Merge branch 'main' into lsc-1771432703.3414142

Author: google-admin

.bazelrc

@@ -1,9 +1,14 @@
 common --enable_bzlmod
+# Use built-in protoc
+common --incompatible_enable_proto_toolchain_resolution --@com_google_protobuf//bazel/toolchains:prefer_prebuilt_protoc
+
 build --java_runtime_version=remotejdk_11
 build --java_language_version=11
 
+
 # Hide Java 8 deprecation warnings.
 common --javacopt=-Xlint:-options
 
 # Remove flag once https://github.com/google/cel-spec/issues/508 and rules_jvm_external is fixed.
 common --incompatible_autoload_externally=proto_library,cc_proto_library,java_proto_library,java_test
+

.github/workflows/cross_artifact_dependencies_check.sh

@@ -0,0 +1,85 @@
+#!/bin/bash
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o pipefail
+
+TARGETS=(
+  "//publish:cel"
+  "//publish:cel_common"
+  "//publish:cel_compiler"
+  "//publish:cel_runtime"
+  "//publish:cel_protobuf"
+  "//publish:cel_v1alpha1"
+)
+
+echo "------------------------------------------------"
+echo "Checking for duplicates..."
+echo "------------------------------------------------"
+
+JDK8_FLAGS="--java_language_version=8 --java_runtime_version=8"
+bazel build $JDK8_FLAGS "${TARGETS[@]}" || { echo "Bazel build failed"; exit 1; }
+
+(
+  for target in "${TARGETS[@]}"; do
+    # Locate the jar
+    jar_path=$(bazel cquery "$target" --output=files 2>/dev/null | grep '\-project.jar$')
+
+    if [[ -z "$jar_path" ]]; then
+      echo "Error: Could not find -project.jar for target $target" >&2
+      exit 1
+    fi
+
+    # Fix relative paths if running from a subdir.
+    if [[ ! -f "$jar_path" ]]; then
+        if [[ -f "../../$jar_path" ]]; then
+           jar_path="../../$jar_path"
+        else
+           echo "Error: File not found at $jar_path" >&2
+           exit 1
+        fi
+    fi
+
+    echo "Inspecting: $target" >&2
+
+    # Extract classes and append the target name to the end of the line
+    # Format: dev/cel/expr/Expr.class //publish:cel_compiler
+    jar tf "$jar_path" | grep "\.class$" | awk -v tgt="$target" '{print $0, tgt}'
+  done
+) | awk '
+  # $1 is the Class Name, $2 is the Target Name
+  seen[$1] {
+    print "❌ DUPLICATE FOUND: " $1
+    print "   Present in: " seen[$1]
+    print "   And in:     " $2
+    dupe=1
+    next
+  }
+  { seen[$1] = $2 }
+
+  END { if (dupe) exit 2 }
+'
+
+EXIT_CODE=$?
+
+if [ $EXIT_CODE -eq 0 ]; then
+  echo "✅ Success: No duplicate classes found."
+elif [ $EXIT_CODE -eq 2 ]; then
+  echo "⛔ Failure: Duplicate classes detected."
+else
+  echo "💥 Error: An unexpected error occurred (e.g., missing jar files). Exit Code: $EXIT_CODE"
+fi
+
+exit $EXIT_CODE
+

.github/workflows/unwanted_deps.sh

@@ -36,10 +36,14 @@ checkUnwantedDeps '//publish:cel_runtime' '@cel_spec'
 checkUnwantedDeps '//publish:cel_runtime' 'protobuf_java_util'
 checkUnwantedDeps '//publish:cel' 'protobuf_java_util'
 
+# cel_runtime shouldn't depend on antlr
+checkUnwantedDeps '//publish:cel_runtime' '@maven//:org_antlr_antlr4_runtime'
+
 # cel_runtime shouldn't depend on the protobuf_lite runtime
 checkUnwantedDeps '//publish:cel_runtime' '@maven_android//:com_google_protobuf_protobuf_javalite'
 checkUnwantedDeps '//publish:cel' '@maven_android//:com_google_protobuf_protobuf_javalite'
 
-# cel_runtime_android shouldn't depend on the full protobuf runtime
+# cel_runtime_android shouldn't depend on the full protobuf runtime or antlr
 checkUnwantedDeps '//publish:cel_runtime_android' '@maven//:com_google_protobuf_protobuf_java'
+checkUnwantedDeps '//publish:cel_runtime_android' '@maven//:org_antlr_antlr4_runtime'
 exit 0

.github/workflows/workflow.yml

@@ -15,6 +15,31 @@ concurrency:
     cancel-in-progress: true
 
 jobs:
+  Static-Checks:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - run: echo "🎉 The job was automatically triggered by a ${{ github.event_name }} event."
+      - run: echo "🐧 Job is running on a ${{ runner.os }} server!"
+      - run: echo "🔎 The name of your branch is ${{ github.ref }} and your repository is ${{ github.repository }}."
+      - name: Check out repository code
+        uses: actions/checkout@v6
+      - name: Setup Bazel
+        uses: bazel-contrib/setup-bazel@0.18.0
+        with:
+            # Avoid downloading Bazel every time.
+            bazelisk-cache: true
+            # Store build cache per workflow.
+            disk-cache: ${{ github.workflow }}
+            # Share repository cache between workflows.
+            repository-cache: true
+            # Never write to the cache, strictly read-only
+            cache-save: false
+      - name: Unwanted Dependencies
+        run: .github/workflows/unwanted_deps.sh
+      - name: Cross-artifact Duplicate Classes Check
+        run: .github/workflows/cross_artifact_dependencies_check.sh
+      - run: echo "🍏 This job's status is ${{ job.status }}."
   Bazel-Tests:
     runs-on: ubuntu-latest
     timeout-minutes: 30
@@ -25,14 +50,16 @@ jobs:
       - name: Check out repository code
         uses: actions/checkout@v6
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.14.0
+        uses: bazel-contrib/setup-bazel@0.18.0
         with:
             # Avoid downloading Bazel every time.
             bazelisk-cache: true
             # Store build cache per workflow.
             disk-cache: ${{ github.workflow }}
             # Share repository cache between workflows.
             repository-cache: true
+            # Prevent PRs from polluting cache
+            cache-save: ${{ github.event_name != 'pull_request' }}
       - name: Bazel Output Version
         run: bazelisk --version
       - name: Java 8 Build
@@ -41,19 +68,41 @@ jobs:
         # Exclude codelab exercises as they are intentionally made to fail
         # Exclude maven conformance tests. They are only executed when there's version change.
         run: bazelisk test ... --deleted_packages=//codelab/src/test/codelab --test_output=errors --test_tag_filters=-conformance_maven --build_tag_filters=-conformance_maven
+      - run: echo "🍏 This job's status is ${{ job.status }}."
 
-      # -- Start of Maven Conformance Tests (Ran only when there's version changes) --
-      - name: Get changed file
+  # -- Start of Maven Conformance Tests (Ran only when there's version changes) --
+  Maven-Conformance:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - run: echo "🎉 The job was automatically triggered by a ${{ github.event_name }} event."
+      - run: echo "🐧 Job is running on a ${{ runner.os }} server!"
+      - run: echo "🔎 The name of your branch is ${{ github.ref }} and your repository is ${{ github.repository }}."
+      - name: Check out repository code
+        uses: actions/checkout@v6
+      - name: Get changed files
         id: changed_file
         uses: tj-actions/changed-files@v46
         with:
           files: publish/cel_version.bzl
+      - name: Setup Bazel
+        if: steps.changed_file.outputs.any_changed == 'true'
+        uses: bazel-contrib/setup-bazel@0.18.0
+        with:
+            # Avoid downloading Bazel every time.
+            bazelisk-cache: true
+            # Store build cache per workflow.
+            disk-cache: ${{ github.workflow }}
+            # Share repository cache between workflows.
+            repository-cache: true
+            # Never write to the cache, strictly read-only
+            cache-save: false
       - name: Verify Version Consistency
         if: steps.changed_file.outputs.any_changed == 'true'
         run: |
           CEL_VERSION=$(grep 'CEL_VERSION =' publish/cel_version.bzl | cut -d '"' -f 2)
 
-          MODULE_VERSION=$(grep 'dev.cel:cel' MODULE.bazel | cut -d '"' -f 2 | cut -d ':' -f 3)
+          MODULE_VERSION=$(grep 'CEL_VERSION =' MODULE.bazel | cut -d '"' -f 2)
 
           if [ -z "$CEL_VERSION" ] || [ -z "$MODULE_VERSION" ]; then
             echo "❌ Error: Could not extract one or both version strings."

MODULE.bazel

@@ -16,16 +16,16 @@ module(
     name = "cel_java",
 )
 
-bazel_dep(name = "bazel_skylib", version = "1.7.1")
+bazel_dep(name = "bazel_skylib", version = "1.8.2")
 bazel_dep(name = "rules_jvm_external", version = "6.9")
-bazel_dep(name = "protobuf", version = "29.3", repo_name = "com_google_protobuf")  # see https://github.com/bazelbuild/rules_android/issues/373
+bazel_dep(name = "protobuf", version = "33.4", repo_name = "com_google_protobuf")  # see https://github.com/bazelbuild/rules_android/issues/373
 bazel_dep(name = "googleapis", version = "0.0.0-20241220-5e258e33.bcr.1", repo_name = "com_google_googleapis")
 bazel_dep(name = "rules_pkg", version = "1.0.1")
 bazel_dep(name = "rules_license", version = "1.0.0")
 bazel_dep(name = "rules_proto", version = "7.1.0")
-bazel_dep(name = "rules_java", version = "8.12.0")
+bazel_dep(name = "rules_java", version = "9.3.0")
 bazel_dep(name = "rules_android", version = "0.7.1")
-bazel_dep(name = "rules_shell", version = "0.5.1")
+bazel_dep(name = "rules_shell", version = "0.6.1")
 bazel_dep(name = "googleapis-java", version = "1.0.0")
 bazel_dep(name = "cel-spec", version = "0.24.0", repo_name = "cel_spec")
 
@@ -39,7 +39,9 @@ GUAVA_VERSION = "33.5.0"
 
 TRUTH_VERSION = "1.4.4"
 
-PROTOBUF_JAVA_VERSION = "4.33.4"
+PROTOBUF_JAVA_VERSION = "4.33.5"
+
+CEL_VERSION = "0.12.0-SNAPSHOT"
 
 # Compile only artifacts
 [
@@ -114,7 +116,11 @@ maven.install(
 
 maven.install(
     name = "maven_conformance",
-    artifacts = ["dev.cel:cel:0.11.1"],
+    artifacts = [
+        "dev.cel:cel:" + CEL_VERSION,
+        "dev.cel:compiler:" + CEL_VERSION,
+        "dev.cel:runtime:" + CEL_VERSION,
+    ],
     repositories = [
         "https://maven.google.com",
         "https://repo1.maven.org/maven2",

bundle/src/test/java/dev/cel/bundle/CelImplTest.java

@@ -1991,59 +1991,6 @@ public void program_nativeTypeUnknownsEnabled_asCallArguments() throws Exception
     assertThat(result.attributes()).isEmpty();
   }
 
-  @Test
-  @TestParameters("{expression: 'string(123)'}")
-  @TestParameters("{expression: 'string(123u)'}")
-  @TestParameters("{expression: 'string(1.5)'}")
-  @TestParameters("{expression: 'string(\"foo\")'}")
-  @TestParameters("{expression: 'string(b\"foo\")'}")
-  @TestParameters("{expression: 'string(timestamp(100))'}")
-  @TestParameters("{expression: 'string(duration(\"1h\"))'}")
-  public void program_stringConversionDisabled_throws(String expression) throws Exception {
-    Cel cel =
-        CelFactory.standardCelBuilder()
-            .setOptions(
-                CelOptions.current()
-                    .enableTimestampEpoch(true)
-                    .enableStringConversion(false)
-                    .build())
-            .build();
-    CelAbstractSyntaxTree ast = cel.compile(expression).getAst();
-
-    CelEvaluationException e =
-        assertThrows(CelEvaluationException.class, () -> cel.createProgram(ast).eval());
-    assertThat(e).hasMessageThat().contains("No matching overload for function 'string'");
-    assertThat(e.getErrorCode()).isEqualTo(CelErrorCode.OVERLOAD_NOT_FOUND);
-  }
-
-  @Test
-  public void program_stringConcatenationDisabled_throws() throws Exception {
-    Cel cel =
-        CelFactory.standardCelBuilder()
-            .setOptions(CelOptions.current().enableStringConcatenation(false).build())
-            .build();
-    CelAbstractSyntaxTree ast = cel.compile("'foo' + 'bar'").getAst();
-
-    CelEvaluationException e =
-        assertThrows(CelEvaluationException.class, () -> cel.createProgram(ast).eval());
-    assertThat(e).hasMessageThat().contains("No matching overload for function '_+_'");
-    assertThat(e.getErrorCode()).isEqualTo(CelErrorCode.OVERLOAD_NOT_FOUND);
-  }
-
-  @Test
-  public void program_listConcatenationDisabled_throws() throws Exception {
-    Cel cel =
-        CelFactory.standardCelBuilder()
-            .setOptions(CelOptions.current().enableListConcatenation(false).build())
-            .build();
-    CelAbstractSyntaxTree ast = cel.compile("[1] + [2]").getAst();
-
-    CelEvaluationException e =
-        assertThrows(CelEvaluationException.class, () -> cel.createProgram(ast).eval());
-    assertThat(e).hasMessageThat().contains("No matching overload for function '_+_'");
-    assertThat(e.getErrorCode()).isEqualTo(CelErrorCode.OVERLOAD_NOT_FOUND);
-  }
-
   @Test
   public void program_comprehensionDisabled_throws() throws Exception {
     Cel cel =

common/BUILD.bazel

@@ -79,6 +79,12 @@ cel_android_library(
     exports = ["//common/src/main/java/dev/cel/common:cel_source_android"],
 )
 
+java_library(
+    name = "cel_source_helper",
+    visibility = ["//:internal"],
+    exports = ["//common/src/main/java/dev/cel/common:cel_source_helper"],
+)
+
 java_library(
     name = "cel_ast",
     exports = ["//common/src/main/java/dev/cel/common:cel_ast"],
@@ -108,9 +114,6 @@ java_library(
     visibility = [
         "//:internal",
         # TODO: Remove references to the following clients
-        "//java/com/google/abuse/admin/notebook/compiler/checkedtypes:__pkg__",
-        "//java/com/google/paymentfraud/v2/util/featurereplay/common/risklogrecordio:__pkg__",
-        "//java/com/google/payments/consumer/growth/treatmentconfig/management/backend/service/config/utils:__pkg__",
     ],
     exports = ["//common/src/main/java/dev/cel/common:cel_descriptor_util"],
 )

common/internal/BUILD.bazel

@@ -11,6 +11,11 @@ java_library(
     exports = ["//common/src/main/java/dev/cel/common/internal"],
 )
 
+java_library(
+    name = "code_point_stream",
+    exports = ["//common/src/main/java/dev/cel/common/internal:code_point_stream"],
+)
+
 java_library(
     name = "comparison_functions",
     exports = ["//common/src/main/java/dev/cel/common/internal:comparison_functions"],