Merge branch 'main' into patch-1

Author: Adam Cozzette

.bazelignore

@@ -1,4 +1 @@
-# These are fetched as external repositories.
-third_party/abseil-cpp
-third_party/googletest
 _build/

.bazelrc

@@ -1,5 +1,8 @@
 build --cxxopt=-std=c++17 --host_cxxopt=-std=c++17
 
+# TODO: ErrorProne's SelfAssertions are violated in protobuf's test
+build --javacopt=-Xep:SelfAssertion:WARN
+
 build:dbg --compilation_mode=dbg
 
 build:opt --compilation_mode=opt
@@ -22,6 +25,8 @@ build:ubsan --action_env=UBSAN_OPTIONS=halt_on_error=1:print_stacktrace=1
 # Workaround for the fact that Bazel links with $CC, not $CXX
 # https://github.com/bazelbuild/bazel/issues/11122#issuecomment-613746748
 build:ubsan --copt=-fno-sanitize=function --copt=-fno-sanitize=vptr
+# Abseil passes nullptr to memcmp with 0 size
+build:ubsan --copt=-fno-sanitize=nonnull-attribute
 
 # TODO: migrate all dependencies from WORKSPACE to MODULE.bazel
 # https://github.com/protocolbuffers/protobuf/issues/14313

.bcr/metadata.template.json

@@ -1,6 +1,11 @@
 {
   "homepage": "https://github.com/protocolbuffers/protobuf",
   "maintainers": [
+    {
+      "email": "protobuf-packages@google.com",
+      "github": "protobuf-team-bot",
+      "name": "Protobuf Team"
+    },
     {
       "email": "sandyzhang@google.com",
       "github": "zhangskz",
@@ -15,6 +20,78 @@
       "email": "gberg@google.com",
       "github": "googleberg",
       "name": "Jerry Berg"
+    },
+    {
+      "email": "acozette@google.com",
+      "github": "acozette",
+      "name": "Adam Cozette",
+      "do_not_notify": true
+    },
+    {
+      "email": "deannagarcia@google.com",
+      "github": "deannagarcia",
+      "name": "Deanna Garcia",
+      "do_not_notify": true
+    },
+    {
+      "email": "esrauch@google.com",
+      "github": "esrauchg",
+      "name": "Em Rauch",
+      "do_not_notify": true
+    },
+    {
+      "email": "haberman@google.com",
+      "github": "haberman",
+      "name": "Josh Haberman",
+      "do_not_notify": true
+    },
+    {
+      "email": "hongshin@google.com",
+      "github": "honglooker",
+      "name": "Hong Shin",
+      "do_not_notify": true
+    },
+    {
+      "email": "jatl@google.com",
+      "github": "JasonLunn",
+      "name": "Jason Lunn",
+      "do_not_notify": true
+    },
+    {
+      "email": "jieluo@google.com",
+      "github": "anandolee",
+      "name": "Jie Luo",
+      "do_not_notify": true
+    },
+    {
+      "email": "salo@google.com",
+      "github": "salo",
+      "name": "Eric Salo",
+      "do_not_notify": true
+    },
+    {
+      "email": "sbenza@google.com",
+      "github": "sbenza",
+      "name": "Samuel Benzaquen",
+      "do_not_notify": true
+    },
+    {
+      "email": "shaod@google.com",
+      "github": "shaod2",
+      "name": "Dennis Shao",
+      "do_not_notify": true
+    },
+    {
+      "email": "theodorerose@google.com",
+      "github": "theodorerose",
+      "name": "Theodore Rose",
+      "do_not_notify": true
+    },
+    {
+      "email": "tonyliaoss@google.com",
+      "github": "tonyliaoss",
+      "name": "Tony Liao",
+      "do_not_notify": true
     }
   ],
   "repository": ["github:protocolbuffers/protobuf"],

.bcr/presubmit.yml

@@ -1,35 +1,36 @@
 matrix:
   platform: ["debian10", "macos", "ubuntu2004", "windows"]
-  bazel: [6.x, 7.x]
+  bazel: [7.x]
 
 tasks:
   verify_targets:
     name: "Verify build targets"
     platform: ${{ platform }}
     bazel: ${{ bazel }}
     build_flags:
-    - '--host_cxxopt=-std=c++14'
-    - '--cxxopt=-std=c++14'
+    - '--host_cxxopt=-std=c++17'
+    - '--cxxopt=-std=c++17'
     build_targets:
     - '@protobuf//:protobuf'
     - '@protobuf//:protobuf_lite'
+    - '@protobuf//:protobuf_python'
+    - '@protobuf//:protobuf_java'
     - '@protobuf//:protoc'
     - '@protobuf//:test_messages_proto2_cc_proto'
     - '@protobuf//:test_messages_proto3_cc_proto'
 
 bcr_test_module:
   module_path: "examples"
   matrix:
-
     platform: ["debian10", "macos", "ubuntu2004", "windows"]
-    bazel: [6.x, 7.x]
+    bazel: [7.x]
   tasks:
     run_test_module:
       name: "Run test module"
       platform: ${{ platform }}
       bazel: ${{ bazel }}
       build_flags:
-      - '--host_cxxopt=-std=c++14'
-      - '--cxxopt=-std=c++14'
+      - '--host_cxxopt=-std=c++17'
+      - '--cxxopt=-std=c++17'
       build_targets:
       - "//..."

.github/BUILD.bazel

@@ -1,5 +1,5 @@
 # This information is extracted from the MacOS runner specs located at:
-# https://github.com/actions/runner-images/blob/main/images/macos/macos-12-Readme.md
+# https://github.com/actions/runner-images/blob/main/images/macos/macos-13-Readme.md
 #
 # When updating, also ensure the "xcode_destination" entries in
 # `.github/workflows/test_objectivec.yml` are supported for the given versions

.github/dependabot.yml

@@ -4,5 +4,5 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
-    # Allow up to 3 opened pull requests for github-actions versions
-    open-pull-requests-limit: 3
+    # Don't allow non-security PRs to be opened.
+    open-pull-requests-limit: 0

.github/scripts/validate_yaml.py

@@ -0,0 +1,75 @@
+"""Validate the YAML files for GitHub Actions workflows.
+
+TODO: b/359303016 - convert to use unittest
+"""
+
+import os
+import re
+
+import yaml
+
+# Ensure every job is in the list of blocking jobs.
+with open(
+    os.path.join(os.path.dirname(__file__), '../workflows/test_runner.yml'), 'r'
+) as f:
+  data = yaml.safe_load(f)
+
+  # List of all YAML files that are used by jobs in the test_runner.yml file.
+  yaml_files = []
+
+  # Get a list of all jobs in the test_runner, except for the blocking job and
+  # the tag removal job, which is not always run.
+  all_jobs = list(data['jobs'].keys())
+  all_jobs.remove('all-blocking-tests')
+  all_jobs.remove('remove-tag')
+
+  passed = True
+  blocking_jobs = data['jobs']['all-blocking-tests']['needs']
+
+  for job in all_jobs:
+    if 'uses' in data['jobs'][job]:
+      yaml_files.append(
+          os.path.join(
+              os.path.dirname(__file__),
+              '../workflows',
+              os.path.basename(data['jobs'][job]['uses']),
+          )
+      )
+    if job not in blocking_jobs:
+      passed = False
+      raise ValueError('Job %s is not in the list of blocking jobs.' % job)
+
+  print('PASSED: All jobs are in the list of blocking jobs.')
+
+# Ensure every job with a continuous prefix conditions every step on whether we
+# are in a continuous run.
+for file in yaml_files:
+  with open(file, 'r') as f:
+    data = yaml.safe_load(f)
+    jobs = data['jobs']
+    for job in jobs:
+      if 'steps' not in jobs[job]:
+        continue
+      continuous_condition = 'inputs.continuous-prefix' in jobs[job]['name']
+      steps = jobs[job]['steps']
+      for step in steps:
+        if 'name' in step:
+          name = step['name']
+        elif 'with' in step and 'name' in step['with']:
+          name = step['with']['name']
+        else:
+          raise ValueError(
+              'Step in job %s from file %s does not have a name.' % (job, file)
+          )
+        if continuous_condition and 'continuous-run' not in step.get('if', ''):
+          raise ValueError(
+              'Step %s in job %s from file %s does not check the continuous-run'
+              ' condition' % (name, job, file)
+          )
+        if not continuous_condition and 'continuous-run' in step.get('if', ''):
+          raise ValueError(
+              'Step %s in job %s from file %s checks the continuous-run'
+              ' condition but the job does not contain the continuous-prefix'
+              % (name, job, file)
+          )
+print('PASSED: All steps in all jobs check the continuous-run condition.')

.github/scripts/validate_yaml_test.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+
+source googletest.sh || exit 1
+
+script=${TEST_SRCDIR}/google3/third_party/protobuf/github/validate_yaml
+
+$script || die "Failed to execute $script"
+
+echo "PASS"

.github/workflows/janitor.yml

@@ -45,7 +45,8 @@ jobs:
 
 
             This issue is labeled `inactive` because the last activity was over
-            90 days ago.
+            90 days ago. This issue will be closed and archived after 14
+            additional days without activity.
           close-issue-message: >
             We triage inactive PRs and issues in order to make it easier to find
             active work. If this issue should remain active or becomes active

.github/workflows/scorecard.yml

@@ -47,7 +47,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # v3.1.0
+        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
         with:
           name: SARIF file
           path: results.sarif