Moved prebuilt-related Bazel files to standard locations.

- Standard location for flags is `bazel/flags/`
- Standard location for OSS-only internal files is `bazel/private/oss`.

PiperOrigin-RevId: 862267301

Author: haberman

.github/workflows/test_bazel.yml

@@ -33,7 +33,7 @@ jobs:
           # Default flags, uses from-source protoc
           - ""
           # still uses from-source protoc unless 
-          # --@com_google_protobuf//bazel/toolchains:prefer_prebuilt_protoc is set
+          # --@com_google_protobuf//bazel/flags:prefer_prebuilt_protoc is set
           - "--incompatible_enable_proto_toolchain_resolution=true"
     runs-on: ${{ matrix.runner }}-latest
     name: ${{ matrix.continuous-only && inputs.continuous-prefix || '' }} Examples ${{ matrix.runner }} ${{ matrix.bazelversion }}${{ matrix.bzlmod && ' (bzlmod)' || '' }} ${{ matrix.toolchain_resolution && ' (toolchain resolution)' || '' }}

BUILD.bazel

@@ -570,7 +570,7 @@ proto_lang_toolchain(
         # Set minimal protoc if prefer_prebuilt_protoc.flag_set is true since a prebuilt for protoc_minimal is not available
         # TODO: Add a flag to switch between minimal and full protoc with proto_lang_toolchain once we have a minimal protoc binary.
         # Setting this attribute to None will make the toolchain to pick the full protoc binary.
-        "//bazel/toolchains:prefer_prebuilt_protoc.flag_set": None,
+        "//bazel/flags:prefer_prebuilt_protoc.flag_set": None,
         "//conditions:default": "//src/google/protobuf/compiler:protoc_minimal",
     }),
     runtime = "//src/google/protobuf",

MODULE.bazel

@@ -120,7 +120,7 @@ register_toolchains(
 )
 
 # Define toolchains that use pre-built protoc binaries.
-prebuilt_protoc = use_extension("//bazel/private:prebuilt_protoc_extension.bzl", "protoc")
+prebuilt_protoc = use_extension("//bazel/private/oss/toolchains/prebuilt:protoc_extension.bzl", "protoc")
 use_repo(
     prebuilt_protoc,
     "prebuilt_protoc.linux_aarch_64",
@@ -135,7 +135,7 @@ use_repo(
 )
 
 # However this registration only matters if the config_setting for prefer_prebuilt_protoc is true,
-# using --@protobuf//bazel/toolchains:prefer_prebuilt_protoc
+# using --@protobuf//bazel/flags:prefer_prebuilt_protoc
 register_toolchains("//bazel/private/oss/toolchains/prebuilt:all")
 
 # From-source protobuf toolchains

bazel/flags/BUILD

@@ -36,6 +36,36 @@ label_flag(
     build_setting_default = "@bazel_tools//tools/proto:protoc",
 )
 
+# When set to true, we will use a prebuilt protoc binary from GitHub if it's available.
+bool_flag(
+    name = "prefer_prebuilt_protoc",
+    # TODO: this should be True after the feature is vetted with some adoption
+    build_setting_default = False,
+    visibility = ["//visibility:private"],
+)
+
+config_setting(
+    name = "prefer_prebuilt_protoc.flag_set",
+    flag_values = {":prefer_prebuilt_protoc": "true"},
+    visibility = [
+        "//bazel/private/oss/toolchains/prebuilt:__pkg__",
+        # Needed by cc_toolchain to switch between minimal and full protoc
+        "//:__pkg__",
+    ],
+)
+
+# The public API users set to disable the validation action failing.
+bool_flag(
+    name = "allow_nonstandard_protoc",
+    build_setting_default = False,
+)
+
+config_setting(
+    name = "allow_nonstandard_protoc.flag_set",
+    flag_values = {":allow_nonstandard_protoc": "true"},
+    visibility = ["//bazel/private/oss/toolchains/prebuilt:__pkg__"],
+)
+
 # TODO: deprecate this flag.
 string_flag(
     name = "strict_proto_deps",

bazel/private/oss/toolchains/prebuilt/BUILD.bazel

@@ -12,7 +12,7 @@ load(":protoc_authenticity.bzl", "protoc_authenticity")
         name = "{}_toolchain".format(platform.replace("-", "_")),
         exec_compatible_with = meta["compatible_with"],
         # Toolchain resolution will only permit this toolchain if the config_setting for prefer_prebuilt_protoc is true,
-        target_settings = ["@com_google_protobuf//bazel/toolchains:prefer_prebuilt_protoc.flag_set"],
+        target_settings = ["@com_google_protobuf//bazel/flags:prefer_prebuilt_protoc.flag_set"],
         # Bazel does not follow this attribute during analysis, so the referenced repo
         # will only be fetched if this toolchain is selected.
         toolchain = "@prebuilt_protoc.{}//:prebuilt_protoc_toolchain".format(platform.replace("-", "_")),
@@ -25,7 +25,7 @@ load(":protoc_authenticity.bzl", "protoc_authenticity")
 protoc_authenticity(
     name = "authenticity_validation",
     fail_on_mismatch = select({
-        "//bazel/toolchains:allow_nonstandard_protoc.flag_set": False,
+        "//bazel/flags:allow_nonstandard_protoc.flag_set": False,
         "//conditions:default": True,
     }),
     visibility = ["//visibility:public"],

bazel/private/oss/toolchains/prebuilt/protoc_authenticity.bzl

@@ -1,8 +1,8 @@
 "Validate that the protoc binary is authentic and not spoofed by a malicious actor."
 
 load("//bazel/common:proto_common.bzl", "proto_common")
-load("//bazel/private:prebuilt_tool_integrity.bzl", "RELEASE_VERSION")
 load("//bazel/private:toolchain_helpers.bzl", "toolchains")
+load(":tool_integrity.bzl", "RELEASE_VERSION")
 
 def _protoc_authenticity_impl(ctx):
     # When this flag is disabled, then users have no way to replace the protoc binary with their own toolchain registration.

…el/private/prebuilt_protoc_extension.bzl …toolchains/prebuilt/protoc_extension.bzlbazel/private/prebuilt_protoc_extension.bzl renamed to bazel/private/oss/toolchains/prebuilt/protoc_extension.bzl bazel/private/prebuilt_protoc_extension.bzl renamed to bazel/private/oss/toolchains/prebuilt/protoc_extension.bzl

@@ -1,8 +1,8 @@
 "Module extensions for use under bzlmod"
 
 load("@bazel_skylib//lib:modules.bzl", "modules")
-load("//bazel/private:prebuilt_protoc_toolchain.bzl", "prebuilt_protoc_repo")
 load("//toolchain:platforms.bzl", "PROTOBUF_PLATFORMS")
+load(":protoc_toolchain.bzl", "prebuilt_protoc_repo")
 
 def create_all_toolchain_repos(name = "prebuilt_protoc"):
     for platform in PROTOBUF_PLATFORMS.keys():

…el/private/prebuilt_protoc_toolchain.bzl …toolchains/prebuilt/protoc_toolchain.bzlbazel/private/prebuilt_protoc_toolchain.bzl renamed to bazel/private/oss/toolchains/prebuilt/protoc_toolchain.bzl bazel/private/prebuilt_protoc_toolchain.bzl renamed to bazel/private/oss/toolchains/prebuilt/protoc_toolchain.bzl

@@ -1,7 +1,7 @@
 "Repository rule that downloads a pre-compiled protoc from our official release for a single platform."
 
 load("//toolchain:platforms.bzl", "PROTOBUF_PLATFORMS")
-load(":prebuilt_tool_integrity.bzl", "RELEASED_BINARY_INTEGRITY", "RELEASE_VERSION")
+load(":tool_integrity.bzl", "RELEASED_BINARY_INTEGRITY", "RELEASE_VERSION")
 
 def release_version_to_artifact_name(release_version, platform):
     # versions have a "v" prefix like "v28.0"
@@ -31,7 +31,7 @@ def _prebuilt_protoc_repo_impl(rctx):
     )
 
     rctx.file("BUILD.bazel", """\
-# Generated by @protobuf//bazel/private:prebuilt_protoc_toolchain.bzl
+# Generated by @protobuf//bazel/private/oss/toolchains/prebuilt:protoc_toolchain.bzl
 load("@com_google_protobuf//bazel/toolchains:proto_toolchain.bzl", "proto_toolchain")
 
 package(default_visibility = ["//visibility:public"])

bazel/private/prebuilt_tool_integrity.bzl …s/toolchains/prebuilt/tool_integrity.bzlbazel/private/prebuilt_tool_integrity.bzl renamed to bazel/private/oss/toolchains/prebuilt/tool_integrity.bzl bazel/private/prebuilt_tool_integrity.bzl renamed to bazel/private/oss/toolchains/prebuilt/tool_integrity.bzl

@@ -12,7 +12,7 @@ load("@rules_testing//lib:util.bzl", "util")
 load("//bazel:proto_library.bzl", "proto_library")
 load("//bazel/tests/testdata:compile_rule.bzl", "compile_rule")
 
-_PREFER_PREBUILT_PROTOC = str(Label("//bazel/toolchains:prefer_prebuilt_protoc"))
+_PREFER_PREBUILT_PROTOC = str(Label("//bazel/flags:prefer_prebuilt_protoc"))
 
 def cc_toolchain_test_suite(name):
     test_suite(