feat(kokoro): Add Kokoro CI configuration from v2.13.x (#15394)

* feat(kokoro): Add Kokoro CI configuration from v2.13.x

This re-introduces the Kokoro build configurations for macOS and
Windows based on the previously working setup from the v2.13.x release.
This is the first step in the proof-of-concept evaluation.

b/438767727.

* feat: update bazel version to 7.6.1

* feat(kokoro): Align Kokoro scripts with current GHA workflows

* Fix: Apply formatting changes

Author: jinseopkim0

ci/kokoro/README.md

@@ -1,5 +1,33 @@
-# Kokoro Configuration and Build script
+# Kokoro Configuration and Build scripts.
 
-As part of the software supply chain security efforts, the automation team runs
-a Kokoro job to capture the commit hash of each release. The script and
-configuration for this Kokoro job live in this directory.
+This directory contains the build scripts and configuration files for Kokoro,
+Google's internal CI system for open source projects.
+
+We use Kokoro because:
+
+- We can run Windows and macOS builds. Kokoro can also run Linux builds, but we
+  use Google Cloud Build for our Linux builds.
+- We can store secrets, such as key files or access tokens, and run integration
+  builds against production.
+
+The documentation for Kokoro is available to Googlers only (sorry) at go/kokoro,
+there are extensive codelabs and detailed descriptions of the system there.
+
+In brief, the Kokoro configuration is split in two:
+
+1. A series of configuration files inside Google define what builds exist, and
+   what resources these builds have access to.
+   - These files are in a hierarchy that mirrors the ci/kokoro directory in this
+     repo.
+   - The `common.cfg` files are parsed first.
+   - The `common.cfg` files are applied according to the directory hierarchy.
+   - Finally any settings in `foobar.cfg` are applied.
+1. A series of configuration files in the `ci/kokoro` directory further define
+   the build configuration:
+   - They define the build script for each build, though they are often common.
+   - They define which of the resources *allowed* by the internal configuration
+     are actually *used* by that build.
+
+Somewhat unique to Kokoro one must define a separate *INTEGRATION* vs.
+*PRESUBMIT* thus the duplication of configuration files for essentially the same
+settings.

ci/kokoro/lib/cache.sh

@@ -0,0 +1,96 @@
+#!/usr/bin/env bash
+#
+# Copyright 2020 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Make our include guard clean against set -o nounset.
+test -n "${CI_KOKORO_LIB_CACHE_SH__:-}" || declare -i CI_KOKORO_LIB_CACHE_SH__=0
+if ((CI_KOKORO_LIB_CACHE_SH__++ != 0)); then
+  return 0
+fi # include guard
+
+source module /ci/kokoro/lib/gcloud.sh
+source module /ci/lib/io.sh
+
+readonly CACHE_KEYFILE="${KOKORO_GFILE_DIR:-/dev/shm}/build-results-service-account.json"
+
+cache_download_enabled() {
+  if [[ ! -f "${CACHE_KEYFILE}" ]]; then
+    io::log "Service account for cache access is not configured."
+    io::log "No attempt will be made to download the cache, exit with success."
+    return 1
+  fi
+
+  if [[ "${RUNNING_CI:-}" != "yes" ]]; then
+    io::log "Cache not downloaded as this is not a CI build."
+    return 1
+  fi
+
+  return 0
+}
+
+cache_gcloud_cleanup() {
+  revoke_service_account_keyfile "${CACHE_KEYFILE}" || true
+  delete_gcloud_config || true
+}
+
+cache_download_tarball() {
+  local -r GCS_FOLDER="$1"
+  local -r DESTINATION="$2"
+  local -r FILENAME="$3"
+
+  trap cache_gcloud_cleanup RETURN
+  create_gcloud_config
+  activate_service_account_keyfile "${CACHE_KEYFILE}"
+
+  io::log_h2 "Downloading build cache ${FILENAME} from ${GCS_FOLDER}"
+  io::log "gcloud configuration"
+  "${GCLOUD_BIN}" version
+  env "CLOUDSDK_ACTIVE_CONFIG_NAME=${GCLOUD_CONFIG}" \
+    "${GCLOUD_BIN}" --quiet storage "${CACHE_GSUTIL_DEBUG:--q}" \
+    cp "gs://${GCS_FOLDER}/${FILENAME}" "${DESTINATION}"
+}
+
+cache_upload_enabled() {
+  if [[ ! -f "${CACHE_KEYFILE}" ]]; then
+    io::log "Service account for cache access is not configured."
+    io::log "No attempt will be made to upload the cache, exit with success."
+    return 1
+  fi
+
+  if [[ "${RUNNING_CI:-}" != "yes" || "${KOKORO_JOB_TYPE:-}" != "CONTINUOUS_INTEGRATION" ]]; then
+    io::log "Cache not updated as this is not a CI build or it is a PR build."
+    return 1
+  fi
+  return 0
+}
+
+cache_upload_tarball() {
+  local -r SOURCE_DIRECTORY="$1"
+  local -r FILENAME="$2"
+  local -r GCS_FOLDER="$3"
+
+  io::log_h2 "Uploading build cache ${FILENAME} to ${GCS_FOLDER}"
+  io::log "gsutil configuration"
+  gsutil version -l
+
+  trap cache_gcloud_cleanup RETURN
+  create_gcloud_config
+  activate_service_account_keyfile "${CACHE_KEYFILE}"
+  env "CLOUDSDK_ACTIVE_CONFIG_NAME=${GCLOUD_CONFIG}" \
+    "${GCLOUD_BIN}" --quiet storage "${CACHE_GSUTIL_DEBUG:--q}" \
+    cp "${SOURCE_DIRECTORY}/${FILENAME}" "gs://${CACHE_FOLDER}/"
+
+  io::log "Upload completed"
+}

ci/kokoro/lib/gcloud.sh

@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+#
+# Copyright 2020 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Make our include guard clean against set -o nounset.
+test -n "${CI_KOKORO_LIB_GCLOUD_SH__:-}" || declare -i CI_KOKORO_LIB_GCLOUD_SH__=0
+if ((CI_KOKORO_LIB_GCLOUD_SH__++ != 0)); then
+  return 0
+fi # include guard
+
+source module /ci/lib/io.sh
+
+if [[ -z "${GCLOUD_CONFIG:-}" ]]; then
+  readonly GCLOUD_CONFIG="cloud-cpp-integration"
+fi
+
+if [[ -z "${GCLOUD_ARGS:-}" ]]; then
+  readonly GCLOUD_ARGS=(
+    # Do not seek confirmation for any actions, assume the default
+    "--quiet"
+
+    # Run the command using a custom configuration, this avoids affecting the
+    # user's `default` configuration
+    "--configuration=${GCLOUD_CONFIG}"
+  )
+fi
+
+GCLOUD_BIN="/usr/local/google-cloud-sdk/bin/gcloud"
+if [ ! -x "${GCLOUD_BIN}" ]; then
+  # If the bin wasn't found at the above path, hope it's found in ${PATH}.
+  GCLOUD_BIN="gcloud"
+fi
+readonly GCLOUD_BIN
+
+activate_service_account_keyfile() {
+  local -r keyfile="$1"
+  local -r account="$(sed -n 's/.*"client_email": "\(.*\)",.*/\1/p' "${keyfile}")"
+  "${GCLOUD_BIN}" "${GCLOUD_ARGS[@]}" auth activate-service-account \
+    --key-file "${keyfile}" >/dev/null
+  "${GCLOUD_BIN}" "${GCLOUD_ARGS[@]}" config set account "${account}"
+}
+
+revoke_service_account_keyfile() {
+  local -r keyfile="$1"
+  local -r account="$(sed -n 's/.*"client_email": "\(.*\)",.*/\1/p' "${keyfile}")"
+  "${GCLOUD_BIN}" "${GCLOUD_ARGS[@]}" auth revoke "${account}" >/dev/null
+}
+
+delete_gcloud_config() {
+  "${GCLOUD_BIN}" --quiet config configurations delete "${GCLOUD_CONFIG}"
+}
+
+create_gcloud_config() {
+  if ! "${GCLOUD_BIN}" --quiet config configurations \
+    describe "${GCLOUD_CONFIG}" >/dev/null 2>&1; then
+    io::log "Create the gcloud configuration for the cloud-cpp tests."
+    "${GCLOUD_BIN}" --quiet --no-user-output-enabled config configurations \
+      create --no-activate "${GCLOUD_CONFIG}" >/dev/null
+  fi
+  if [[ -n "${GOOGLE_CLOUD_PROJECT:-}" ]]; then
+    # At this point, we haven't yet activated our service account, but we also
+    # don't want this config setting to use any default account that may
+    # already exist on the machine, so we explicitly set `--account=""` to
+    # avoid using incidental gcloud accounts.
+    "${GCLOUD_BIN}" "${GCLOUD_ARGS[@]}" --account="" config set project "${GOOGLE_CLOUD_PROJECT}"
+  fi
+}

ci/kokoro/lib/vcpkg.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+#
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Make our include guard clean against set -o nounset.
+test -n "${CI_KOKORO_LIB_VCPKG_SH__:-}" || declare -i CI_KOKORO_LIB_VCPKG_SH__=0
+if ((CI_KOKORO_LIB_VCPKG_SH__++ != 0)); then
+  return 0
+fi # include guard
+
+source module /ci/lib/io.sh
+source module /ci/kokoro/lib/cache.sh
+source module /ci/kokoro/lib/gcloud.sh
+
+install_vcpkg() {
+  local -r vcpkg_dir="$1"
+  local url
+
+  mkdir -p "${vcpkg_dir}"
+  io::log "Downloading vcpkg into ${vcpkg_dir}..."
+  VCPKG_VERSION="$(<ci/etc/vcpkg-version.txt)"
+  url="https://github.com/microsoft/vcpkg/archive/${VCPKG_VERSION}.tar.gz"
+  if [[ "${VCPKG_VERSION}" =~ [0-9]{4}.[0-9]{2}.[0-9]{2} ]]; then
+    # vcpkg uses date-like tags for releases
+    url="https://github.com/microsoft/vcpkg/archive/refs/tags/${VCPKG_VERSION}.tar.gz"
+  fi
+  ci/retry-command.sh 3 120 curl -fsSL "${url}" |
+    tar -C "${vcpkg_dir}" --strip-components=1 -zxf -
+
+  io::log_h2 "Configure VCPKG to use GCS as a cache"
+  readonly CACHE_BUCKET="${GOOGLE_CLOUD_CPP_KOKORO_RESULTS:-cloud-cpp-kokoro-results}"
+  readonly CACHE_FOLDER="build-cache/google-cloud-cpp/vcpkg/macos"
+  export VCPKG_BINARY_SOURCES="x-gcs,gs://${CACHE_BUCKET}/${CACHE_FOLDER},readwrite"
+  export X_VCPKG_IGNORE_LOCK_FAILURES=true
+
+  create_gcloud_config
+  activate_service_account_keyfile "${CACHE_KEYFILE}"
+  export CLOUDSDK_ACTIVE_CONFIG_NAME="${GCLOUD_CONFIG}"
+  io::run gsutil ls "gs://${CACHE_BUCKET}/"
+  # Eventually we can remove this, but the current caches contain both `ccache`
+  # files (which we want), and `vcpkg` files (which we don't want).
+  io::run rm -fr "${HOME}/.cache/vcpkg"
+
+  ci/retry-command.sh 3 120 "${vcpkg_dir}/bootstrap-vcpkg.sh"
+}

ci/kokoro/macos/bazel-presubmit.cfg

@@ -0,0 +1,15 @@
+# Copyright 2023 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+timeout_mins: 480

ci/kokoro/macos/bazel.cfg

@@ -0,0 +1,15 @@
+# Copyright 2023 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+timeout_mins: 480