Merge branch 'trunk' into js-bidi-codegen

Author: pujagani

.bazelrc

@@ -21,10 +21,10 @@ build --flag_alias=pin_browsers=//common:pin_browsers
 build --flag_alias=headless=//common:headless
 
 # Set the default java toolchain
-build --java_language_version=21
-build --java_runtime_version=remotejdk_21
-build --tool_java_language_version=21
-build --tool_java_runtime_version=remotejdk_21
+build --java_language_version=25
+build --java_runtime_version=remotejdk_25
+build --tool_java_language_version=25
+build --tool_java_runtime_version=remotejdk_25
 
 # We target java 11 by default
 build --javacopt="--release 11"
@@ -44,6 +44,9 @@ build --nobuild_runfile_links
 build --allow_unresolved_symlinks
 # Avoid a warning about directory tracking being unsound
 startup --host_jvm_args=-DBAZEL_TRACK_SOURCE_DIRECTORIES=1
+# Ceiling, not an allocation; small builds still use what they need.
+# Bazel's auto-sized default is too low for CI
+startup --host_jvm_args=-Xmx8g
 
 # Required for faster TS builds
 build --@aspect_rules_ts//ts:skipLibCheck=always
@@ -58,6 +61,10 @@ query --@aspect_rules_ts//ts:default_to_tsc_transpiler
 
 build --incompatible_strict_action_env
 
+# Prevent runner-provided ANDROID_HOME triggering rules_android's SDK fetch.
+# Creates a harmless empty repo instead of failing on missing API platforms.
+common --repo_env=ANDROID_HOME=
+
 # Required for prebuilt protoc to be used
 common --@protobuf//bazel/toolchains:prefer_prebuilt_protoc=true
 

.github/workflows/bazel.yml

@@ -26,11 +26,6 @@ on:
         required: false
         type: string
         default: ''
-      caching:
-        description: Toggle caching of Bazel
-        required: false
-        type: boolean
-        default: true
       node-version:
         description: Custom Node version to install
         required: false
@@ -76,6 +71,11 @@ on:
         required: false
         type: string
         default: ''
+      cache-save:
+        description: Save the Bazel cache after the run (avoids multiple jobs clobbering it)
+        required: false
+        type: boolean
+        default: false
       gem-trusted-publishing:
         description: Exchange GitHub OIDC token for a RubyGems API token (requires trusted publisher configured on rubygems.org)
         required: false
@@ -95,19 +95,6 @@ jobs:
       GEM_HOST_API_KEY: ${{ secrets.GEM_HOST_API_KEY }}
       NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
     steps:
-      - name: Remove extra tools to free disk space
-        if: inputs.os == 'ubuntu'
-        run: |
-          echo "Removing extra tools to free disk space..."
-          echo "Space before: $(df -BG / | tail -1 | awk '{print $4}')"
-          sudo rm -rf /opt/ghc || true
-          sudo rm -rf /usr/local/.ghcup || true
-          sudo rm -rf /usr/local/share/boost || true
-          sudo rm -rf /usr/share/swift || true
-          sudo rm -rf /usr/local/julia* || true
-          sync
-          after=$(df -BG / | tail -1 | awk '{print $4}')
-          echo "Space after: ${after}"
       - name: Calculate fetch depth
         id: depth
         shell: bash
@@ -134,31 +121,30 @@ jobs:
           fetch-tags: ${{ inputs.fetch-depth != '' }}
       - name: Pull latest changes from head ref for PRs
         if: contains(github.head_ref, 'renovate/')
+        shell: bash
         run: git pull origin "$HEAD_REF"
         env:
           HEAD_REF: ${{ github.head_ref }}
       - name: Pull latest changes from ref for branch pushes
         if: contains(github.ref, 'renovate/')
+        shell: bash
         run: git pull origin "$GIT_REF"
         env:
           GIT_REF: ${{ github.ref }}
+      - name: Free disk space
+        if: inputs.os == 'ubuntu'
+        run: ./scripts/github-actions/free-disk-space.sh
+      - name: Free disk space (Windows)
+        if: inputs.os == 'windows'
+        shell: pwsh
+        run: ./scripts/github-actions/free-disk-space.ps1
       - name: Restore cache
         if: inputs.cache-name != ''
         uses: actions/cache/restore@v5
         with:
           path: ${{ inputs.cache-name }}
           key: ${{ inputs.cache-name }}-
           restore-keys: ${{ inputs.cache-name }}-
-      - name: Remove driver directories Windows
-        if: inputs.os == 'windows'
-        run: |
-          rm "$env:ChromeWebDriver" -r -v
-          rm "$env:EdgeWebDriver" -r -v
-          rm "$env:GeckoWebDriver" -r -v
-      - name: Remove driver directories Non-Windows
-        if: inputs.os != 'windows'
-        run: |
-          sudo rm -rf "$CHROMEWEBDRIVER" "$EDGEWEBDRIVER" "$GECKOWEBDRIVER"
       - name: Set Python version
         if: inputs.python-version != ''
         run: echo '${{ inputs.python-version }}' > py/.python-version
@@ -171,50 +157,21 @@ jobs:
         with:
           node-version: ${{ inputs.node-version }}
       - name: Setup Bazel with caching
-        if: inputs.caching
+        continue-on-error: true
         uses: bazel-contrib/setup-bazel@0.19.0
         with:
-          cache-save: ${{ github.ref_name == 'trunk' }}
+          cache-save: ${{ inputs.cache-save }}
           bazelisk-cache: true
           bazelrc: common --color=yes
           # Workaround for long path issues: https://github.com/bazelbuild/bazel/pull/22532
           output-base: ${{ inputs.os == 'windows' && 'D://b' || '' }}
-          cache-version: 2
           disk-cache: false
-          external-cache: |
-            manifest:
-              crates: rust/Cargo.Bazel.lock
-              "rules_ruby++ruby+ruby": false
-              "+pin_browsers_extension+linux_beta_chrome": false
-              "+pin_browsers_extension+linux_beta_chromedriver": true
-              "+pin_browsers_extension+linux_beta_firefox": false
-              "+pin_browsers_extension+linux_chrome": false
-              "+pin_browsers_extension+linux_chromedriver": true
-              "+pin_browsers_extension+linux_edge": false
-              "+pin_browsers_extension+linux_edgedriver": true
-              "+pin_browsers_extension+linux_firefox": false
-              "+pin_browsers_extension+linux_geckodriver": true
-              "+pin_browsers_extension+mac_beta_chrome": false
-              "+pin_browsers_extension+mac_beta_chromedriver": false
-              "+pin_browsers_extension+mac_beta_firefox": false
-              "+pin_browsers_extension+mac_chrome": false
-              "+pin_browsers_extension+mac_chromedriver": false
-              "+pin_browsers_extension+mac_edge": false
-              "+pin_browsers_extension+mac_edgedriver": false
-              "+pin_browsers_extension+mac_firefox": false
-              "+pin_browsers_extension+mac_geckodriver": false
-          repository-cache: true
-      - name: Setup Bazel without caching
-        if: inputs.caching == false
-        uses: bazel-contrib/setup-bazel@0.19.0
-        with:
-          cache-save: false
-          bazelisk-cache: true
-          external-cache: |
-            manifest:
-              crates: rust/Cargo.Bazel.lock
+          external-cache: false
           repository-cache: true
-          bazelrc: common --color=yes
+      - name: Disk status after cache restore
+        if: inputs.os != 'macos'
+        shell: bash
+        run: . ./scripts/github-actions/disk-status.sh
       - name: Setup Fluxbox and Xvfb
         if: inputs.os == 'ubuntu' && inputs.browser != ''
         run: |
@@ -240,8 +197,18 @@ jobs:
       - name: Configure RubyGems credentials via OIDC
         if: inputs.gem-trusted-publishing
         uses: rubygems/configure-rubygems-credentials@main
+      - name: Disk status before build
+        if: inputs.os != 'macos'
+        shell: bash
+        run: |
+          . ./scripts/github-actions/disk-status.sh
+          if [ "$AVAIL_GB" -lt 10 ]; then
+            echo "::error::Insufficient disk space: ${AVAIL_GB}GB available (need >=10GB)"
+            exit 1
+          fi
       - name: Run Bazel
         id: run-bazel
+        continue-on-error: true
         shell: bash
         env:
           MSYS_NO_PATHCONV: 1
@@ -252,15 +219,16 @@ jobs:
             ${{ inputs.run }}
           } 2>&1 | tee build/bazel-console.log
       - name: Rerun failures with debug
-        if: failure() && steps.run-bazel.outcome == 'failure'
+        id: rerun-failures
+        if: steps.run-bazel.outcome == 'failure'
         shell: bash
         run: ./scripts/github-actions/rerun-failures.sh '${{ inputs.run }}' '${{ inputs.rerun-with-debug }}'
       - name: Collect failed test logs
-        if: failure() && steps.run-bazel.outcome == 'failure'
+        if: always() && steps.run-bazel.outcome == 'failure'
         shell: bash
         run: ./scripts/github-actions/collect-test-logs.sh
       - name: Upload failed test logs
-        if: failure() && steps.run-bazel.outcome == 'failure'
+        if: always() && steps.run-bazel.outcome == 'failure'
         uses: actions/upload-artifact@v7
         with:
           name: test-logs-${{ inputs.os }}-${{ inputs.name }}-${{ inputs.browser }}
@@ -285,13 +253,11 @@ jobs:
           path: ${{ inputs.artifact-path || 'changes.patch' }}
           retention-days: 6
           if-no-files-found: ${{ inputs.artifact-path != '' && 'error' || 'ignore' }}
-      - name: Check disk space
+      - name: Low Disk Warning
         if: always()
         shell: bash
         run: |
-          avail=$(df -k "$GITHUB_WORKSPACE" | awk 'NR==2 {printf "%.0f", $4/1024/1024}')
-          echo "Remaining disk space: ${avail}GB"
-          if [ "$avail" -lt 5 ]; then
-            echo "::error::Low disk space: ${avail}GB remaining"
-            exit 1
+          . ./scripts/github-actions/disk-status.sh
+          if [ "$AVAIL_GB" -lt 5 ]; then
+            echo "::warning::Low disk space: ${AVAIL_GB}GB remaining"
           fi

.github/workflows/ci-python.yml

@@ -16,12 +16,29 @@ jobs:
       run: |
         bazel build //py:selenium-wheel //py:selenium-sdist
 
-  lint:
-    name: Lint
+  lint-ruff:
+    name: Lint (ruff)
     uses: ./.github/workflows/bazel.yml
     with:
-      name: Lint
-      run: ./go py:lint
+      name: Lint (ruff)
+      run: bazel run //py:ruff-check -- --no-fix
+
+  lint-mypy:
+    name: Lint (mypy)
+    uses: ./.github/workflows/bazel.yml
+    with:
+      name: Lint (mypy)
+      run: bazel run //py:mypy
+
+  lint-docs:
+    name: Lint (docs)
+    uses: ./.github/workflows/bazel.yml
+    with:
+      name: Lint (docs)
+      run: |
+        bazel run //py:generate-api-listing
+        bazel run //py:sphinx-autogen
+        bazel build //py:docs
 
   unit-tests:
     name: Unit Tests

.github/workflows/ci-rbe.yml

@@ -12,9 +12,10 @@ on:
         required: false
         default: false
         type: boolean
+  workflow_call:
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
+  group: ci-rbe-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 permissions:
@@ -24,11 +25,11 @@ permissions:
 jobs:
   test:
     name: Test
-    if: github.event.repository.fork == false && startsWith(github.head_ref, 'renovate/') != true
+    if: github.event.repository.fork == false
     uses: ./.github/workflows/bazel.yml
     with:
       name: All RBE tests
+      cache-save: ${{ github.ref_name == 'trunk' }}
       rerun-with-debug: true
-      caching: false
       ruby-version: jruby-10.1.0.0
       run: ./scripts/github-actions/ci-build.sh ${{ github.event.inputs.disable_test_cache }}

.github/workflows/ci-renovate-rbe.yml

@@ -0,0 +1,50 @@
+name: CI - Renovate - RBE
+
+on:
+  push:
+    branches:
+      - renovate/*
+
+concurrency:
+  group: ci-renovate-rbe-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  pin:
+    name: Repin Dependencies
+    if: github.event.repository.fork == false
+    uses: ./.github/workflows/bazel.yml
+    with:
+      name: Repin Dependencies
+      run: |
+        ./go all:pin
+        ./go rust:pin
+        ./go format
+      artifact-name: repin-changes
+
+  commit-repins:
+    name: Commit Repins
+    needs: pin
+    permissions:
+      contents: write
+      actions: read
+    uses: ./.github/workflows/commit-changes.yml
+    with:
+      artifact-name: repin-changes
+      commit-message: "Repin dependencies"
+
+  test:
+    name: Test
+    needs: commit-repins
+    permissions:
+      contents: read
+      packages: read
+    uses: ./.github/workflows/ci-rbe.yml
+
+  ci-gh:
+    name: CI - GitHub
+    needs: commit-repins
+    uses: ./.github/workflows/ci.yml

.github/workflows/ci-ruby.yml

@@ -85,4 +85,5 @@ jobs:
         --local_test_jobs 1
         --test_size_filters large
         --test_tag_filters ${{ matrix.browser }}
+        ${{ (github.event_name != 'schedule' && github.event_name != 'workflow_dispatch') && '--test_env=SKIP_PENDING=true' || '' }}
         //rb/spec/...

.github/workflows/ci-rust.yml

@@ -77,7 +77,7 @@ jobs:
     name: "Windows Debug"
     runs-on: windows-latest
     needs: tests
-    if: github.event_name != 'schedule'
+    if: github.event_name != 'schedule' && github.event.repository.fork == false && (github.ref == 'refs/heads/trunk' || inputs.release)
     env:
       RUSTFLAGS: '-Ctarget-feature=+crt-static'
     steps:
@@ -136,7 +136,7 @@ jobs:
     name: "Linux Debug"
     runs-on: ubuntu-latest
     needs: tests
-    if: github.event_name != 'schedule'
+    if: github.event_name != 'schedule' && github.event.repository.fork == false && (github.ref == 'refs/heads/trunk' || inputs.release)
     steps:
       - name: "Checkout project"
         uses: actions/checkout@v6
@@ -199,7 +199,7 @@ jobs:
     name: "MacOS Debug"
     runs-on: macos-latest
     needs: tests
-    if: github.event_name != 'schedule'
+    if: github.event_name != 'schedule' && github.event.repository.fork == false && (github.ref == 'refs/heads/trunk' || inputs.release)
     env:
       RUSTFLAGS: '-Ctarget-feature=+crt-static'
     steps: