Experimental: disable derived test.xml spawn - #15
Closed
alexeagle wants to merge 5068 commits into
Closed
Conversation
numAvailableConnections() is called under lock but the connection creation happens outside of the lock so it's possible for the remote_max_concurrency_per_connection number of rpcs per connection to be exceeded. This change makes the token acquisition happen under lock, while deferring the connection creation. Closes bazelbuild#29693. PiperOrigin-RevId: 926053103 Change-Id: I8cacb67ef7be1ffb338a7880d084b83074974914
This change extends the Bazel Args API and C++ rules to allow explicit naming of command-line parameter files. This will be leveraged in a follow on change to improve the name of the LTO indexing action params file. PiperOrigin-RevId: 926071106 Change-Id: Iee0217d840fedd0173622e655f6247592bac46f1
…actions:actions` ... ... to not have `srcs` also contained in other targets. If two targets contain the same class file, this can lead to one-version failures in coverage runs if the `--instrumentation_filter` only includes one of the targets[^1]. PiperOrigin-RevId: 926071880 Change-Id: Id97103b95c788293ab83fe88b30ee6b55406b71f
…elbuild#29655) Implements [Hierarchical constraint settings](https://docs.google.com/document/d/1Lq-0aPBOT0cat1wcFbnPmurbyo05NpZXu0uGq12H_HE) ([discussion bazelbuild#28877](bazelbuild#28877)). Adds a new optional, label-valued `refines_constraint_value` attribute on `constraint_setting`. This lets a `constraint_setting` express that any of its `constraint_value`s refine (i.e., imply) a particular `constraint_value` of another setting (e.g. a `//libc/glibc:version` setting refining `//libc:glibc`). This has two consequences: * **Platform validation.** Any `platform` that declares a non-default `constraint_value` for a refining setting must also declare the refined `constraint_value` (directly or via a parent platform). Bazel reports an actionable error including a `buildozer` fixup. * **`select()` specificity.** A condition that matches via a refining `constraint_value` is treated as more specific than a condition that matches only via the refined `constraint_value`, so both can co-exist in the same `select()` without producing an "ambiguous match" error. > Note: the design doc calls this attribute `refines_value`. It is renamed to `refines_constraint_value` here for symmetry with `default_constraint_value`. RELNOTES: The new `refines_constraint_value` attribute on `constraint_setting` can be used to indicate that any non-default value for that setting specified on a `platform` requires the refined value to also be specified. Closes bazelbuild#29655. PiperOrigin-RevId: 926078211 Change-Id: Ic82738f2771adf7469f267aeea9dc020f203f8e5
PiperOrigin-RevId: 926160802 Change-Id: Ied6dbb52ab6a8196fa93a791fe319d70b8345782
PiperOrigin-RevId: 926169693 Change-Id: Ic0ec7f7225de42bd692d654b1df4099f012900bc
Bumps the github-actions group with 5 updates: | Package | From | To | | --- | --- | --- | | [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.19.0` | `2.19.4` | | [bazelbuild/continuous-integration](https://github.com/bazelbuild/continuous-integration) | `ee5ba8422a610abe834d379252881d903890d560` | `8fae15fdb0532109a35cae0ca16041fc424c0a9b` | | [actions/labeler](https://github.com/actions/labeler) | `6.0.1` | `6.1.0` | | [github/codeql-action](https://github.com/github/codeql-action) | `4.35.2` | `4.36.0` | | [actions/stale](https://github.com/actions/stale) | `10.2.0` | `10.3.0` | Updates `step-security/harden-runner` from 2.19.0 to 2.19.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/step-security/harden-runner/releases">step-security/harden-runner's releases</a>.</em></p> <blockquote> <h2>v2.19.4</h2> <h2>What's Changed</h2> <ul> <li>Improvements for HTTPS Monitoring for the Enterprise tier of Harden Runner</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/step-security/harden-runner/compare/v2.19.3...v2.19.4">https://github.com/step-security/harden-runner/compare/v2.19.3...v2.19.4</a></p> <h2>v2.19.3</h2> <h2>What's Changed</h2> <ul> <li>Default to audit mode when api-key missing with use-policy-store by <a href="https://github.com/varunsh-coder"><code>@varunsh-coder</code></a> in <a href="https://redirect.github.com/step-security/harden-runner/pull/665">step-security/harden-runner#665</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/step-security/harden-runner/compare/v2.19.2...v2.19.3">https://github.com/step-security/harden-runner/compare/v2.19.2...v2.19.3</a></p> <h2>v2.19.2</h2> <h2>What's Changed</h2> <ul> <li>Update the Harden Runner agent for enterprise tier to use go 1.26 and fix minor bugs.</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/step-security/harden-runner/compare/v2.19.1...v2.19.2">https://github.com/step-security/harden-runner/compare/v2.19.1...v2.19.2</a></p> <h2>v2.19.1</h2> <h2>What's Changed</h2> <ul> <li>fix: detect ubuntu-slim runners early and bail out by <a href="https://github.com/devantler"><code>@devantler</code></a> in <a href="https://redirect.github.com/step-security/harden-runner/pull/657">step-security/harden-runner#657</a></li> </ul> <p>What the fix changes</p> <ul> <li>Harden-Runner will detect <code>ubuntu-slim</code> runners and exit cleanly with an informational log message, instead of post harden runner step failing on chown: invalid user: 'undefined'.</li> </ul> <p>What the fix does not do</p> <ul> <li>Jobs running on <code>ubuntu-slim</code> will not be monitored by Harden-Runner. The agent relies on kernel-level features (that require elevated capabilities).</li> <li>Per GitHub's docs on <a href="https://docs.github.com/en/actions/reference/runners/github-hosted-runners#single-cpu-runners">single-CPU runners</a>: "The container for ubuntu-slim runners runs in unprivileged mode. This means that some operations requiring elevated privileges such as mounting file systems, using Docker-in-Docker, or accessing low-level kernel features are not supported." Those low-level kernel features are what the agent needs, so monitoring inside the unprivileged container is not feasible today.</li> </ul> <p>For StepSecurity enterprise customers If your security posture requires that workflows are always monitored, you can block the use of <code>ubuntu-slim</code> via workflow run policies see the <a href="https://docs.stepsecurity.io/workflow-run-policies/policies#runner-label-policy">Runner Label Policy</a> docs. This lets you enforce that jobs only run on monitored runner types.</p> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/devantler"><code>@devantler</code></a> made their first contribution in <a href="https://redirect.github.com/step-security/harden-runner/pull/657">step-security/harden-runner#657</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/step-security/harden-runner/compare/v2.19.0...v2.19.1">https://github.com/step-security/harden-runner/compare/v2.19.0...v2.19.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/step-security/harden-runner/commit/9af89fc71515a100421586dfdb3dc9c984fbf411"><code>9af89fc</code></a> Merge pull request <a href="https://redirect.github.com/step-security/harden-runner/issues/667">#667</a> from step-security/update-agent-v1.8.6</li> <li><a href="https://github.com/step-security/harden-runner/commit/485dce8cb5d75cda51e8bfa947de06030d080208"><code>485dce8</code></a> Update agent to v1.8.6</li> <li><a href="https://github.com/step-security/harden-runner/commit/ab7a9404c0f3da075243ca237b5fac12c98deaa5"><code>ab7a940</code></a> Merge pull request <a href="https://redirect.github.com/step-security/harden-runner/issues/665">#665</a> from step-security/fix/use-policy-store-default-audit</li> <li><a href="https://github.com/step-security/harden-runner/commit/ec41b783c27ed7f0db6855a6d9970abd4572858c"><code>ec41b78</code></a> Default to audit mode when api-key missing with use-policy-store</li> <li><a href="https://github.com/step-security/harden-runner/commit/9ca718d3bf646d6534007c269a635b3e54cadf99"><code>9ca718d</code></a> Merge pull request <a href="https://redirect.github.com/step-security/harden-runner/issues/664">#664</a> from step-security/update-agent-v1.8.5</li> <li><a href="https://github.com/step-security/harden-runner/commit/1dee3df8d29f4225c582eee2ddb6053ca616c0df"><code>1dee3df</code></a> Update agent to v1.8.5</li> <li><a href="https://github.com/step-security/harden-runner/commit/a5ad31d6a139d249332a2605b85202e8c0b78450"><code>a5ad31d</code></a> Merge pull request <a href="https://redirect.github.com/step-security/harden-runner/issues/657">#657</a> from devantler/fix/ubuntu-slim-user-env</li> <li><a href="https://github.com/step-security/harden-runner/commit/6e928567d74554b8842dd434908da31c593ba85c"><code>6e92856</code></a> build dist and trim ubuntu-slim message</li> <li><a href="https://github.com/step-security/harden-runner/commit/4e0504ee086374bdec7064e5c26d48af41ba6209"><code>4e0504e</code></a> Merge branch 'main' into fix/ubuntu-slim-user-env</li> <li><a href="https://github.com/step-security/harden-runner/commit/376d25a97f3a1640ff8cbbddaa4af25948df2cf3"><code>376d25a</code></a> fix: detect ubuntu-slim runners early and bail out</li> <li>See full diff in <a href="https://github.com/step-security/harden-runner/compare/8d3c67de8e2fe68ef647c8db1e6a09f647780f40...9af89fc71515a100421586dfdb3dc9c984fbf411">compare view</a></li> </ul> </details> <br /> Updates `bazelbuild/continuous-integration` from ee5ba84 to 8fae15f <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/bazelbuild/continuous-integration/blob/master/docs/release-playbook.md">bazelbuild/continuous-integration's changelog</a>.</em></p> <blockquote> <h1>Bazel Release Playbook</h1> <p>This is the guide to conducting a Bazel release. This is especially relevant for release managers, but will be of interest to anyone who is curious about the release process.</p> <h2>Preface</h2> <blockquote> <p>For future reference and release managers - the release manager playbook should be treated like an IKEA manual. That means: Do not try to be smart, optimize / skip / reorder steps, otherwise chaos will ensue. Just follow it and the end result will be.. well, a usable piece of furniture, or a Bazel release (depending on the manual).</p> <p>Like aviation and workplace safety regulations, the playbook is written in the tears and blood of broken Bazelisks, pipelines, releases and Git branches. Assume that every step is exactly there for a reason, even if it might not be obvious. If you follow them to the letter, they are not error prone. Errors have only happened in the past, when a release manager thought it's ok to follow them by spirit instead. ;)</p> <p>-- <a href="https://github.com/philwo"><code>@philwo</code></a></p> </blockquote> <h2>One-time setup</h2> <p>These steps only have to be performed once, ever.</p> <ul> <li>Make sure you are a member of the Bazel <a href="https://github.com/orgs/bazelbuild/teams/release-managers/members">Release Managers</a> team on GitHub.</li> <li>Make sure you are a member of the Bazel <a href="https://buildkite.com/organizations/bazel-trusted/teams/release-managers/members">release-managers</a> group on BuildKite. If that link does not work for you, ask one of the Buildkite org admins to add you to the group.</li> <li>Set up github ssh key if you haven't already. <ul> <li><a href="https://help.github.com/articles/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent/">https://help.github.com/articles/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent/</a></li> </ul> </li> <li>Generate a new identifier for Google's internal Git mirror: <a href="https://bazel.googlesource.com/new-password">https://bazel.googlesource.com/new-password</a> (and paste the code in your shell).</li> <li>Log in to the Gerrit UI to create an account: <a href="[] </ul> <h2>Preparing a new release</h2> <ol> <li><a href="https://github.com/bazelbuild/bazel/milestones/new">Create a release blockers milestone</a> named "X.Y.Z release blockers" (case-sensitive), where we keep track of issues that must be resolved before the release goes out. <ul> <li>Set the (tentative) release date.</li> <li>Add this description: <code>Issues that need to be resolved before the X.Y.Z release.</code>.</li> <li>Refer to <a href="https://github.com/bazelbuild/bazel/milestone/38">this example</a></li> </ul> </li> <li><a href="https://github.com/bazelbuild/bazel/issues/new?assignees=&labels=release%2Cteam-OSS%2CP1%2Ctype%3A+process&template=release.md&title=Release+X.Y+-+%24MONTH+%24YEAR">Create a release tracking issue</a> to keep the community updated about the progress of the release. <a href="https://redirect.github.com/bazelbuild/bazel/issues/16159">See example</a>. Pin this issue.</li> <li>Create the branch for the release. The branch should always be named <code>release-X.Y.Z</code> (the <code>.Z</code> part is important). Cherry-pick PRs will be sent against this branch. <ul> <li>The actual creation of the branch can be done via the GitHub UI or via the command line. For minor and patch releases, create the branch from the previous release tag, if possible. How we choose the base commit of the branch depends on the type of the release:</li> <li>For patch releases (<code>X.Y.Z</code> where <code>Z>0</code>), the base commit should simply be <code>X.Y.(Z-1)</code>.</li> <li>For minor releases (<code>X.Y.0</code> where <code>Y>0</code>), the base commit should typically be <code>X.(Y-1).<current max Z></code>.</li> <li>For major releases (<code>X.0.0</code>), the base commit is some "healthy" commit on the main branch. <ul> <li>This means that there's an extra step involved in preparing the release -- "cutting" the release branch, so to speak. For this, check the <a href="https://buildkite.com/bazel/bazel-with-downstream-projects-bazel">Bazel@HEAD+Downstream pipeline</a>. The branch cut should happen on a green commit there; if the pipeline is persistently red, work with the Green Team to resolve it first and delay the branch cut as needed.</li> <li>A first release candidate should immediately be created after the release branch is created. See <a href="https://github.com/bazelbuild/continuous-integration/blob/master/docs/#create-a-release-candidate">create a release candidate</a> below.</li> </ul> </li> </ul> </li> </ol> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/7211b7c8077ea37d8641b6271f6a365a22a5fbfa"><code>7211b7c</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3927">#3927</a> from github/update-v4.36.0-ebc2d9e2b</li> <li><a href="https://github.com/github/codeql-action/commit/7740f2fb21add1d46278215acea47540db22f022"><code>7740f2f</code></a> Update changelog for v4.36.0</li> <li><a href="https://github.com/github/codeql-action/commit/ebc2d9e2bc247eec51bee8d4df806c4030eb0761"><code>ebc2d9e</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3926">#3926</a> from github/update-bundle/codeql-bundle-v2.25.5</li> <li><a href="https://github.com/github/codeql-action/commit/d1f74b777c95c777bf4f42ce4b250bc916e745c7"><code>d1f74b7</code></a> Add changelog note</li> <li><a href="https://github.com/github/codeql-action/commit/2dc40cec39bdc63d3561d74fa6100cebb0418ff4"><code>2dc40ce</code></a> Update default bundle to codeql-bundle-v2.25.5</li> <li><a href="https://github.com/github/codeql-action/commit/84498526a009a99c875e83ef4821a8ba52de7c22"><code>8449852</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3910">#3910</a> from github/henrymercer/repo-size-diff-check</li> <li><a href="https://github.com/github/codeql-action/commit/72ac23c6d16b29fbe801e87e3439941558c53094"><code>72ac23c</code></a> Update excluded required check list</li> <li><a href="https://github.com/github/codeql-action/commit/c5297a28a2c3e6a8062041b58858bd7117cebe37"><code>c5297a2</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3919">#3919</a> from github/henrymercer/workflow-concurrency</li> <li><a href="https://github.com/github/codeql-action/commit/8ffeae7d05bc1b914a009d197e64e4f5c9e14503"><code>8ffeae7</code></a> CI: Automatically cancel non-generated workflows</li> <li><a href="https://github.com/github/codeql-action/commit/f3f52bf568dc44a1069faafa538caa6b1fec40c9"><code>f3f52bf</code></a> Revert <code>getErrorMessage</code> import</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/95e58e9a2cdfd71adc6e0353d5c52f41a045d225...7211b7c8077ea37d8641b6271f6a365a22a5fbfa">compare view</a></li> </ul> </details> <br /> Updates `actions/stale` from 10.2.0 to 10.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/stale/releases">actions/stale's releases</a>.</em></p> <blockquote> <h2>v10.3.0</h2> <h2>What's Changed</h2> <h3>Bug Fix</h3> <ul> <li>Enhancement: ignore stale labeling events by <a href="https://github.com/shamoon"><code>@shamoon</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1311">actions/stale#1311</a></li> </ul> <h3>Dependency Updates</h3> <ul> <li>Upgrade dependencies (<code>@actions/core</code>, <code>@octokit/plugin-retry</code>, <a href="https://github.com/typescript-eslint"><code>@typescript-eslint</code></a>) by <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1335">actions/stale#1335</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/shamoon"><code>@shamoon</code></a> made their first contribution in <a href="https://redirect.github.com/actions/stale/pull/1311">actions/stale#1311</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/stale/compare/v10...v10.3.0">https://github.com/actions/stale/compare/v10...v10.3.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/stale/commit/eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899"><code>eb5cf3a</code></a> chore: upgrade dependencies and bump version to 10.3.0 (<a href="https://redirect.github.com/actions/stale/issues/1335">#1335</a>)</li> <li><a href="https://github.com/actions/stale/commit/db5d06a4c82d5e94513c09c406638111df61f63e"><code>db5d06a</code></a> Enhancement: ignore stale labeling events (<a href="https://redirect.github.com/actions/stale/issues/1311">#1311</a>)</li> <li>See full diff in <a href="https://github.com/actions/stale/compare/b5d41d4e1d5dceea10e7104786b73624c18a190f...eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Closes bazelbuild#29699. PiperOrigin-RevId: 926183737 Change-Id: I76eeb08fe178adacffb381692eb4178bcda1b291
Bumps [idna](https://github.com/kjd/idna) from 3.11 to 3.15. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/kjd/idna/blob/master/HISTORY.md">idna's changelog</a>.</em></p> <blockquote> <h2>3.15 (2026-05-12)</h2> <ul> <li>Enforce DNS-length cap on individual labels early in <code>check_label</code>, short-circuiting contextual-rule processing for oversized input while staying compatible with UTS 46 usage.</li> <li>Tidy core helpers: hoist bidi category sets to module-level frozensets (avoiding per-codepoint list construction), simplify length checks, and reuse the shared <code>_unicode_dots_re</code> from <code>idna.core</code> in the codec module.</li> <li>Use <code>raise ... from err</code> for proper exception chaining and switch internal string formatting to f-strings.</li> <li>Allow <code>flit_core</code> 4.x in the build backend.</li> <li>Expand the ruff lint set (flake8-bugbear, flake8-simplify, pyupgrade, perflint) and apply the surfaced fixes; pin lint CI to Python 3.14.</li> <li>Add Dependabot configuration for GitHub Actions.</li> <li>Convert README and HISTORY from reStructuredText to Markdown.</li> <li>Reference CVE-2026-45409 for the 3.14 advisory in place of the initial GHSA identifier.</li> </ul> <p>Thanks to Felix Yan, Stan Ulbrych, and metsw24-max for contributions to this release.</p> <h2>3.14 (2026-05-10)</h2> <ul> <li>Removed opportunity to process long inputs into quadratic time by rejecting oversize inputs up-front. Closes a bypass of the CVE-2024-3651 mitigation. [CVE-2026-45409]</li> </ul> <p>Thanks to Stan Ulbrych for reporting the issue.</p> <h2>3.13 (2026-04-22)</h2> <ul> <li>Correct classification error for codepoint U+A7F1</li> </ul> <h2>3.12 (2026-04-21)</h2> <ul> <li>Update to Unicode 17.0.0.</li> <li>Issue a deprecation warning for the transitional argument.</li> <li>Added lazy-loading to provide some performance improvements.</li> <li>Removed vestiges of code related to Python 2 support, including segmentation of data structures specific to Jython.</li> </ul> <p>Thanks to Rodrigo Nogueira for contributions to this release.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/kjd/idna/commit/af30a092e158181d0b35ac66dfa813788126bdd8"><code>af30a09</code></a> Release 3.15</li> <li><a href="https://github.com/kjd/idna/commit/30314d4628744ca14cf2b5820564e5127a9f86f2"><code>30314d4</code></a> Pre-release 3.15rc0</li> <li><a href="https://github.com/kjd/idna/commit/05d4b219aa9eddc47371fcbd2000f0301016f3e9"><code>05d4b21</code></a> Merge pull request <a href="https://redirect.github.com/kjd/idna/issues/237">#237</a> from kjd/convert-docs-to-markdown</li> <li><a href="https://github.com/kjd/idna/commit/2987fdba1962bbb2358399e0084ba062b98a0bee"><code>2987fdb</code></a> Convert README and HISTORY from reStructuredText to Markdown</li> <li><a href="https://github.com/kjd/idna/commit/59fa8002d514bf4a5ce7b58f67b9ec587d53fa9c"><code>59fa800</code></a> Merge pull request <a href="https://redirect.github.com/kjd/idna/issues/236">#236</a> from kjd/dependabot/github_actions/actions-f3e34333ea</li> <li><a href="https://github.com/kjd/idna/commit/def69834ced5d4b3c50439d8b99c4c856ec19ca2"><code>def6983</code></a> Merge branch 'master' into dependabot/github_actions/actions-f3e34333ea</li> <li><a href="https://github.com/kjd/idna/commit/bbd8004a797185d8c56bb555cd5c88fde05e0631"><code>bbd8004</code></a> Merge pull request <a href="https://redirect.github.com/kjd/idna/issues/234">#234</a> from StanFromIreland/patch-1</li> <li><a href="https://github.com/kjd/idna/commit/edd07c05024344a6ccb517414ccb36683aee99fc"><code>edd07c0</code></a> Bump github/codeql-action from 3.35.2 to 4.35.2 in the actions group</li> <li><a href="https://github.com/kjd/idna/commit/5557db030c11bdec50d62aa5f631d705d33ba123"><code>5557db0</code></a> Merge branch 'master' into patch-1</li> <li><a href="https://github.com/kjd/idna/commit/f11746cf4981d25123ef7830d3ee60f07de8ae3d"><code>f11746c</code></a> Merge pull request <a href="https://redirect.github.com/kjd/idna/issues/235">#235</a> from StanFromIreland/patch-2</li> <li>Additional commits viewable in <a href="https://github.com/kjd/idna/compare/v3.11...v3.15">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/bazelbuild/bazel/network/alerts). </details> Closes bazelbuild#29598. PiperOrigin-RevId: 926199751 Change-Id: I5aa16e83d6e270cc326d380167b44c42748ac47b
… in MODULE.blazel file Also see bazelbuild#29402. PiperOrigin-RevId: 926207178 Change-Id: I91829b58548f678c37e4c31d28337027f41c33d3
Baseline: fdba6e6 Important changes: - CDC chunk uploads and downloads can now happen in parallel within a large blob. This release contains contributions from many people at Google, as well as Benjamin Peterson, Tyler French, XananasX.
The roadmap page was retired from the unversioned narrative documentation on the master branch in commit 2e72f2f (chore: remove outdated roadmap) because the 2025 planning projection had become stale. Context bazelbuild#29135 Closes bazelbuild#29703. PiperOrigin-RevId: 926211279 Change-Id: I8c25ae7c13b2b371b1e633621dc5c3cb94d14508
Remove the obsolete `QueuePool` class and simplify the public API of `EagerRequestBatcher` by accepting `maxBatchSize` directly as an integer. PiperOrigin-RevId: 926216029 Change-Id: I99072ea8e0e12c2031ffd320fb1a5cf88c4c235a
…y value. Codecs can choose on a per-object basis during serialization, laying the groundwork for deterministic serialization of interned objects. - Rename `MemoizationStrategy` to `MemoizationTiming` (`BEFORE`/`AFTER`). - Introduce `MemoizationEquality` (`BY_REFERENCE`/`BY_VALUE`) and add `getMemoizationEquality(T obj)` to determine the behavior dynamically. PiperOrigin-RevId: 926273630 Change-Id: I7564e38d0a7e639c9a6baf2eabb0d78039e70fa2
…ationEquality#BY_VALUE`. To prevent serialization nondeterminism, `StarlarkInfoWithSchemaCodec` is updated to memoize internable instances using value equality rather than reference equality. Also incorporate the `StarlarkFloat` exclusion from unknown commit. PiperOrigin-RevId: 926323299 Change-Id: I85c2e1c21b85aa2d26c557f9f7a72b46881041d0
PiperOrigin-RevId: 926657433 Change-Id: Ife6985b842f8711b7b168caf555ae8048bbd834e
This was leftover from a previous cleanup. PiperOrigin-RevId: 926664812 Change-Id: I7ef8d442517ac4cc838c54b5826af79cbd25d0d9
… the `map_directory` action (bazelbuild#29642) ### Description Fix the link to the `ExpandedDirectory` page in the doc of the [map_directory](https://bazel.build/rules/lib/builtins/actions#map_directory) action for the `implementation` parameter. ### Motivation No ### Build API Changes No ### Checklist - [ ] I have added tests for the new use cases (if any). - [X] I have updated the documentation (if applicable). Closes bazelbuild#29642. PiperOrigin-RevId: 926703431 Change-Id: I8e61d65a660fe2871649457c3c8dfadd3e3c6cc9
PiperOrigin-RevId: 926711485 Change-Id: I3b9ec0e01f2649e72be20fa2ad89df8568624f62
Replace the `ImmutableList<String>` with a mapping of field names to their index in the sorted schema. This enables O(1) lookups instead of binary search. PiperOrigin-RevId: 926734807 Change-Id: If6ca739306abb1d1f222b9512a6b4e7446bd2aa7
PiperOrigin-RevId: 926798856 Change-Id: I024a75b153f615a9258f208b3a9b9057990e9564
In the previous serialization scheme, Bazel assigned an integer "tag" number on startup to all ObjectCodecs and serializable constants. These assignments depended on what classes were on the classpath and were only guaranteed to be consistent within that exact Bazel version. Now each integer "tag" is accompanied by a `WireType`, acting as a namespace for tags. Codecs and Constants will use the `CodecWireType.UNSTABLE` and `ConstantWireType.UNSTABLE` by default and inherit the previous behavior: assignments are consistent only within an exact Bazel version. The encoding of the `(tag number, wire-type)` pair is identical to the protocol buffers field number wire encoding. Classes that exist in Bazel may opt in to `CodecWireType.STABLE_PUBLIC`/`ConstantWireType.STABLE_PUBLIC`, declaring that their tag assignment will never change in future versions of a build tool based on Bazel. Similarly, classes that are introduced by private forks of Bazel (like Google's Blaze) may opt in to `CodecWireType.STABLE_PRIVATE`/`ConstantWireType.STABLE_PRIVATE`. These wire types are separate to ensure there is no need for a confusing coordination process between any particular private tag registry and a public tag registry. `WireType.Backreference` is introduced to simplify a quirk in how the previous encoding scheme implemented memoized serialization. Instead of using negative integers to encode backreferences we can simply use a new `WireType`. One `WireType` remains unallocated and may be used in the future for arbitrary purposes. No actual codecs/constants are enrolled in stable serialization with this change. See issue bazelbuild#29375 for more details. RELNOTES: Bazel's serialization system now has a new wire encoding that supports preserving how values are serialized across Bazel versions. PiperOrigin-RevId: 926812288 Change-Id: I7591a9578d28f31fbd055358a0719d9459b4115e
PiperOrigin-RevId: 926852071 Change-Id: Iaaa87d7c5e3b50da58100b2d0692e92c50dc1494
Disable StarlarkJavaLiteProtoLibraryTest.testBinaryDeps. END_PUBLIC PiperOrigin-RevId: 926860320 Change-Id: I6e17f15bcae2033edbe8721c8f421ba3da2b4426
…le_support version. PiperOrigin-RevId: 927300343 Change-Id: If2e523cd25f03cf2d8fb2a9209ff30e22e4e3126
…ollection APIs. Replaces `Collections.sort` with `List.sort`, iterates over `Map.values()` instead of `entrySet()` when only values are needed, and uses `Collection.removeIf` for filtering. RELNOTES: n/a PiperOrigin-RevId: 927320716 Change-Id: If3bc361caaa2201427632c37c48d9de31ac458c5
…sentations. Implements the "Better union abstraction" concept from b/502962607. Spawns frequently union the inputs of their owning action (obtained via `Action#getInputs`) with additional files like parameter files. Previously, `Spawn#getInputFiles` returned a `NestedSet`, which forced the creation of a new `NestedSet` instance for this union. This prevented reuse of the cached list representation of the action's inputs populated during flattening. This change introduces `SpawnInputs`, which represents the inputs to a `Spawn` as a lazy union of up to two nested sets and a list of additional inputs. `SpawnInputs#flatten` lazily concatenates the underlying lists, avoiding the allocation of a merged list and the reconstruction of a nested set during iteration. Benchmarks confirm statistically significant reductions in CPU, wall time, and garbage generation during large builds. PiperOrigin-RevId: 927400959 Change-Id: I00bd575427198e3ee3fe264d19a404454296867f
…#29475) Previously you could only put constraint_values directly in target_compatible_with. Therefore for other configs you had to do something like: ```bzl target_compatible_with = select({ ":my_config_setting": [], "//conditions:default": ["@platforms//:incompatible"], }) ``` Now you can inline that just like config settings: ```bzl target_compatible_with = [":my_config_setting"], ``` Fixes bazelbuild#21857 Closes bazelbuild#29475. PiperOrigin-RevId: 927432687 Change-Id: Ia76951fe673304a1b6c7e22757586362643c1366
…9232) ### Description This change alters the behavior of the project scope so that flags explicitly defined with this scope correctly propagate through exec transitions instead of being systematically stripped. At target-configuration time, BuildConfigurationKeyProducer enforces the project boundary restrictions. If a target is evaluated outside of the directories defined by its associated PROJECT.scl, the flag value is gracefully reset to its baseline execution defaults. This PR addresses two NullPointerExceptions surfaced when flags propagate natively through these headless environments: 1. Exec configuration and top-level testing pathways frequently parse configurations without assigned target labels (label == null). BuildConfigurationKeyProducer.resetFlags() has been null-guarded to gracefully wipe project-scoped flags from the evaluated configuration when there is no target label context. 2. An edge-case NPE has been fixed where un-scoped Starlark variables dynamically injected back into the options map without corresponding scopeTypeMap metadata incorrectly triggered a verification failure during loop validation. Updated BuildConfigurationValueTest behavior to test execution options against AnalysisTestUtil.execOptions directly instead of artificially piping through getConfiguration() tests (which obscured the transitions raw output since createExec() silently dropped unsupported scopes). Added detailed tests to BuildConfigurationKeyProducerTest explicitly validating boundary enforcement inside and outside of project trees as well as providing guaranteed protection against these headless/null evaluation situations. ### Motivation See bazelbuild#28320 ### Build API Changes Yes - it changes the behaviour of the 'project' scope flag. ### Checklist - [x] I have added tests for the new use cases (if any). - [ ] I have updated the documentation (if applicable). ### Release Notes RELNOTES: None Closes bazelbuild#29232. PiperOrigin-RevId: 927480714 Change-Id: Ia721c4312a373081e024232d6ca3981dceaae18c
### Description This change extracts setup logic for remote repo content caching from the gRPC path so it can be shared with the HTTP/disk path. ### Motivation Remote repo content caching is currently only initialized for gRPC cache backends. The `--experimental_remote_repo_contents_cache` flag is a no-op when using a cache backend like GCS. ### Build API Changes No ### Checklist - [x] I have added tests for the new use cases (if any). - [ ] I have updated the documentation (if applicable). ### Release Notes RELNOTES: Fixed repo content caching for non-gRPC cache backends. Closes bazelbuild#29744. PiperOrigin-RevId: 928545624 Change-Id: Ib811c85d0c2462f91a8a8114640d58edf5b4c0a3
…ycache_analysis_only`. PiperOrigin-RevId: 928573533 Change-Id: I3fd81d74abae8d975ea739aa1d85c85fc12455c1
PiperOrigin-RevId: 941634047 Change-Id: I4cc5083090de0dd3084060a6b1dc67978be62865
Exclude the `GrepIncludes` mnemonic from `--strategy_regexp` matching to prevent include scanning spawns from picking up incorrect strategies (e.g., local execution) if their progress messages or filenames (e.g., `LinkGraphLinkingLayer.h`) match a general strategy regex like "Linking". PiperOrigin-RevId: 941727447 Change-Id: I7a2a62dee50d0af30657389192f76c70ad180f00
bazelbuild#30004) ### Description Adds an integration test for the `FileContentsProxy` optimization of the remote repo contents cache (PR bazelbuild#28654) and proves that the part of the PR reverted in 741ee01 isn't relevant - it only applies to outputs, but external repo files are always source files. ### Motivation PR bazelbuild#28654 added the contents proxy optimization for the remote repo contents cache but landed without a test. This adds coverage so the injection-site behavior can't silently regress. Closes bazelbuild#29976 ### Build API Changes No ### Checklist - [x] I have added tests for the new use cases (if any). - [ ] I have updated the documentation (if applicable). ### Release Notes RELNOTES: None Closes bazelbuild#30004. PiperOrigin-RevId: 941950605 Change-Id: Iaf770c416d7496d002db44d77105b36975dded6a
bazelbuild#30069) …xecution Fixes bazelbuild#25754 Closes bazelbuild#30069. PiperOrigin-RevId: 942017787 Change-Id: I8bf83d0a944616f77573751a86b1b9cbed1385ab
Allow source artifacts to have null owner in createLabelCause, as source artifacts can legitimately have null owner (e.g. if created with NULL_OWNER during include scanning). PiperOrigin-RevId: 942052854 Change-Id: Ib272cfe11f5c5464e0058ea8aab6590c55d76bbd
PiperOrigin-RevId: 942079883 Change-Id: I7f53f41a0cf3548b4298878bf6b2eb574322520d
This CL converts `NativePosixFilesService.StatErrorHandling` from an `enum` to a `final class` to remove it from the Skybridge interface exemption list. We refactored: - `NativePosixFilesService.java` to define `StatErrorHandling` as a `final class` with a `char code` field and boilerplate. No changes were needed in the JNI implementation as the native methods already accept `char` instead of the enum type. PiperOrigin-RevId: 943148997 Change-Id: I35e2dd639ace823ca65b552c44105558c2da8892
PiperOrigin-RevId: 943169073 Change-Id: I145932faf6cccd05db7bd0a2fb89647ed58261b9
PiperOrigin-RevId: 943211755 Change-Id: I1fd04dd6ecde98eaf422d13fd3e4c62634fc1628
This cuts down the amount of work done in the shutdown hook since only a single walk of the Java bytecode needs to be done. This also simplifies the formatter code and tests; we don't need to conform to Jacoco's visitor API nor mock anything. This slightly changes the names of functions recorded in the output file. Previously the name of a function was "className.methodName" but now the class name used is subject to the "execPaths" remapping. We also need to change the analyzer to skip synthetic classes in the same way Jacoco does. This was not an issue when we just recorded branch coverage, but matters now. PiperOrigin-RevId: 943242319 Change-Id: I4f7de2f42eb8ad99aea7022b80fbcf69cc092777
These are only ever not passed for test cases and it's easy to change those. The additional complexity is not worth unused flexibility. PiperOrigin-RevId: 943257839 Change-Id: Ia3a33b760504c89173ae26925880e28995fb23ba
PiperOrigin-RevId: 943273009 Change-Id: I23dfb97f19bcc6f64792a955141da0c913b9f5b1
This CL converts `BuildEventServiceClient.AbortReason` from an `enum` to a `final class` to remove it from the Skybridge interface exemption list. PiperOrigin-RevId: 943322247 Change-Id: Ia6892d873df1b01f6a367a599e5b1c61f8398a75
This CL converts `LifecycleEvent.InvocationStatus` from an `enum` to a `final class` to remove it from the Skybridge interface exemption list. We refactored: - `LifecycleEvent.java` to define `InvocationStatus` as a `final class`. - `BuildEventServiceProtoUtil.java` to refactor the `switch` on `InvocationStatus` to `if-else`. PiperOrigin-RevId: 943340118 Change-Id: I9398f0ec6bdf4c777c6ce002259fd92b5f646a95
This CL converts `CounterSeriesTask.Color` from an `enum` to a `static final class` to remove it from the Skybridge interface exemption list. We refactored: - `CounterSeriesTask.java` to define `Color` as a `static final class` with a `value()` method. PiperOrigin-RevId: 943349516 Change-Id: Ie382ac038e375334b66f3bc8a448daa71d4f6699
This CL converts `ProfilePhase` from an `enum` to a `final class` to remove it from the Skybridge interface exemption list. We refactored: - `ProfilePhase.java` to define `ProfilePhase` as a `final class` with a `getPhaseFromDescription` method using a `switch` on the description string. - `PhaseSummaryStatistics.java` to use `LinkedHashMap` instead of `EnumMap`, as `EnumMap` requires an `enum` class. PiperOrigin-RevId: 943370957 Change-Id: Id14cf6f15968ad67b0fc20b9853c15837ac2614d
*** Reason for rollback *** Use close() to free memory in ActionFS. Additionally free the input map and re-populate in updateContext() since close() is called after input discovery. See newly added comment in ActionFS for motivation. *** Original change description *** Don't close action file systems. PiperOrigin-RevId: 943381200 Change-Id: I7454de22a086ac328dcdc33a0d73082c9e7c431d
* Use a dedicated subclass for the very common case where none of the dependency attributes are select statements, and so there is only one possible outcome. This subclass foregoes the lookup table `Map`. * Share a single "default" instance among rules of a given rule class where none of the dependency attributes are explicitly specified, and so they take on their default value. * Use `ImmutableList` for the dependency tuple, using a `NULL_MARKER` object to guarantee that elements are non-null. PiperOrigin-RevId: 943452437 Change-Id: Ifd938115d102aee61e0e009c4b264143c2185051
This test is failing due to a clang update. PiperOrigin-RevId: 943497618 Change-Id: Ib2993df0e60e39c7563280c3393ce69f0c3f0dcf
…ure. PiperOrigin-RevId: 943499349 Change-Id: I6ffcf1f4620bdd8ba34be32161cd17c443b2b0ad
The experimental_* names are set globally in blazerc, so suppress deprecation warnings when users continue using the old flag names.
Resolve conflict in BazelRulesModule.java by keeping both the execution graph graveyard flags and the new test support compile-time deps flag.
Comment out the generate-xml.sh follow-on spawn so we can observe checkOutputs behavior when tests do not produce test.xml themselves. Not intended for upstream.
Author
|
Closing in favor of a clean branch based on 8.7.0-figma. The original fix_29810 head tracked upstream master (~9.0.0rc1+), which made the diff against 8.7.0-figma misleadingly large. |
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
19 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
generate-xml.shfollow-on spawn inStandaloneTestStrategyfor internal experimentation on 8.7.0-figmacheckOutputsfailure when tests do not produce their owntest.xmlBase
Branch
fix_29810-8.7is based on8.7.0-figma(upstream8.7.0+ figma patches). The priorfix_29810head was incorrectly tracking upstreammaster(~9.0.0rc1+), which caused a misleading multi-thousand-commit diff.Test plan
sh_test(no native XML) and confirmACTION_OUTPUTS_NOT_CREATEDfor missingtest.xml