google-ai-edge · copybara-service · Aug 5, 2026
diff --git a/src/builtin-adapter/.bazelrc b/src/builtin-adapter/.bazelrc
@@ -43,6 +43,14 @@ common --experimental_repo_remote_exec
 #
 # Default build options. These are applied first and unconditionally.
 
+build --incompatible_enable_cc_toolchain_resolution
+build --repo_env USE_HERMETIC_CC_TOOLCHAIN=1
+
+# TODO: Migrate for https://github.com/bazelbuild/bazel/issues/7260
+build:clang_local --noincompatible_enable_cc_toolchain_resolution
+build:clang_local --noincompatible_enable_android_toolchain_resolution
+build:clang_local --repo_env USE_HERMETIC_CC_TOOLCHAIN=1
+
 build --copt=-DGRPC_BAZEL_BUILD
 build --host_copt=-DGRPC_BAZEL_BUILD
 build --action_env=GRPC_BAZEL_RUNTIME=1
@@ -178,14 +186,22 @@ build:macos --config=apple-toolchain
 
 # Use cc toolchains from apple_support for Apple builds (ios, macos, etc).
 # https://github.com/bazelbuild/apple_support/tree/master?tab=readme-ov-file#bazel-6-setup
+build:apple-toolchain --config=clang_local
 build:apple-toolchain --apple_crosstool_top=@local_config_apple_cc//:toolchain
 build:apple-toolchain --crosstool_top=@local_config_apple_cc//:toolchain
 build:apple-toolchain --host_crosstool_top=@local_config_apple_cc//:toolchain
 
+# Wheel builds need the installable macOS runtime dylib linked into python
+# extensions and packaged into the wheel.
+build:macos_wheel --config=macos
+build:macos_wheel --define=resolve_symbols_in_exec=false
+
 # Settings for MacOS on ARM CPUs.
+build:macos_arm64 --config=macos
 build:macos_arm64 --cpu=darwin_arm64
+build:macos_arm64 --cxxopt=-std=gnu++17
 build:macos_arm64 --macos_minimum_os=11.0
-build:macos_arm64 --platforms=@build_bazel_apple_support//configs/platforms:darwin_arm64
+build:macos_arm64 --platforms=@build_bazel_apple_support//platforms:macos_arm64
 
 # iOS configs for each architecture and the fat binary builds.
 build:ios --apple_platform_type=ios
@@ -475,7 +491,8 @@ build --config=litert_prefixes
 build --define=disable_tf_lite_py=true
 
 # Config to use a gcs bucket as remote cache.
-build:public_cache --remote_cache="https://storage.googleapis.com/litert-bazel-artifacts" --remote_upload_local_results=false
+# Unset DOCKER_CACHEBUSTER variables to prevent random container injection from breaking action cache keys across CI environments.
+build:public_cache --remote_cache="https://storage.googleapis.com/litert-bazel-artifacts" --remote_upload_local_results=false --action_env=DOCKER_CACHEBUSTER= --action_env=DOCKER_HOST_CACHEBUSTER=
 
 # Cache pushes are limited to CI system.
 # WARNING: THIS OPTION WONT WORK IF YOU DO NOT HAVE PROPER AUTHENTICATION AND PERMISSIONS
@@ -549,11 +566,3 @@ test:bulk_test_cpu --build_tests_only
 # TODO: b/397625618 Enable bzlmod
 common --noenable_bzlmod
 
-# TODO: Migrate for https://github.com/bazelbuild/bazel/issues/7260
-common --noincompatible_enable_cc_toolchain_resolution
-common --noincompatible_enable_android_toolchain_resolution
-
-
-# Disable Hermetic CC toolchains
-build --@rules_ml_toolchain//common:enable_hermetic_cc=False
-build --repo_env USE_HERMETIC_CC_TOOLCHAIN=0
diff --git a/src/builtin-adapter/.bazelversion b/src/builtin-adapter/.bazelversion
@@ -1 +1 @@
-7.4.1
+7.7.0
diff --git a/src/builtin-adapter/WORKSPACE b/src/builtin-adapter/WORKSPACE
@@ -40,9 +40,9 @@ rules_shell_toolchains()
 # b) get the sha256 hash of the commit by running:
 #    curl -L https://github.com/tensorflow/tensorflow/archive/<COMMIT_HASH>.tar.gz | sha256sum
 #    and update TENSORFLOW_SHA256 with the result.
-TENSORFLOW_COMMIT = "9e1afa4e5cfd8818518183211b77f2976c7dc450"
+TENSORFLOW_COMMIT = "bcdab1a62e138c8f8784a7477c0be8af6dd0bd0a"
 
-TENSORFLOW_SHA256 = "c67c2e8c62b55936a3d7705989af57a0eb28a8b97ab7ed95fe294917c6fb0c14"
+TENSORFLOW_SHA256 = "c3c552414ab2e59e72511a21c1df566346a7c8f160909325edec6d1ff403d69d"
 
 http_archive(
     name = "org_tensorflow",
@@ -57,6 +57,34 @@ http_archive(
 # restriction that load() statements need to be at the top of .bzl files.
 # E.g. we can not retrieve a new repository with http_archive and then load()
 # a macro from that repository in the same file.
+# Use 3.22.0 (from 3.5.1 of tensorflow) to fix binary signing issue on MacOS Tahoe.
+http_archive(
+    name = "build_bazel_rules_apple",
+    sha256 = "a78f26c22ac8d6e3f3fcaad50eace4d9c767688bd7254b75bdf4a6735b299f6a",
+    url = "https://github.com/bazelbuild/rules_apple/releases/download/3.22.0/rules_apple.3.22.0.tar.gz",
+)
+
+load(
+    "@build_bazel_rules_apple//apple:repositories.bzl",
+    "apple_rules_dependencies",
+)
+
+apple_rules_dependencies()
+
+http_archive(
+    name = "build_bazel_rules_swift",
+    sha256 = "f7a67197cd8a79debfe70b8cef4dc19d03039af02cc561e31e0718e98cad83ac",
+    url = "https://github.com/bazelbuild/rules_swift/releases/download/2.9.0/rules_swift.2.9.0.tar.gz",
+)
+
+# Lower the version from 1.24.5 that tensorflow uses to 1.23.1, the highest version which don't have
+# issues with missing LC_UUID, DEVELOPER_DIR or SDKROOT on MacOS Tahoe.
+http_archive(
+    name = "build_bazel_apple_support",
+    sha256 = "ee20cc5c0bab47065473c8033d462374dd38d172406ecc8de5c8f08487943f2f",
+    url = "https://github.com/bazelbuild/apple_support/releases/download/1.23.1/apple_support.1.23.1.tar.gz",
+)
+
 load("@org_tensorflow//tensorflow:workspace3.bzl", "tf_workspace3")
 
 tf_workspace3()
@@ -72,19 +100,12 @@ http_archive(
     ],
 )
 
-load(
-    "@rules_ml_toolchain//cc/deps:cc_toolchain_deps.bzl",
-    "cc_toolchain_deps",
-)
-
-cc_toolchain_deps()
-
 # Initialize hermetic Python
 load("@xla//third_party/py:python_init_rules.bzl", "python_init_rules")
 
 python_init_rules()
 
-load("@xla//third_party/py:python_init_repositories.bzl", "python_init_repositories")
+load("@rules_ml_toolchain//py:python_init_repositories.bzl", "python_init_repositories")
 
 python_init_repositories(
     default_python_version = "system",
@@ -103,11 +124,11 @@ python_init_repositories(
     },
 )
 
-load("@xla//third_party/py:python_init_toolchains.bzl", "python_init_toolchains")
+load("@rules_ml_toolchain//py:python_register_toolchain.bzl", "python_register_toolchain")
 
-python_init_toolchains()
+python_register_toolchain()
 
-load("@xla//third_party/py:python_init_pip.bzl", "python_init_pip")
+load("@rules_ml_toolchain//py:python_init_pip.bzl", "python_init_pip")
 
 python_init_pip()
 
@@ -135,6 +156,17 @@ load(
 
 python_wheel_version_suffix_repository(name = "tf_wheel_version_suffix")
 
+# Initialize hermetic C++
+load(
+    "@rules_ml_toolchain//cc/deps:cc_toolchain_deps.bzl",
+    "cc_toolchain_deps",
+)
+
+cc_toolchain_deps()
+
+register_toolchains("@rules_ml_toolchain//cc:linux_x86_64_linux_x86_64")
+# End hermetic C++ initialization
+
 load(
     "@rules_ml_toolchain//gpu/cuda:cuda_json_init_repository.bzl",
     "cuda_json_init_repository",

diff --git a/src/builtin-adapter/python/pip_package/build_pip_package.sh b/src/builtin-adapter/python/pip_package/build_pip_package.sh
@@ -47,7 +47,7 @@ IFS='.' read -ra VERSION_PARTS <<< "${PYTHON_VERSION}"
 export TF_PYTHON_VERSION="${VERSION_PARTS[0]}.${VERSION_PARTS[1]}"
 export PROJECT_NAME=${WHEEL_PROJECT_NAME:-ai_edge_model_explorer_adapter}
 BUILD_DIR="gen/adapter_pip"
-BAZEL_FLAGS="--copt=-O3"
+BAZEL_FLAGS="--copt=-O1 --local_ram_resources=9216 --jobs=3 --config=public_cache"
 ARCH="$(uname -m)"
 
 # Build source tree.
@@ -78,7 +78,7 @@ case "${ARCH}" in
     ;;
   arm64)
     # MacOS arm64.
-    BAZEL_FLAGS="${BAZEL_FLAGS} --linkopt=\"-ld_classic\""
+    BAZEL_FLAGS="${BAZEL_FLAGS} --linkopt=\"-ld_classic\" --linkopt=\"-Wl,-headerpad_max_install_names\""
     ;;
   aarch64)
     # Linux arm64.
@@ -90,6 +90,10 @@ case "${ARCH}" in
     ;;
 esac
 
+if [[ "$(uname -s)" == "Darwin" ]]; then
+  BAZEL_FLAGS="${BAZEL_FLAGS} --config=macos_wheel"
+fi
+
 bazel build -c opt -s --config=monolithic --config=noaws --config=nogcp --config=nohdfs --config=nonccl \
   ${BAZEL_FLAGS} python/convert_wrapper:_pywrap_convert_wrapper
 cp "bazel-bin/python/convert_wrapper/_pywrap_convert_wrapper${LIBRARY_EXTENSION}" \