Commit graph

49 commits

Author SHA1 Message Date
Protobuf Team Bot
a362a3b2fc Update hard-coded bazel version numbers in the CI workflows.
#test-continuous

PiperOrigin-RevId: 962521143
2026-08-10 20:14:02 -07:00
Protobuf Team Bot
caa4c0c8d9 Update CI docker images to use latest supported versions of Bazel
Update the GitHub Actions CI tests to use the latest versions of the images, which include versions 8.7.0 and 9.2.0 of bazel and a few language specific updates.

#test-continuous

Note: The Continuous Linux TSAN test failure is pre-existing and currently broken at HEAD
PiperOrigin-RevId: 959198290
2026-08-04 13:38:35 -07:00
Protobuf Team Bot
9d9a069bc5 Update downstream test container images in GHA workflows.
PiperOrigin-RevId: 936407941
2026-06-22 21:08:54 -07:00
Jie Luo
f9e028f29f bazel 9 tests for csharp, hpb, objc, php, python, rust and upb
PiperOrigin-RevId: 918164613
2026-05-19 19:58:47 -07:00
Salman Chishti
adf9e8b80f Upgrade GitHub Actions for Node 24 compatibility (#25572)
## Summary

Upgrade GitHub Actions to their latest versions to ensure compatibility with Node 24, as Node 20 will reach end-of-life in April 2026.

## Changes

| Action | Old Version(s) | New Version | Release | Files |
|--------|---------------|-------------|---------|-------|
| `actions/cache` | [`1bd1e32`](1bd1e32a3b) | [`8b402f5`](8b402f58fb) | [Release](https://github.com/actions/cache/releases/tag/v5) | clear_caches.yml |
| `actions/checkout` | [`8ade135`](8ade135a41) | [`8e8c483`](8e8c483db8) | [Release](https://github.com/actions/checkout/releases/tag/v6) | scorecard.yml, staleness_refresh.yml, update_php_repo.yml |
| `actions/download-artifact` | [`018cc2c`](018cc2cf5b), [`fa0a91b`](fa0a91b85d) | [`37930b1`](37930b1c2a) | [Release](https://github.com/actions/download-artifact/releases/tag/v7) | test_cpp.yml, test_php_ext.yml, test_upb.yml |
| `actions/setup-dotnet` | [`3447fd6`](3447fd6a9f) | [`baa11fb`](baa11fbfe1) | [Release](https://github.com/actions/setup-dotnet/releases/tag/v5) | test_csharp.yml |
| `actions/setup-java` | [`3a4f6e1`](3a4f6e1af5) | [`be666c2`](be666c2fcd) | [Release](https://github.com/actions/setup-java/releases/tag/v5) | test_bazel.yml |
| `actions/setup-python` | [`39cd149`](39cd14951b), [`e797f83`](e797f83bcb) | [`a309ff8`](a309ff8b42) | [Release](https://github.com/actions/setup-python/releases/tag/v6) | test_python.yml, test_upb.yml |
| `actions/stale` | [`b69b346`](b69b346013) | [`9971854`](997185467f) | [Release](https://github.com/actions/stale/releases/tag/v10) | janitor.yml |
| `actions/upload-artifact` | [`5076954`](50769540e7), [`v4`](https://github.com/actions/upload-artifact/releases/tag/v4) | [`b7c566a`](b7c566a772) | [Release](https://github.com/actions/upload-artifact/releases/tag/v6) | scorecard.yml, test_cpp.yml, test_php_ext.yml, test_ruby.yml, test_upb.yml |

## Context

Per [GitHub's announcement](https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/), Node 20 is being deprecated and runners will begin using Node 24 by default starting March 4th, 2026.

### Why this matters

- **Node 20 EOL**: April 2026
- **Node 24 default**: March 4th, 2026
- **Action**: Update to latest action versions that support Node 24

### Security Note

Actions that were previously pinned to commit SHAs remain pinned to SHAs (updated to the latest release SHA) to maintain the security benefits of immutable references.

### Testing

These changes only affect CI/CD workflow configurations and should not impact application functionality. The workflows should be tested by running them on a branch before merging.

Closes #25572

COPYBARA_INTEGRATE_REVIEW=https://github.com/protocolbuffers/protobuf/pull/25572 from salmanmkc:upgrade-github-actions-node24 ef77dcfa4f
PiperOrigin-RevId: 874140973
2026-02-23 10:27:07 -08:00
Joshua Haberman
1ea2c4bab5 Updated release builds to use Bazel 8 and platforms.
Bazel 8 no longer supports legacy toolchains, so all of our release toolchains have been updated to use platforms.

#test-continuous

PiperOrigin-RevId: 870017275
2026-02-13 21:47:47 -08:00
Jie Luo
b046c9a30e Drop Bazel 7 tests for bazel, python, partially java partially cpp.
C++, java, PHP, Ruby and upb still have some cross-compilation Bazel 7 tests.

PiperOrigin-RevId: 855994201
2026-01-13 20:11:39 -08:00
Jie Luo
bbc9dd9e8a Drop Python 3.9 support
Python 3.9 reached its official End-of-Life (EOL) on October 31, 2025
https://devguide.python.org/versions/

PiperOrigin-RevId: 854341311
2026-01-09 14:20:23 -08:00
Mikita Belahlazau
4f076d951f Add metadata annotations for generated Python protobuf symbols.
The pyi generator now includes Kythe annotations for:
*   Extension field constants (e.g., `EXTENSION_FIELD`).
*   Field number constants (e.g., `STRING_FIELD_FIELD_NUMBER`).
*   `Create` methods in generated Stubby client classes.

These annotations allow the Python indexer to link these generated symbols back to their definitions in the `.proto` files.

PiperOrigin-RevId: 852971617
2026-01-06 16:05:56 -08:00
Protobuf Team Bot
ae67a4c195 Internal version update.
PiperOrigin-RevId: 852733884
2026-01-06 05:27:44 -08:00
Hong Shin
66a9ea7540 update min mac ver from 11 to 12
PiperOrigin-RevId: 845329387
2025-12-16 10:18:38 -08:00
Eric Salo
a6fbd40d7e Update GitHub Actions to use macOS-14.
See https://github.com/actions/runner-images/issues/13046.

#test-continuous

PiperOrigin-RevId: 835391347
2025-11-21 16:05:25 -08:00
Jie Luo
8e3543177e Add Python 3.14 test coverage
#test-continuous

PiperOrigin-RevId: 829211258
2025-11-06 19:21:19 -08:00
Mike Kruskal
f764f12dc8 Upgrade to protobuf-ci v5
PiperOrigin-RevId: 825653280
2025-10-29 12:14:52 -07:00
Mike Kruskal
fa9ceb3d4f Add bzlmod support for system_python.
#test-continuous

This creates a module extension for system python so that it can be used in bzlmod builds.  The pip_parse setup (dynamically building a new repo) doesn't work in the new bzlmod model, so we use the regular pip extension pointed at system_python's interpreter.

Remaining work to get off WORKSPACE:
* The pip extension quickly fails in the case where there's no python available, unlike our system_python setup
* Our windows upb tests were never actually running python, and system_python doesn't work (and breaks under bzlmod due to the above issue)
* Some of the upb wheel tests still don't work on bzlmod yet because they depend on some very custom http_archive dependencies.

Closes #18750
Closes #23313
Closes #23307

PiperOrigin-RevId: 810995270
2025-09-24 12:54:08 -07:00
Adam Cozzette
25d7981143 Upgrade to Bazel 7.6.1
This is necessary for upgrading setuptools, because older Bazel versions apparently can't handle whitespace in file names: https://github.com/protocolbuffers/protobuf/pull/22094

PiperOrigin-RevId: 780210543
2025-07-07 12:22:23 -07:00
Sandy Zhang
e7260fd5cc Remove --noenable_bzlmod from .bazelrc
Enables bzlmod for most CI tests, except python (and thus upb) since infra for system python headers for python dist are not bzlmod compatible and require further work.

#test-continuous

PiperOrigin-RevId: 721946253
2025-01-31 16:45:18 -08:00
Tony Liao
39808bc55d Remove the entire pb_unit_tests/ directory with reflection_test_wrapper.
The test wrappers were another way to document nonconformant behaviour between
different python backends. We can achieve the same by removing the wrapper
script and adding an if-condition in the test itself based on
api_implementation.Type(). Since we already do that for nonconformance between
pure Python vs. C++ backends, this change makes it easier to look for UPB
nonconformance instead of going through another layer of indirection.

Since this is the last remaining test file in the pb_unit_tests directory, I
have removed the entire directory. Future UPB tests will be in the same
directory as C++ and pure python implementations, namely:
//python/google/protobuf/internal.

Temporarily, we will need to hardcode the migrated test name in test_upb.yml
because not all tests under google.protobuf.internal support UPB yet.
(UPB testing for selected tests are added in 21e9aa6cac).

The reflection_test is a slightly more complicated test. In this commit I've
removed exemption of testParsingNestedClass in reflection_test. A follow-up
commit will ensure further conformance within the reflection_test. There are
quite a few if-conditions that were added to skip certain checks due to
nonconformant behavior -- they seem to no longer apply.

PiperOrigin-RevId: 712943652
2025-01-07 09:52:04 -08:00
Sandy Zhang
aef40aaf83 Update protobuf repository to use the newest version (v4) of protobuf-ci
#test-continuous

PiperOrigin-RevId: 712618052
2025-01-06 12:33:01 -08:00
Deanna Garcia
afe2de2618 Move to bazel 7 and turn down support for bazel 6.
Migrate all tests to run on bazel 7 and fix errors that came up in the process. 30.x will no longer guarantee support for bazel 6.
#test-continuous

PiperOrigin-RevId: 703590770
2024-12-06 13:05:40 -08:00
Sandy Zhang
4d998f2742 Add linker flags enabling undefined dynamic_lookup for macOS for Python api_implementation.so and message.so
Enable Bazel 7 macOS test coverage which otherwise fails with
```
Undefined symbols for architecture arm64:
  "_PyModule_AddIntConstant", referenced from:
      _PyInit__api_implementation in api_implementation.o
  "_PyModule_Create2", referenced from:
      _PyInit__api_implementation in api_implementation.o
  "__Py_Dealloc", referenced from:
      _PyInit__api_implementation in api_implementation.o
ld: symbol(s) not found for architecture arm64
```
Fixes https://github.com/protocolbuffers/protobuf/issues/19454

#test-continuous

PiperOrigin-RevId: 702375059
2024-12-03 10:01:18 -08:00
Protobuf Team Bot
f5a293768f Drop Python 3.8 support
This was previously announced in https://engdoc.corp.google.com/eng/doc/devguide/proto/news/2024-10-02.md#dropping-python-38-support per our support policies.

#test-continuous

PiperOrigin-RevId: 698398370
2024-11-20 08:41:33 -08:00
Protobuf Team Bot
7060d3d723 Add Python 3.13 test coverage
#test-continuous

PiperOrigin-RevId: 690740783
2024-10-28 14:01:44 -07:00
Sandy Zhang
9f1b38e8a1 Update minimum supported macOS 11
This is per the updated OSS foundational support (https://github.com/google/oss-policies-info/blob/main/foundational-cxx-support-matrix.md) since Chrome has raised its minimum macOS requirements.

#test-continuous

PiperOrigin-RevId: 688657808
2024-10-22 12:59:31 -07:00
Tony Liao
b93b8e5f64 Upgrade Python test --macos_minimum_os to 10.15 (Catalina)
See prior art:
- aa3b976f42
- 67fca5cb70

OSS foundational support matrix suggests that the minimum supported macOS
version has been moved up to macOS 11 (Big Sur).
See: https://github.com/google/oss-policies-info/blob/main/foundational-cxx-support-matrix.md

#test-continuous

PiperOrigin-RevId: 687413401
2024-10-18 13:54:47 -07:00
Protobuf Team Bot
87de73d8e8 Update GitHub Actions to use macOS-13 ahead of macOS-12 deprecation.
See https://github.com/actions/runner-images/issues/10721.

#test-continuous

PiperOrigin-RevId: 684546079
2024-10-10 13:02:46 -07:00
Protobuf Team Bot
b377202cfb extend test matrix to python 3.12
PiperOrigin-RevId: 673425482
2024-09-11 09:38:49 -07:00
Protobuf Team Bot
13cf397e1a upgrade test images to bazel 6.4
PiperOrigin-RevId: 673392132
2024-09-11 08:06:35 -07:00
Deanna Garcia
2f9cdd1d65 Update GHA tests to return single pass/fail signal at the end
Before this PR, we stored a list internally of tests that must pass on presubmit and tried to keep it up to date.

This PR moves that information keeping into GitHub by adding a 'continuous-only' variable to most testing matrices to allow authors to specify which of their tests should be skipped on presubmit. During presubmit, tests that were specified to not run on presubmit will not be run and their names will be prefixed with "[SKIPPED]". All continuous only tests will be suffixed with "(Continuous)".

At the end of running all the tests, we have a single "All Blocking Tests" signal that will tell us whether all of the necessary tests have passed (either for presubmit or continuous based on how the test was triggered).

I've tested this from a different branch [here](https://github.com/protocolbuffers/protobuf/actions/runs/9602443750?pr=17151) and from a different fork [here](https://github.com/protocolbuffers/protobuf/actions/runs/9602554500?pr=17192). These should be the same and are as far as I can tell.

I also have a continuous test run [here](https://github.com/protocolbuffers/protobuf/actions/runs/9603824200) which runs the entire test suite.

Closes #17198

PiperOrigin-RevId: 662940724
2024-08-14 09:10:14 -07:00
Mike Kruskal
b28d9d4144 Migrate bazel tests to protobuf-ci.
This will allow them to reuse our bazelrc and remote caching setup.  This also silences the non-bzlmod windows test that's hitting the windows path length.

PiperOrigin-RevId: 626390416
2024-04-19 10:00:00 -07:00
Adam Cozzette
24fef03259 Add support and partial CI coverage for Python 3.12
There's a test run in test_python.yml that is non-trivial to get working with
Python 3.12 due to some refactoring of our Docker images that would be needed.
But this change updates everything else to add coverage for Python 3.12.

The main changes necessary to get the builds working were to upgrade some Pip
packages via requirements.txt, including in a patch to `rules_fuzzing` that I
plan to upstream soon. I also had to take an explicit dependency on
`setuptools`.

I removed tox.ini, since it was outdated and we have not been actively
maintaining it.

PiperOrigin-RevId: 580548224
2023-11-08 08:53:27 -08:00
Mike Kruskal
5f146f8dfe Enable caching of pip dependencies
PiperOrigin-RevId: 578740011
2023-11-01 22:21:11 -07:00
Adam Cozzette
501ececd39 Reorganize upb file structure
This change moves almost everything in the `upb/` directory up one level, so
that for example `upb/upb/generated_code_support.h` becomes just
`upb/generated_code_support.h`. The only exceptions I made to this were that I
left `upb/cmake` and `upb/BUILD` where they are, mostly because that avoids
conflict with other files and the current locations seem reasonable for now.

The `python/` directory is a little bit of a challenge because we had to merge
the existing directory there with `upb/python/`. I made `upb/python/BUILD` into
the BUILD file for the merged directory, and it effectively loads the contents
of the other BUILD file via `python/build_targets.bzl`, but I plan to clean
this up soon.

PiperOrigin-RevId: 568651768
2023-09-26 14:38:35 -07:00
Mike Kruskal
4ce04206fc Update our tests to use a custom checkout action.
This will retry up to 3 times if we hit networks flakes updating our submodules.  It will also allow us to easily inject other stability fixes to this step in the future.

PiperOrigin-RevId: 568306356
2023-09-25 13:18:39 -07:00
Sandy Zhang
c50e89217d Require Python >=3.8 and add 3.11 to test matrix
Dropping 3.7 support was already announced in https://protobuf.dev/news/2023-07-06/ and meant to be dropped in
https://github.com/protocolbuffers/protobuf/pull/13219 but tests / setup.py were missed.

PiperOrigin-RevId: 567691335
2023-09-22 12:42:38 -07:00
Adam Cozzette
9df1d76970 Prepare to reorganize upb file structure
I am getting ready to move almost everything under the upb/ directory up one
level to integrate upb better into its new location in the protobuf repo. This
change makes a few tweaks to prepare for that:
- Delete upb's LICENSE and CONTRIBUTING.md files since we already have similar
  files at the top level.
- Rename `//python:python_version` so that it won't conflict later with
  `//upb/python:python_version`.
- Move the contents of python/BUILD.bazel out to a Bazel macro to facilitate
  merging that BUILD.bazel file with upb/python/BUILD.

PiperOrigin-RevId: 567119840
2023-09-20 17:02:51 -07:00
Sandy Zhang
81068e8e8c Internal change
PiperOrigin-RevId: 566426899
2023-09-18 15:17:56 -07:00
Mike Kruskal
4d6ad56e4a Migrate to sccache for better CMake caching
This hooks up to the changes in https://github.com/protocolbuffers/protobuf-ci/pull/26.  We see a speedup of up to 50% in no-op runs of our slowest CI builds.

PiperOrigin-RevId: 565122690
2023-09-13 12:10:12 -07:00
Adam Cozzette
7286ffceb2 Merge the protobuf and upb Bazel repos
A couple weeks ago we moved upb into the protobuf Git repo, and this change
continues the merger of the two repos by making them into a single Bazel repo.
This was mostly a matter of deleting upb's WORKSPACE file and fixing up a bunch
of references to reflect the new structure.

Most of the changes are pretty mechanical, but one thing that needed more
invasive changes was the Python script for generating CMakeLists.txt,
make_cmakelists.py. The WORKSPACE file it relied on no longer exists with this
change, so I updated it to hardcode the information it needed from that file.

PiperOrigin-RevId: 564810016
2023-09-12 13:09:54 -07:00
dependabot[bot]
fa57b05755 Bump actions/setup-python from 4.5.0 to 4.7.0 (#13766)
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 4.5.0 to 4.7.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/actions/setup-python/releases">actions/setup-python's releases</a>.</em></p>
<blockquote>
<h2>v4.7.0</h2>
<p>In scope of this release, the support for reading python version from pyproject.toml was added (<a href="https://redirect.github.com/actions/setup-python/pull/669">actions/setup-python#669</a>).</p>
<pre lang="yaml"><code>      - name: Setup Python
        uses: actions/setup-python@v4
        with:
          python-version-file: pyproject.toml
</code></pre>
<h3>Besides, it includes such changes as:</h3>
<ul>
<li>Bump tough-cookie and <code>@​azure/ms-rest-js</code> by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/697">actions/setup-python#697</a></li>
<li>Bump semver from 7.3.8 to 7.5.2 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/692">actions/setup-python#692</a></li>
<li>Fix typos found by codespell by <a href="https://github.com/DimitriPapadopoulos"><code>@​DimitriPapadopoulos</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/650">actions/setup-python#650</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/dariocurr"><code>@​dariocurr</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-python/pull/669">actions/setup-python#669</a></li>
<li><a href="https://github.com/DimitriPapadopoulos"><code>@​DimitriPapadopoulos</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-python/pull/650">actions/setup-python#650</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-python/compare/v4...v4.7.0">https://github.com/actions/setup-python/compare/v4...v4.7.0</a></p>
<h2>v4.6.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix <code>allow-prereleases</code> sample configuration by <a href="https://github.com/mayeut"><code>@​mayeut</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/615">actions/setup-python#615</a></li>
<li>Fix a incorrect link advanced-usage.md by <a href="https://github.com/siyuan0322"><code>@​siyuan0322</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/657">actions/setup-python#657</a></li>
<li>Remove implicit dependency by <a href="https://github.com/nikolai-laevskii"><code>@​nikolai-laevskii</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/668">actions/setup-python#668</a></li>
<li>Automatic update of configuration files from 05/23/2023 by <a href="https://github.com/github-actions"><code>@​github-actions</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/671">actions/setup-python#671</a></li>
<li>Add warning for python 2.7 on release/v4 by <a href="https://github.com/dmitry-shibanov"><code>@​dmitry-shibanov</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/673">actions/setup-python#673</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/siyuan0322"><code>@​siyuan0322</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-python/pull/657">actions/setup-python#657</a></li>
<li><a href="https://github.com/nikolai-laevskii"><code>@​nikolai-laevskii</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-python/pull/668">actions/setup-python#668</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-python/compare/v4...v4.6.1">https://github.com/actions/setup-python/compare/v4...v4.6.1</a></p>
<h2>Add allow-prereleases input</h2>
<p>In scope of this release we added a new input (<code>allow-prereleases</code>) to allow <a href="https://redirect.github.com/actions/setup-python/pull/414">falling back to pre-release versions of Python when a matching GA version of Python is not available</a></p>
<pre lang="yaml"><code>steps:
  - uses: actions/checkout@v3
  - uses: actions/setup-python@v4
    with:
      python-version: 3.12
      allow-prereleases: true
</code></pre>
<p>Besides, we added such changes as:</p>
<ul>
<li>Fix bug to trim new line for PyPy version: <a href="https://redirect.github.com/actions/setup-python/pull/610">actions/setup-python#610</a></li>
<li>Added pip dependency file to generate hash from it: <a href="https://redirect.github.com/actions/setup-python/pull/604">actions/setup-python#604</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="61a6322f88"><code>61a6322</code></a> Fix typos found by codespell (<a href="https://redirect.github.com/actions/setup-python/issues/650">#650</a>)</li>
<li><a href="ea5b57fccc"><code>ea5b57f</code></a> Bump semver from 7.3.8 to 7.5.2 (<a href="https://redirect.github.com/actions/setup-python/issues/692">#692</a>)</li>
<li><a href="014d32a830"><code>014d32a</code></a> Bump tough-cookie and <code>@​azure/ms-rest-js</code> (<a href="https://redirect.github.com/actions/setup-python/issues/697">#697</a>)</li>
<li><a href="c16c4b8d18"><code>c16c4b8</code></a> Fix pipenv jobs (<a href="https://redirect.github.com/actions/setup-python/issues/699">#699</a>)</li>
<li><a href="0d5da6a89a"><code>0d5da6a</code></a> Read python version from pyproject.toml (fix <a href="https://redirect.github.com/actions/setup-python/issues/542">#542</a>) (<a href="https://redirect.github.com/actions/setup-python/issues/669">#669</a>)</li>
<li><a href="3f824b7ca6"><code>3f824b7</code></a> remove python 2.7 from the tests (<a href="https://redirect.github.com/actions/setup-python/issues/687">#687</a>)</li>
<li><a href="bd6b4b6205"><code>bd6b4b6</code></a> Add warning for python 2.7 (<a href="https://redirect.github.com/actions/setup-python/issues/673">#673</a>)</li>
<li><a href="0cbcb9a3d7"><code>0cbcb9a</code></a> Merge pull request <a href="https://redirect.github.com/actions/setup-python/issues/668">#668</a> from akv-platform/disallow-implicit-dependencies</li>
<li><a href="669664dac1"><code>669664d</code></a> Merge branch 'tool-config-auto-update' into disallow-implicit-dependencies</li>
<li><a href="9cbf792a3c"><code>9cbf792</code></a> Update configuration files</li>
<li>Additional commits viewable in <a href="d27e3f3d7c...61a6322f88">compare view</a></li>
</ul>
</details>
<br />

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/setup-python&package-manager=github_actions&previous-version=4.5.0&new-version=4.7.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

</details>

Closes #13766

COPYBARA_INTEGRATE_REVIEW=https://github.com/protocolbuffers/protobuf/pull/13766 from protocolbuffers:dependabot/github_actions/actions/setup-python-4.7.0 5e427982474c6dfb5304e50662f45d585acad73d
PiperOrigin-RevId: 561416587
2023-08-30 12:30:35 -07:00
Adam Cozzette
a2f3fd0367 Upgrade our emulation and tcmalloc Docker images
This will pull in a change allowing us to exclude Bazel targets using the
`-//foo:bar` syntax.

PiperOrigin-RevId: 558149395
2023-08-18 08:31:55 -07:00
Mike Kruskal
a80daa2a2c Drop support for Bazel 5.
This moves all our CI to Bazel 6 and drops the additional parameterization we had on Bazel version.

PiperOrigin-RevId: 551986376
2023-07-28 17:11:00 -07:00
Joyce
010fde9a18 Set top level permissions to read only on GitHub Workflows (#12971)
Hi, here is Joyce from Google again.

I'd like starting suggesting the [Token-Permission check](https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions) fix.

Let me know if I might be missing any permission. Thanks!

### Security Reason

This is needed because, by default, github grants write-all permission to all workflows, which could be exploit by an attacker in case of a compromised workflow. Limiting permissions is a simple and effective way to also limit the impact of an eventual compromised workflow.

Thus, it is both a recommendation from [OpenSSF Scorecard](https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions) and the [Github](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions) to always use credentials that are minimally scoped.

Closes #12971

COPYBARA_INTEGRATE_REVIEW=https://github.com/protocolbuffers/protobuf/pull/12971 from joycebrum:main 6d6dac5678
PiperOrigin-RevId: 537973051
2023-06-05 13:56:32 -07:00
Mike Kruskal
804ec94a16 Add release tests for statically linked binaries
For now, this only covers linux on the two architectures we have testing support for.  However, it serves as a good sanity check and can be expanded in the future.

PiperOrigin-RevId: 514449399
2023-03-06 10:26:21 -08:00
Mike Kruskal
723bd4c3c1 Modify release artifacts for protoc to statically link system libraries.
Closes #12063

PiperOrigin-RevId: 513034570
2023-02-28 14:13:48 -08:00
Mike Kruskal
ef8ebe6c19 Migrate our shared github actions to a separate repository.
This will make PRs from forked repositories significantly less painful, since they'll agree on which version of each action to use.  OTOH, we'll have a separate repo that needs to be maintained, and changes to it will need to be coordinated and versioned carefully.  This will likely need to be done less often though now that our infrastructure is stable.

PiperOrigin-RevId: 512117705
2023-02-24 11:19:20 -08:00
Mike Kruskal
b7e0f842e9 Remove recursive checkout for purely Bazel tests
This will prevent unnecessary network access.

PiperOrigin-RevId: 510444213
2023-02-17 09:01:08 -08:00
Mike Kruskal
f0ef44d1e1 Migrate remaining macOS tests to GHA actions
PiperOrigin-RevId: 506744609
2023-02-02 15:54:29 -08:00
Mike Kruskal
a138e54582 Migrate Python and Ruby Linux tests to GHA actions
PiperOrigin-RevId: 506449977
2023-02-01 16:12:20 -08:00