### Commit IDs')
         name: Run cherrypicker on demand
-        uses: bazelbuild/continuous-integration/actions/cherry_picker@fcd3cdd216acf5b78449ae6c05da1c789f5ef76c
+        uses: bazelbuild/continuous-integration/actions/cherry_picker@ee5ea988681e086afabfe6677eef2dc1292f6b9d
         with:
           triggered-on: ondemand
           milestone-title: ${{ github.event.milestone.title }}

.github/workflows/issue-labeler.yml

@@ -17,9 +17,9 @@ jobs:
         template: [ bug_report.yml, feature_request.yml ]
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Harden Runner
-        uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0
+        uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
         with:
           egress-policy: audit
 

.github/workflows/labeler.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0
+      uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
       with:
         egress-policy: audit
 

.github/workflows/release-helper.yml

@@ -13,11 +13,11 @@ jobs:
       issues: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0
+        uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
         with:
           egress-policy: audit
 
       - name: Run helper
-        uses: bazelbuild/continuous-integration/actions/release-helper@fcd3cdd216acf5b78449ae6c05da1c789f5ef76c # master
+        uses: bazelbuild/continuous-integration/actions/release-helper@ee5ea988681e086afabfe6677eef2dc1292f6b9d # master
         with:
           token: ${{ secrets.BAZEL_IO_TOKEN }}

.github/workflows/remove-labels.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0
+      uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
       with:
         egress-policy: audit
 

.github/workflows/scorecard.yml

@@ -32,12 +32,12 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0
+        uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
         with:
           egress-policy: audit
 
       - name: "Checkout code"
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           persist-credentials: false
 
@@ -72,6 +72,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@f079b8493333aace61c81488f8bd40919487bd9f # v3.25.7
+        uses: github/codeql-action/upload-sarif@b611370bb5703a7efb587f9d136a52ea24c5c38c # v3.25.11
         with:
           sarif_file: results.sarif

.github/workflows/stale.yml

@@ -23,7 +23,7 @@ jobs:
 
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0
+      uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
       with:
         egress-policy: audit