Skip to content

Commit a5d3486

Browse files
erendnerendn
committed
Merge branch 'master' into rename_size_down
2 parents 6fda822 + 53ec684 commit a5d3486

163 files changed

Lines changed: 17639 additions & 4650 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.bazelrc‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,10 @@
11
common --enable_bzlmod
2+
# sv-lang 10.0.bcr.2 (slang at f04e8156 with the foreign_cc cmake -xc++
3+
# fix) is pending upstream as a PR against bazelbuild/bazel-central-
4+
# registry: https://github.com/bazelbuild/bazel-central-registry/pull/8987
5+
# Remove this registry line once the version lands on BCR.
6+
common --registry=https://raw.githubusercontent.com/oharboe/bazel-central-registry/1beaf797951046d93a2f656d4238c954a21833e5/
7+
common --registry=https://bcr.bazel.build/
28
build --workspace_status_command=tools/workspace_status.sh
39

410
# Release builds embed real git version info; dev builds use cache-safe placeholders.

‎.github/workflows/black.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,6 @@ jobs:
1313
runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && 'self-hosted' || 'ubuntu-latest' }}
1414
steps:
1515
- name: Checkout Code
16-
uses: actions/checkout@v6
16+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1717
- name: Run black
18-
uses: psf/black@stable
18+
uses: psf/black@87928e6d6761a4a6d22250e1fee5601b3998086e # 26.5.1

‎.github/workflows/buildifier.yaml‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,21 +15,26 @@ jobs:
1515
fail-fast: false
1616
matrix:
1717
check:
18+
# Drive buildifier from `git ls-files` instead of `-r .` so the
19+
# scan stays inside this repo. With `-r .` buildifier was
20+
# recursing into submodule contents (third-party/slang-elab/...)
21+
# left on disk by self-hosted runners — files we can't fix from
22+
# here since they're upstream-managed.
1823
- name: Buildifier format
19-
run: ./buildifier -r -mode=check -lint=off .
24+
run: "git ls-files -z ':(glob)**/*.bzl' ':(glob)**/*.bazel' ':(glob)**/BUILD' ':(glob)**/WORKSPACE' | xargs -0 -r ./buildifier -mode=check -lint=off"
2025
- name: Buildifier lint
21-
run: ./buildifier -r -lint=warn .
26+
run: "git ls-files -z ':(glob)**/*.bzl' ':(glob)**/*.bazel' ':(glob)**/BUILD' ':(glob)**/WORKSPACE' | xargs -0 -r ./buildifier -lint=warn"
2227
name: ${{ matrix.check.name }}
2328
env:
2429
BUILDIFIER_VERSION: v8.2.1
2530

2631
steps:
2732
- name: Checkout Code
28-
uses: actions/checkout@v6
33+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2934

3035
- name: Cache buildifier
3136
id: cache-buildifier
32-
uses: actions/cache@v5
37+
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
3338
with:
3439
path: ./buildifier
3540
key: ${{ runner.os }}-buildifier-${{ env.BUILDIFIER_VERSION }}

‎.github/workflows/first-time-contributor.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ jobs:
1414
pull-requests: write
1515
steps:
1616
- name: Greet First-Time Contributor
17-
uses: actions/first-interaction@v1
17+
uses: actions/first-interaction@34f15e814fe48ac9312ccf29db4e74fa767cbab7 # v1.3.0
1818
with:
1919
repo-token: ${{ secrets.GITHUB_TOKEN }}
2020
issue-message: |

‎.github/workflows/github-actions-are-differences-found.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ jobs:
88
runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && 'self-hosted' || 'ubuntu-latest' }}
99
steps:
1010
- name: Check out repository code
11-
uses: actions/checkout@v6
11+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1212
with:
1313
fetch-depth: 0
1414
- name: Check ok files

‎.github/workflows/github-actions-are-odb-files-generated.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ jobs:
1313
runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && 'self-hosted' || 'ubuntu-latest' }}
1414
steps:
1515
- name: Check out repository code
16-
uses: actions/checkout@v6
16+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1717
with:
1818
fetch-depth: 0
1919
submodules: 'recursive'

‎.github/workflows/github-actions-check-bazel-lock.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ jobs:
1010
runs-on: ubuntu-latest
1111
steps:
1212
- name: Check out repository code
13-
uses: actions/checkout@v6
13+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1414

1515
- name: Verify lock file is up to date
1616
run: bazelisk mod deps --lockfile_mode=error

‎.github/workflows/github-actions-clang-tidy-bazel-post.yml‎

Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
name: clang-tidy-bazel-post
2+
3+
# Runs in the base repository's context with a writable GITHUB_TOKEN, so it
4+
# can post reviewdog comments on PRs opened from forks (which the upstream
5+
# `clang-tidy-bazel` workflow cannot, since fork pull_request runs get a
6+
# read-only token by GitHub's design).
7+
#
8+
# Security: this workflow MUST NOT execute untrusted PR code. It only reads
9+
# the text artifact (clang-tidy.txt) produced by the upstream workflow and
10+
# the metadata file we wrote there ourselves. No checkout of the PR head,
11+
# no bazel build, no scripts from the fork.
12+
13+
on:
14+
workflow_run:
15+
workflows: ["clang-tidy-bazel"]
16+
types:
17+
- completed
18+
19+
permissions:
20+
contents: read
21+
pull-requests: write
22+
# Needed for actions/download-artifact@v4 to fetch from another workflow.
23+
actions: read
24+
25+
jobs:
26+
Post-Reviewdog:
27+
# Run on success AND failure: Stage A intentionally exits non-zero when
28+
# clang-tidy findings exist on the PR diff (to fail the required PR
29+
# check), but the artifact is uploaded *before* that fail step, so the
30+
# findings are still posted as review comments. Only skip on cancelled.
31+
if: ${{ github.event.workflow_run.conclusion != 'cancelled' }}
32+
runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && 'self-hosted' || 'ubuntu-latest' }}
33+
steps:
34+
# Reviewdog's github-pr-review reporter resolves the local git root
35+
# before flushing comments and silently no-ops if .git is missing.
36+
# Check out the base repo (default branch, shallow) so reviewdog has
37+
# a .git directory to operate against. No fork code involved — this
38+
# is the base repo at HEAD of its default branch.
39+
- name: Check out base repo for reviewdog .git requirement
40+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
41+
with:
42+
fetch-depth: 1
43+
# Default ref in workflow_run context is the base repo's default
44+
# branch, which is the safe choice here. Reviewdog uses GitHub
45+
# API to fetch the actual PR diff, so the local SHA need not
46+
# match the PR head.
47+
48+
- name: Download clang-tidy artifact
49+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
50+
with:
51+
name: clang-tidy-bazel
52+
run-id: ${{ github.event.workflow_run.id }}
53+
github-token: ${{ secrets.GITHUB_TOKEN }}
54+
55+
- name: Load PR metadata
56+
id: meta
57+
run: |
58+
# pr-meta.txt is produced by the upstream workflow from the
59+
# pull_request event payload. It is text we wrote ourselves —
60+
# not arbitrary fork content — and is parsed with a strict
61+
# allowlist below before being exported.
62+
if [ ! -f pr-meta.txt ]; then
63+
echo "::error::pr-meta.txt missing from artifact"
64+
exit 1
65+
fi
66+
while IFS='=' read -r key value; do
67+
case "$key" in
68+
pr_number|head_sha|base_sha|head_repo|base_repo) ;;
69+
*) continue ;;
70+
esac
71+
# Validate values: numbers, hex SHAs, or owner/repo slugs only.
72+
case "$key" in
73+
pr_number)
74+
[[ "$value" =~ ^[0-9]+$ ]] || { echo "::error::bad pr_number"; exit 1; } ;;
75+
head_sha|base_sha)
76+
[[ "$value" =~ ^[0-9a-f]{40}$ ]] || { echo "::error::bad $key"; exit 1; } ;;
77+
head_repo|base_repo)
78+
[[ "$value" =~ ^[A-Za-z0-9._-]+/[A-Za-z0-9._-]+$ ]] || { echo "::error::bad $key"; exit 1; } ;;
79+
esac
80+
echo "$key=$value" >> "$GITHUB_OUTPUT"
81+
done < pr-meta.txt
82+
83+
- name: Synthesize pull_request event payload
84+
id: event
85+
env:
86+
PR_NUMBER: ${{ steps.meta.outputs.pr_number }}
87+
HEAD_SHA: ${{ steps.meta.outputs.head_sha }}
88+
BASE_SHA: ${{ steps.meta.outputs.base_sha }}
89+
HEAD_REPO: ${{ steps.meta.outputs.head_repo }}
90+
BASE_REPO: ${{ steps.meta.outputs.base_repo }}
91+
run: |
92+
# Reviewdog's `github-pr-review` reporter reads GITHUB_EVENT_PATH
93+
# expecting a pull_request payload. The real event here is
94+
# workflow_run, so we synthesize the minimum payload reviewdog
95+
# needs and point GITHUB_EVENT_PATH at it for the next step.
96+
EVENT_PATH="${RUNNER_TEMP}/pr-event.json"
97+
python3 - <<'PY' > "$EVENT_PATH"
98+
import json, os
99+
payload = {
100+
"action": "synchronize",
101+
"number": int(os.environ["PR_NUMBER"]),
102+
"pull_request": {
103+
"number": int(os.environ["PR_NUMBER"]),
104+
"head": {
105+
"sha": os.environ["HEAD_SHA"],
106+
"repo": {"full_name": os.environ["HEAD_REPO"]},
107+
},
108+
"base": {
109+
"sha": os.environ["BASE_SHA"],
110+
"repo": {"full_name": os.environ["BASE_REPO"]},
111+
},
112+
},
113+
"repository": {
114+
"full_name": os.environ["BASE_REPO"],
115+
"owner": {"login": os.environ["BASE_REPO"].split("/")[0]},
116+
"name": os.environ["BASE_REPO"].split("/")[1],
117+
},
118+
}
119+
print(json.dumps(payload))
120+
PY
121+
echo "event_path=${EVENT_PATH}" >> "$GITHUB_OUTPUT"
122+
123+
- name: Set up reviewdog
124+
uses: reviewdog/action-setup@d8a7baabd7f3e8544ee4dbde3ee41d0011c3a93f # v1.5.0
125+
with:
126+
reviewdog_version: latest
127+
128+
- name: Run reviewdog
129+
env:
130+
REVIEWDOG_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
131+
GITHUB_EVENT_NAME: pull_request
132+
GITHUB_EVENT_PATH: ${{ steps.event.outputs.event_path }}
133+
GITHUB_SHA: ${{ steps.meta.outputs.head_sha }}
134+
GITHUB_REPOSITORY: ${{ steps.meta.outputs.base_repo }}
135+
run: |
136+
reviewdog \
137+
-efm="%E%f:%l:%c: error: %m" \
138+
-efm="%W%f:%l:%c: warning: %m" \
139+
-name="clang-tidy" \
140+
-reporter=github-pr-review \
141+
-filter-mode=added \
142+
-fail-level=any \
143+
< clang-tidy.txt

‎.github/workflows/github-actions-clang-tidy-bazel.yml‎

Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
name: clang-tidy-bazel
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- master
7+
8+
# Read-only by design: fork PRs get a read-only GITHUB_TOKEN regardless of
9+
# what this block requests, so this workflow only builds clang-tidy and
10+
# uploads the findings as an artifact. The companion workflow
11+
# `clang-tidy-bazel-post` runs on `workflow_run` in the base repo context
12+
# with a writable token and posts the reviewdog comments.
13+
permissions:
14+
contents: read
15+
16+
jobs:
17+
Clang-Tidy-Bazel:
18+
runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && 'self-hosted' || 'ubuntu-latest' }}
19+
steps:
20+
- name: Check out repository code
21+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
22+
with:
23+
submodules: 'recursive'
24+
# Need full history so the post workflow's reviewdog can diff
25+
# against the PR base via the API.
26+
fetch-depth: 0
27+
28+
- name: Set up bazel
29+
# GitHub-hosted ubuntu-latest preinstalls bazelisk, but self-hosted
30+
# runners do not. Install it explicitly so the workflow works on
31+
# both runner types. bazel-contrib/setup-bazel's default uses a
32+
# pre-installed bazelisk; passing bazelisk-version forces install.
33+
uses: bazel-contrib/setup-bazel@c5acdfb288317d0b5c0bbd7a396a3dc868bb0f86 # 0.19.0
34+
with:
35+
bazelisk-version: 1.x
36+
bazelisk-cache: true
37+
38+
- name: Run bazel clang-tidy
39+
env:
40+
BAZEL_CACHE_PASSWORD: ${{ secrets.BAZEL_CACHE_PASSWORD }}
41+
run: |
42+
# Same auth pattern as github-actions-macos-bazel.yml: when the
43+
# cache secret is present (push / dispatch / private repo PR),
44+
# add authed gRPC + Remote Asset API on top of the .bazelrc anon
45+
# HTTPS read-only cache. Fork PRs have no secret and just read
46+
# the anon cache.
47+
REMOTE_FLAGS=()
48+
if [ -n "${BAZEL_CACHE_PASSWORD}" ]; then
49+
TOKEN_B64=$(printf 'ci:%s' "${BAZEL_CACHE_PASSWORD}" | base64 | tr -d '\n')
50+
echo "::add-mask::${TOKEN_B64}"
51+
REMOTE_FLAGS=(
52+
--remote_cache=grpcs://bazel.precisioninno.com:443
53+
--experimental_remote_downloader=grpcs://bazel.precisioninno.com:443
54+
--remote_upload_local_results=true
55+
--remote_header="Authorization=Basic ${TOKEN_B64}"
56+
)
57+
fi
58+
# Note: do NOT use --config=ci here. That config sets
59+
# --remote_download_minimal and --config=opt (LTO), but we need
60+
# the .AspectRulesLintClangTidy.out files materialized locally
61+
# to feed reviewdog, and LTO is wasted work for lint.
62+
set -x
63+
bazel build \
64+
"${REMOTE_FLAGS[@]}" \
65+
--config=lint \
66+
-- //src/... //third-party/... -//src/sta/... -//third-party/abc/...
67+
68+
- name: Collect clang-tidy diagnostics
69+
run: |
70+
# Paths in .out files are sandbox-absolute; strip to workspace-
71+
# relative so reviewdog can match against the PR diff. Keep only
72+
# `path:line:col: warning|error:` lines — drops source-context
73+
# carets, notes, and clang-tidy's header noise in one filter.
74+
# `grep -v bazel-out/` drops findings against external virtual
75+
# includes (not in any PR diff). `sort -u` dedupes the same
76+
# finding emitted under multiple cc_library consumers of a
77+
# shared source.
78+
BAZEL_BIN=$(bazel info bazel-bin)
79+
find "${BAZEL_BIN}" -name '*.AspectRulesLintClangTidy.out' -print0 \
80+
| xargs -0 cat \
81+
| sed -E 's|^.*/execroot/_main/||' \
82+
| grep -E '^[^:]+:[0-9]+:[0-9]+: (warning|error):' \
83+
| grep -vE '^(bazel-out|external)/' \
84+
| sort -u \
85+
> clang-tidy.txt
86+
echo "::group::clang-tidy.txt (head)"
87+
head -50 clang-tidy.txt || true
88+
echo "::endgroup::"
89+
echo "Findings: $(wc -l < clang-tidy.txt)"
90+
91+
- name: Save PR metadata for post workflow
92+
run: |
93+
# workflow_run.event.pull_requests[] is empty for fork PRs, so the
94+
# post workflow needs the PR number and head SHA delivered via the
95+
# artifact itself.
96+
{
97+
echo "pr_number=${{ github.event.pull_request.number }}"
98+
echo "head_sha=${{ github.event.pull_request.head.sha }}"
99+
echo "base_sha=${{ github.event.pull_request.base.sha }}"
100+
echo "head_repo=${{ github.event.pull_request.head.repo.full_name }}"
101+
echo "base_repo=${{ github.event.pull_request.base.repo.full_name }}"
102+
} > pr-meta.txt
103+
104+
- name: Upload clang-tidy artifact
105+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
106+
with:
107+
name: clang-tidy-bazel
108+
path: |
109+
clang-tidy.txt
110+
pr-meta.txt
111+
retention-days: 7
112+
if-no-files-found: error
113+
114+
- name: Set up reviewdog
115+
uses: reviewdog/action-setup@v1
116+
with:
117+
reviewdog_version: latest
118+
119+
- name: Fail check on clang-tidy findings in PR diff
120+
# Runs after the artifact upload so the post workflow always has the
121+
# findings to comment on, even when this step exits non-zero.
122+
# Uses -reporter=local because the fork-PR token is read-only here;
123+
# local mode just prints to stdout and exits with -fail-level=any if
124+
# findings exist. The post workflow does the actual review posting.
125+
env:
126+
BASE_SHA: ${{ github.event.pull_request.base.sha }}
127+
HEAD_SHA: ${{ github.event.pull_request.head.sha }}
128+
run: |
129+
reviewdog \
130+
-efm="%E%f:%l:%c: error: %m" \
131+
-efm="%W%f:%l:%c: warning: %m" \
132+
-name="clang-tidy" \
133+
-reporter=local \
134+
-diff="git diff ${BASE_SHA}...${HEAD_SHA}" \
135+
-filter-mode=added \
136+
-fail-level=any \
137+
< clang-tidy.txt

0 commit comments

Comments
 (0)