sync

.bazelignore

@@ -7,3 +7,7 @@ third-party/abc/
 tmp
 # standalone workspace for downstream consumer tests
 test/downstream/
+# fmt ships its own BUILD.bazel assuming it is the workspace root; we overlay
+# fmt via new_local_repository(name="fmt"), so hide this nested package from
+# //... discovery (its glob(["include/fmt/*.h"]) matches nothing here).
+third-party/slang-elab/third_party/fmt/support/bazel/

.bazelrc

@@ -1,4 +1,8 @@
 common --enable_bzlmod
+
+# abc is driven programmatically by OpenROAD, so skip the interactive
+# readline dependency exposed by abc@0.64-yosyshq.bcr.2.
+common --@abc//:use_readline=false
 build --workspace_status_command=tools/workspace_status.sh
 
 # Release builds embed real git version info; dev builds use cache-safe placeholders.
@@ -40,9 +44,24 @@ build  --cxxopt=-fexceptions    --host_cxxopt=-fexceptions
 build --copt "-Wall"               --host_copt "-Wall"
 build --copt "-Wextra"             --host_copt "-Wextra"
 
+# Treat specific warnings as errors
+build --copt "-Werror=array-bounds"               --host_copt "-Werror=array-bounds"
+build --copt "-Werror=dangling"                   --host_copt "-Werror=dangling"
+build --copt "-Werror=dangling-assignment"        --host_copt "-Werror=dangling-assignment"
+build --copt "-Werror=dangling-assignment-gsl"    --host_copt "-Werror=dangling-assignment-gsl"
+build --copt "-Werror=dangling-field"             --host_copt "-Werror=dangling-field"
+build --copt "-Werror=dangling-gsl"               --host_copt "-Werror=dangling-gsl"
+build --copt "-Werror=fortify-source"             --host_copt "-Werror=fortify-source"
+build --copt "-Werror=return-stack-address"       --host_copt "-Werror=return-stack-address"
+
 # ... and disable the warnings we're not interested in.
 build --copt "-Wno-sign-compare"          --host_copt "-Wno-sign-compare"
 build --copt "-Wno-unused-parameter"      --host_copt "-Wno-unused-parameter"
+# False positive under Bazel's parse_headers feature: it compiles each
+# declared header as a main TU, which makes clang treat #pragma once as
+# a no-op and emit -Wpragma-once-outside-header.  Project convention is
+# #pragma once for all headers, so silence the warning project-wide.
+build --copt "-Wno-pragma-once-outside-header" --host_copt "-Wno-pragma-once-outside-header"
 build --copt "-Wno-gcc-compat"            --host_copt "-Wno-gcc-compat"
 build --copt "-Wno-nullability-extension" --host_copt "-Wno-nullability-extension"
 build --copt "-Wno-deprecated-declarations" --host_copt "-Wno-deprecated-declarations"
@@ -58,13 +77,26 @@ build --copt "-Wno-cast-function-type-mismatch"  --host_copt "-Wno-cast-function
 build --copt "-Wno-unused-but-set-variable"  --host_copt "-Wno-unused-but-set-variable"
 build --cxxopt "-Wno-deprecated-copy"  --host_cxxopt "-Wno-deprecated-copy"
 build --cxxopt "-Wno-deprecated-copy-with-user-provided-copy"  --host_cxxopt "-Wno-deprecated-copy-with-user-provided-copy"
-build --cxxopt "-Wno-dangling"  --host_cxxopt "-Wno-dangling"
 
 # For 3rd party code: Disable warnings entirely.
 # They are not actionable and just create noise.
 build --per_file_copt=.*external/.*@-w
 build --host_per_file_copt=.*external/.*@-w
 
+# Treat include paths into external/ (bzlmod/BCR deps) as -isystem so clang
+# suppresses ALL warnings from third-party headers pulled into our TUs (boost,
+# Eigen, googletest, ...), regardless of the specific warning. The
+# per_file_copt -w above only covers compiling external *source* files; this
+# covers external *headers* included by our own sources.
+#
+# The feature is global (target and exec config) and also demotes a from-source
+# dep's own -iquote entries to -isystem. Tools that rely on -iquote precedence
+# to shadow libc headers are patched to restore it -- e.g. git's
+# builtin/get-tar-commit-id.c includes git's own tar.h, which must win over
+# glibc's <tar.h>. See the git single_version_override in MODULE.bazel (same
+# class of fix as the bison/sed/gawk/m4 -I-over-isystem overrides).
+build --features=external_include_paths
+
 # This avoid problems with building -c dbg which enables asserts.
 # Without this libstdc++ vs libc++ differences cause link errors.
 build --per_file_copt=.*external/abc.*@-stdlib=libc++
@@ -78,9 +110,13 @@ common --enable_platform_specific_config
 # macOS: boost.stacktrace needs this since backtrace() doesn't require GNU source
 build:macos --copt=-DBOOST_STACKTRACE_GNU_SOURCE_NOT_REQUIRED
 build:macos --host_copt=-DBOOST_STACKTRACE_GNU_SOURCE_NOT_REQUIRED
-# Aligned allocation/deallocation for abseil is only available since 10.13
-build:macos --macos_minimum_os=10.13
-build:macos --host_macos_minimum_os=10.13
+# Floating-point std::to_chars (behind std::format, used by OpenSTA)
+# needs macOS 13.3; std::filesystem (src/tcl_readline_setup.cc) needs
+# 10.15; abseil's aligned allocation needs 10.13. The historical 10.13
+# floor was never enforced: toolchains_llvm ignored it and compiled
+# against the host SDK's default. hermetic-llvm honors it.
+build:macos --macos_minimum_os=13.3
+build:macos --host_macos_minimum_os=13.3
 
 # Settings for --config=asan address sanitizer build
 build:asan --strip=never
@@ -89,17 +125,69 @@ build:asan --copt=-DADDRESS_SANITIZER
 build:asan --copt=-O1
 build:asan --copt=-g
 build:asan --copt=-fno-omit-frame-pointer
+# Compress the DWARF debug sections (transparent to gdb/perf/addr2line).
+build:asan --copt=-gz=zlib
+build:asan --linkopt=-gz=zlib
 build:asan --linkopt=-fsanitize=address
+# TCMalloc is incompatible with ASan: __asan_init's interceptor setup calls
+# dlsym -> malloc before TCMalloc is initialized, segfaulting at startup.
+# Override the per-target malloc attribute to use the system allocator, which
+# ASan intercepts cleanly.
+build:asan --custom_malloc=@bazel_tools//tools/cpp:malloc
 
 # Flags with enough debug symbols to get useful outputs with Linux `perf`
 build:profile --strip=never
 build:profile --copt -g --host_copt -g
 build:profile --copt -gmlt --host_copt -gmlt
 build:profile --copt -fno-omit-frame-pointer --host_copt -fno-omit-frame-pointer
+# Compress the DWARF debug sections (transparent to gdb/perf/addr2line).
+build:profile --copt=-gz=zlib --host_copt=-gz=zlib
+build:profile --linkopt=-gz=zlib
+
+# Settings for --config=coverage C++ coverage build (LLVM source-based).
+# Usage: bazel coverage --config=coverage //...
+# `bazel coverage` already layers the `test` config on top of `build`, so this
+# only adds the coverage-specific bits. --combined_report=lcov merges every
+# test's per-target lcov into one file at
+# bazel-out/_coverage/_coverage_report.dat, which CI renders with genhtml
+# (lcov is installed in bazel/Dockerfile). The instrumentation_filter mirrors
+# the exclusions of the retired cmake/lcov flow (etc/CodeCoverage.sh _lcov):
+# instrument OpenROAD's own //src/... code, minus OpenSTA (src/sta, which has
+# its own private test suite) and drt's unused global-routing code. Third-party
+# deps live under external repos / //third-party and are simply never matched
+# by //src, so they need no explicit exclusion.
+#
+# The hermetic-llvm cc_toolchain implements no coverage feature: it applies
+# zero instrumentation flags under `bazel coverage` and its declared gcov tool
+# (a symlink onto the multiplexed `llvm` binary) is broken/undeclared, so both
+# the gcov and the default LLVM paths silently produce empty reports. Hence:
+#   - instrument explicitly with clang source-based coverage
+#     (-fprofile-instr-generate -fcoverage-mapping); gcov-style -fprofile-arcs
+#     is not an option, its objects break ld.lld ('.eh_frame: relocation is
+#     not in any piece' as of LLVM 22.1.8);
+#   - point the collector at llvm-profdata/llvm-cov via --test_env (the
+#     toolchain does not export them; keep the path in sync with the `llvm`
+#     bazel_dep version in MODULE.bazel);
+#   - run test actions unsandboxed (--strategy=TestRunner=local): the sandbox
+#     omits the coverage tools because the toolchain never declares them as
+#     test inputs. Compile actions stay sandboxed.
+coverage:coverage --combined_report=lcov
+coverage:coverage --instrumentation_filter=//src[/:],-//src/sta[/:],-//src/drt/src/gr[/:],-//src/drt/src/db/grObj[/:]
+coverage:coverage --copt=-fprofile-instr-generate
+coverage:coverage --copt=-fcoverage-mapping
+coverage:coverage --linkopt=-fprofile-instr-generate
+coverage:coverage --experimental_generate_llvm_lcov
+coverage:coverage --experimental_use_llvm_covmap
+coverage:coverage --strategy=TestRunner=local
+coverage:coverage --test_env=LLVM_PROFDATA=external/llvm++llvm_toolchain_minimal+llvm-toolchain-minimal-22.1.8-linux-amd64/bin/llvm-profdata
+coverage:coverage --test_env=LLVM_COV=external/llvm++llvm_toolchain_minimal+llvm-toolchain-minimal-22.1.8-linux-amd64/bin/llvm-cov
 
 # Improve hermeticity by disallowing user envars and network access
 build --incompatible_strict_action_env
 build --nosandbox_default_allow_network
+# Refuse to autodetect a local C++ toolchain (/usr/bin/gcc); the hermetic
+# toolchain must win resolution, with or without the etc/bazel-hermetic wrapper.
+common --repo_env=BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
 
 test --build_tests_only
 
@@ -119,12 +207,27 @@ build:ci --disk_cache=
 # Tell the 'ci' config to include 'opt'
 build:ci --config=opt
 
+# Launch py_binary via a shell stub instead of rules_python's legacy python
+# stub, whose '#!/usr/bin/env python3' shebang needs a host python3 before
+# the hermetic interpreter takes over (found by etc/bazel-hermetic).
+common --@rules_python//python/config_settings:bootstrap_impl=script
+
 # Setup remote cache
+# Anon: HTTPS read-only cache
 build --remote_cache=https://bazel.precisioninno.com
 build --remote_cache_compression=true
 build --remote_upload_local_results=false
+# CI: gRPC + Remote Asset API, requires --remote_header
+build:ci --remote_cache=grpcs://bazel.precisioninno.com:443
+build:ci --experimental_remote_downloader=grpcs://bazel.precisioninno.com:443
 
 # Without this, bazelisk build ... builds the bazel-orfs tests
 build --build_tag_filters=-orfs
 
+# clang-tidy via aspect_rules_lint, using clang-tidy from the LLVM toolchain.
+# Usage: bazel build --config=lint //src/utl/...
+build:lint --aspects=//tools/lint:linters.bzl%clang_tidy
+build:lint --output_groups=rules_lint_report
+build:lint --remote_download_outputs=all
+
 try-import %workspace%/user.bazelrc

.bazelversion

@@ -1 +1 @@
-8.6.0
+9.1.1

.github/workflows/black.yaml

@@ -13,6 +13,6 @@ jobs:
     runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && 'self-hosted' || 'ubuntu-latest' }}
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       - name: Run black
-        uses: psf/black@stable
+        uses: psf/black@87928e6d6761a4a6d22250e1fee5601b3998086e  # 26.5.1

.github/workflows/buildifier.yaml

@@ -15,21 +15,26 @@ jobs:
       fail-fast: false
       matrix:
         check:
+          # Drive buildifier from `git ls-files` instead of `-r .` so the
+          # scan stays inside this repo. With `-r .` buildifier was
+          # recursing into submodule contents (third-party/slang-elab/...)
+          # left on disk by self-hosted runners — files we can't fix from
+          # here since they're upstream-managed.
           - name: Buildifier format
-            run: ./buildifier -r -mode=check -lint=off .
+            run: "git ls-files -z ':(glob)**/*.bzl' ':(glob)**/*.bazel' ':(glob)**/BUILD' ':(glob)**/WORKSPACE' | xargs -0 -r ./buildifier -mode=check -lint=off"
           - name: Buildifier lint
-            run: ./buildifier -r -lint=warn .
+            run: "git ls-files -z ':(glob)**/*.bzl' ':(glob)**/*.bazel' ':(glob)**/BUILD' ':(glob)**/WORKSPACE' | xargs -0 -r ./buildifier -lint=warn"
     name: ${{ matrix.check.name }}
     env:
       BUILDIFIER_VERSION: v8.2.1
 
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
       - name: Cache buildifier
         id: cache-buildifier
-        uses: actions/cache@v5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
         with:
           path: ./buildifier
           key: ${{ runner.os }}-buildifier-${{ env.BUILDIFIER_VERSION }}

.github/workflows/first-time-contributor.yml

@@ -14,7 +14,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Greet First-Time Contributor
-        uses: actions/first-interaction@v1
+        uses: actions/first-interaction@34f15e814fe48ac9312ccf29db4e74fa767cbab7  # v1.3.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           issue-message: |

.github/workflows/github-actions-are-differences-found.yml

@@ -8,7 +8,7 @@ jobs:
     runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && 'self-hosted' || 'ubuntu-latest' }}
     steps:
       - name: Check out repository code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           fetch-depth: 0
       - name: Check ok files

.github/workflows/github-actions-are-odb-files-generated.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && 'self-hosted' || 'ubuntu-latest' }}
     steps:
       - name: Check out repository code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           fetch-depth: 0
           submodules: 'recursive'

.github/workflows/github-actions-check-bazel-lock.yml

@@ -10,7 +10,18 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
-      - name: Verify lock file is up to date
-        run: bazelisk mod deps --lockfile_mode=error
+      - name: Update lock file to check for differences
+        run: |
+          cp MODULE.bazel MODULE.bazel.before
+          bazelisk mod deps --lockfile_mode=update
+
+      - name: Differences to be adressed
+        run: |
+          if ! diff MODULE.bazel.before MODULE.bazel ; then
+            echo "Run"
+            echo "bazelisk mod deps --lockfile_mode=update"
+            echo "and update pull request"
+            exit 1
+          fi