55 Commits

Author SHA1 Message Date
Salman Chishti
adf9e8b80f Upgrade GitHub Actions for Node 24 compatibility (#25572)
## Summary

Upgrade GitHub Actions to their latest versions to ensure compatibility with Node 24, as Node 20 will reach end-of-life in April 2026.

## Changes

| Action | Old Version(s) | New Version | Release | Files |
|--------|---------------|-------------|---------|-------|
| `actions/cache` | [`1bd1e32`](1bd1e32a3b) | [`8b402f5`](8b402f58fb) | [Release](https://github.com/actions/cache/releases/tag/v5) | clear_caches.yml |
| `actions/checkout` | [`8ade135`](8ade135a41) | [`8e8c483`](8e8c483db8) | [Release](https://github.com/actions/checkout/releases/tag/v6) | scorecard.yml, staleness_refresh.yml, update_php_repo.yml |
| `actions/download-artifact` | [`018cc2c`](018cc2cf5b), [`fa0a91b`](fa0a91b85d) | [`37930b1`](37930b1c2a) | [Release](https://github.com/actions/download-artifact/releases/tag/v7) | test_cpp.yml, test_php_ext.yml, test_upb.yml |
| `actions/setup-dotnet` | [`3447fd6`](3447fd6a9f) | [`baa11fb`](baa11fbfe1) | [Release](https://github.com/actions/setup-dotnet/releases/tag/v5) | test_csharp.yml |
| `actions/setup-java` | [`3a4f6e1`](3a4f6e1af5) | [`be666c2`](be666c2fcd) | [Release](https://github.com/actions/setup-java/releases/tag/v5) | test_bazel.yml |
| `actions/setup-python` | [`39cd149`](39cd14951b), [`e797f83`](e797f83bcb) | [`a309ff8`](a309ff8b42) | [Release](https://github.com/actions/setup-python/releases/tag/v6) | test_python.yml, test_upb.yml |
| `actions/stale` | [`b69b346`](b69b346013) | [`9971854`](997185467f) | [Release](https://github.com/actions/stale/releases/tag/v10) | janitor.yml |
| `actions/upload-artifact` | [`5076954`](50769540e7), [`v4`](https://github.com/actions/upload-artifact/releases/tag/v4) | [`b7c566a`](b7c566a772) | [Release](https://github.com/actions/upload-artifact/releases/tag/v6) | scorecard.yml, test_cpp.yml, test_php_ext.yml, test_ruby.yml, test_upb.yml |

## Context

Per [GitHub's announcement](https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/), Node 20 is being deprecated and runners will begin using Node 24 by default starting March 4th, 2026.

### Why this matters

- **Node 20 EOL**: April 2026
- **Node 24 default**: March 4th, 2026
- **Action**: Update to latest action versions that support Node 24

### Security Note

Actions that were previously pinned to commit SHAs remain pinned to SHAs (updated to the latest release SHA) to maintain the security benefits of immutable references.

### Testing

These changes only affect CI/CD workflow configurations and should not impact application functionality. The workflows should be tested by running them on a branch before merging.

Closes #25572

COPYBARA_INTEGRATE_REVIEW=https://github.com/protocolbuffers/protobuf/pull/25572 from salmanmkc:upgrade-github-actions-node24 ef77dcfa4f
PiperOrigin-RevId: 874140973
2026-02-23 10:27:07 -08:00
Joshua Haberman
1ea2c4bab5 Updated release builds to use Bazel 8 and platforms.
Bazel 8 no longer supports legacy toolchains, so all of our release toolchains have been updated to use platforms.

#test-continuous

PiperOrigin-RevId: 870017275
2026-02-13 21:47:47 -08:00
Protobuf Team Bot
52efc0b2bb Update Ruby 4.0 test Docker image and enable continuous tests.
This docker image includes ruby gems v4.0.5, which includes https://github.com/ruby/rubygems/pull/9245 that fixes building multiple native extensions.

PiperOrigin-RevId: 863399053
2026-01-30 14:44:44 -08:00
Frederik Spang
93f4eba258 Support Ruby 4.0 (#25051)
Note: Building the protobuf gem with versions of rubygems that include https://github.com/ruby/rubygems/pull/8569 is broken due to the issue reported in https://github.com/ruby/rubygems/issues/9244. Workaround is to use a rubygems version below 3.7.0 to build the gem.

Closes #25051

COPYBARA_INTEGRATE_REVIEW=https://github.com/protocolbuffers/protobuf/pull/25051 from frederikspang:main 83f91c76e1
PiperOrigin-RevId: 858713403
2026-01-20 12:54:12 -08:00
Mikita Belahlazau
4f076d951f Add metadata annotations for generated Python protobuf symbols.
The pyi generator now includes Kythe annotations for:
*   Extension field constants (e.g., `EXTENSION_FIELD`).
*   Field number constants (e.g., `STRING_FIELD_FIELD_NUMBER`).
*   `Create` methods in generated Stubby client classes.

These annotations allow the Python indexer to link these generated symbols back to their definitions in the `.proto` files.

PiperOrigin-RevId: 852971617
2026-01-06 16:05:56 -08:00
Protobuf Team Bot
ae67a4c195 Internal version update.
PiperOrigin-RevId: 852733884
2026-01-06 05:27:44 -08:00
Eric Salo
a6fbd40d7e Update GitHub Actions to use macOS-14.
See https://github.com/actions/runner-images/issues/13046.

#test-continuous

PiperOrigin-RevId: 835391347
2025-11-21 16:05:25 -08:00
Mike Kruskal
f764f12dc8 Upgrade to protobuf-ci v5
PiperOrigin-RevId: 825653280
2025-10-29 12:14:52 -07:00
Mike Kruskal
c2608c1c8d Mark aarch64 tests continous-only
These are by far our slowest tests due to their QEMU use.  They rarely catch unique issues, so we can handle this in post-submits instead of paying ~4 minutes on every presubmit

PiperOrigin-RevId: 818873557
2025-10-13 16:07:46 -07:00
Adam Cozzette
25d7981143 Upgrade to Bazel 7.6.1
This is necessary for upgrading setuptools, because older Bazel versions apparently can't handle whitespace in file names: https://github.com/protocolbuffers/protobuf/pull/22094

PiperOrigin-RevId: 780210543
2025-07-07 12:22:23 -07:00
Deanna Garcia
6feb80dbd0 Test ruby bazel 8
Note that cross compilation tests are still in bazel 7 while we debug b/409557730
#test-continuous

PiperOrigin-RevId: 745750653
2025-04-09 15:13:13 -07:00
Mike Kruskal
2ad7546e0e Re-enable aarch64 tests.
These were broken by a QEMU bug that appears to have been broken by a recent hardening added to the ubuntu kernel rolled out to the github runner images.

See https://bugs.launchpad.net/ubuntu/+source/qemu/+bug/2096782 and https://github.com/tonistiigi/binfmt/issues/215 for more information.

PiperOrigin-RevId: 740895829
2025-03-26 14:07:17 -07:00
Protobuf Team Bot
5de7c80e32 Drop Ruby 3.0
Bump to Bundler v2.6.6 now that the minimum supported Ruby version is 3.1.

PiperOrigin-RevId: 738125541
2025-03-18 13:36:49 -07:00
Adam Cozzette
6aefdde973 Automated rollback of commit 46e602c914.
PiperOrigin-RevId: 737031015
2025-03-14 17:12:48 -07:00
Adam Cozzette
46e602c914 Automated rollback of commit d311374b14.
PiperOrigin-RevId: 736907364
2025-03-14 10:28:46 -07:00
Mike Kruskal
0d844b8d3f Fix ruby release tests
PiperOrigin-RevId: 734388414
2025-03-06 20:43:11 -08:00
Sandy Zhang
d311374b14 Temporarily disable broken aarch64 test runs.
This seems to have been broken by latest github ubuntu runner image.

PiperOrigin-RevId: 732135074
2025-02-28 08:10:48 -08:00
Protobuf Team Bot
06ba410c27 Bump the C++/Ruby CI runner images
Reenable aarch64 tests

PiperOrigin-RevId: 723490932
2025-02-05 06:47:30 -08:00
Adam Cozzette
e77920478c Temporarily disable or remove flaky aarch64 test runs
These tests are currently flaky but should be fixed soon by a new image
rollout.

I plan on rolling back this change in a couple of days once the issue is fixed.

PiperOrigin-RevId: 720598019
2025-01-28 09:13:40 -08:00
Jason Lunn
4a92a1c9bf Support ruby 3.4 (#19752)
#test-continuous

Closes #19752

COPYBARA_INTEGRATE_REVIEW=https://github.com/protocolbuffers/protobuf/pull/19752 from protocolbuffers:support_ruby_3.4 d326fc2a6f
PiperOrigin-RevId: 715037231
2025-01-13 11:10:53 -08:00
Sandy Zhang
aef40aaf83 Update protobuf repository to use the newest version (v4) of protobuf-ci
#test-continuous

PiperOrigin-RevId: 712618052
2025-01-06 12:33:01 -08:00
Deanna Garcia
afe2de2618 Move to bazel 7 and turn down support for bazel 6.
Migrate all tests to run on bazel 7 and fix errors that came up in the process. 30.x will no longer guarantee support for bazel 6.
#test-continuous

PiperOrigin-RevId: 703590770
2024-12-06 13:05:40 -08:00
Protobuf Team Bot
87de73d8e8 Update GitHub Actions to use macOS-13 ahead of macOS-12 deprecation.
See https://github.com/actions/runner-images/issues/10721.

#test-continuous

PiperOrigin-RevId: 684546079
2024-10-10 13:02:46 -07:00
Protobuf Team Bot
13cf397e1a upgrade test images to bazel 6.4
PiperOrigin-RevId: 673392132
2024-09-11 08:06:35 -07:00
Deanna Garcia
f6a6b060e2 Edit GHA to never skip full jobs on presubmit -- only steps.
This ensures the names of these jobs will properly be prefixed with "[SKIPPED] (Continuous)" and will show as passed instead of skipped.

PiperOrigin-RevId: 666918220
2024-08-23 14:16:07 -07:00
Deanna Garcia
2f9cdd1d65 Update GHA tests to return single pass/fail signal at the end
Before this PR, we stored a list internally of tests that must pass on presubmit and tried to keep it up to date.

This PR moves that information keeping into GitHub by adding a 'continuous-only' variable to most testing matrices to allow authors to specify which of their tests should be skipped on presubmit. During presubmit, tests that were specified to not run on presubmit will not be run and their names will be prefixed with "[SKIPPED]". All continuous only tests will be suffixed with "(Continuous)".

At the end of running all the tests, we have a single "All Blocking Tests" signal that will tell us whether all of the necessary tests have passed (either for presubmit or continuous based on how the test was triggered).

I've tested this from a different branch [here](https://github.com/protocolbuffers/protobuf/actions/runs/9602443750?pr=17151) and from a different fork [here](https://github.com/protocolbuffers/protobuf/actions/runs/9602554500?pr=17192). These should be the same and are as far as I can tell.

I also have a continuous test run [here](https://github.com/protocolbuffers/protobuf/actions/runs/9603824200) which runs the entire test suite.

Closes #17198

PiperOrigin-RevId: 662940724
2024-08-14 09:10:14 -07:00
Jason Lunn
2088bc6e66 Disable upload artifacts action (#17160)
Address [test flakes](https://github.com/protocolbuffers/protobuf/actions/runs/9527280868/job/26263735005) introduced by failure of the `upload-artifacts` GHA

Closes #17160

COPYBARA_INTEGRATE_REVIEW=https://github.com/protocolbuffers/protobuf/pull/17160 from protocolbuffers:disable-upload-artifacts-action 87c458388d
PiperOrigin-RevId: 644228044
2024-06-17 20:52:26 -07:00
Protobuf Team Bot
e595749c9c Reenable FFI tests on CRuby.
PiperOrigin-RevId: 640188804
2024-06-04 10:00:40 -07:00
Protobuf Team Bot
475158ef61 Internal change
PiperOrigin-RevId: 639885959
2024-06-03 13:09:47 -07:00
Mike Kruskal
b28d9d4144 Migrate bazel tests to protobuf-ci.
This will allow them to reuse our bazelrc and remote caching setup.  This also silences the non-bzlmod windows test that's hitting the windows path length.

PiperOrigin-RevId: 626390416
2024-04-19 10:00:00 -07:00
Jason Lunn
801049a43e Update JRuby from 9.4.3.0 to 9.4.6.0. (#16381)
Closes #16381

COPYBARA_INTEGRATE_REVIEW=https://github.com/protocolbuffers/protobuf/pull/16381 from protocolbuffers:jruby_9.4.6.0 e9d1244efa
PiperOrigin-RevId: 621364008
2024-04-02 19:25:11 -07:00
Sandy Zhang
360531cd08 Drop Ruby 2.7.
This updates the required ruby version to >= 3.0 and removes Ruby 2.7 tests from main branch, in anticipation for end of Ruby 2.7 support on 3/31 in 27.x

See https://cloud.google.com/ruby/getting-started/supported-ruby-versions

PiperOrigin-RevId: 612841114
2024-03-05 08:06:23 -08:00
Sandy Zhang
0317875286 Update Ruby GHA to test against Ruby 3.3 in Linux / MacOS / Install and FFI combinations.
PiperOrigin-RevId: 594132729
2023-12-27 18:20:06 -08:00
Sandy Zhang
2f7b2832b6 Update Ruby GHA to test against Ruby 3.3.
Fixes #15182

PiperOrigin-RevId: 593899707
2023-12-26 19:46:27 -08:00
Sandy Zhang
9f96118e1e Pin bundler version to 2.4.22 for Ruby 2.7 support.
Latest bundler 2.5.0 release results in the following error: `The last version of bundler (>= 0) to support your Ruby & RubyGems was 2.4.22. Try installing it with gem install bundler -v 2.4.22 bundler requires Ruby version >= 3.0.0. The current ruby version is 2.7.3.183.`

PiperOrigin-RevId: 591288515
2023-12-15 10:10:11 -08:00
Mike Kruskal
4ce04206fc Update our tests to use a custom checkout action.
This will retry up to 3 times if we hit networks flakes updating our submodules.  It will also allow us to easily inject other stability fixes to this step in the future.

PiperOrigin-RevId: 568306356
2023-09-25 13:18:39 -07:00
Mike Kruskal
1210eac457 Don't check out submodules in tests that don't need them.
This will help prevent network flakes.

PiperOrigin-RevId: 568287969
2023-09-25 12:12:46 -07:00
Sandy Zhang
81068e8e8c Internal change
PiperOrigin-RevId: 566426899
2023-09-18 15:17:56 -07:00
Mike Kruskal
395bfe1d55 Cleanup Bazel/Bash CI commands
PiperOrigin-RevId: 561422532
2023-08-30 12:53:17 -07:00
Adam Cozzette
0937be16c0 Update PHP and Ruby amalgamations in regenerate_stale_files.sh
This removes the need for us to manually rebuild these amalgamation files. I
added the "manual" tag to the corresponding staleness tests so that we won't
get presubmit errors if the amalgamation files are out of date. I also had to
tweak the Ruby BUILD.bazel file to make sure it uses Bazel-generated
amalgamations instead of relying on the checked-in files.

I added deliberate errors to the Ruby and PHP amalgamation files to test that
everything is working. We should not see any CI errors, and the files should
quickly be auto-updated after the change lands on main.

PiperOrigin-RevId: 561187352
2023-08-29 18:05:38 -07:00
Stan Hu
055c3782f6 ruby: Fix object cache lookups on 32-bit platforms (#13494)
https://github.com/protocolbuffers/protobuf/pull/13204 refactored the Ruby object cache to use a key of `LL2NUM(key_val)` instead of `LL2NUM(key_val >> 2)`. On 32-bit systems, `LL2NUM(key_val)` returns inconsistent results because a large value has to be stored as a Bignum on the heap. This causes cache lookups to fail.

This commit restores the previous behavior of using `ObjectCache_GetKey`, which discards the lower 2 bits, which are zero. This enables a key to be stored as a Fixnum on both 32 and 64-bit platforms.

As https://patshaughnessy.net/2014/1/9/how-big-is-a-bignum describes, a Fixnum uses:

* 1 bit for the `FIXNUM_FLAG`.
* 1 bit for the sign flag.

Therefore the largest possible Fixnum value on a 64-bit value is 4611686018427387903 (2^62 - 1). On a 32-bit system, the largest value  is 1073741823 (2^30 - 1).

For example, a possible VALUE pointer address on a 32-bit system:

0xff5b4af8 => 4284173048

Dropping the lower 2 bits makes up for the loss of range to these flags. In the example above, we see that shifting by 2 turns the value into a 30-bit number, which can be represented as a Fixnum:

(0xff5b4af8 >> 2) => 1071043262

This bug can also manifest on a 64-bit system if the upper bits are 0xff.

Closes #13481

Closes #13494

COPYBARA_INTEGRATE_REVIEW=https://github.com/protocolbuffers/protobuf/pull/13494 from stanhu:sh-fix-ruby-protobuf-32bit d63122a6fc
PiperOrigin-RevId: 557211768
2023-08-15 12:54:32 -07:00
Mike Kruskal
04a7cfb3ee Disable flaky linux ruby FFI tests.
A previous change accidentally disabled the gem install tests instead, which weren't flaky.

PiperOrigin-RevId: 555615548
2023-08-10 13:08:00 -07:00
Mike Kruskal
c15655bb80 Disable Ruby FFI tests until flakes are resolved
PiperOrigin-RevId: 555173058
2023-08-09 08:41:08 -07:00
Mike Kruskal
a80daa2a2c Drop support for Bazel 5.
This moves all our CI to Bazel 6 and drops the additional parameterization we had on Bazel version.

PiperOrigin-RevId: 551986376
2023-07-28 17:11:00 -07:00
Jason Lunn
c52d80cf04 Ruby FFI implementation (#13343)
Supersedes #11483.

Closes #13343

COPYBARA_INTEGRATE_REVIEW=https://github.com/protocolbuffers/protobuf/pull/13343 from protocolbuffers:simultaneous_ffi bcb4bb7842
PiperOrigin-RevId: 550782245
2023-07-24 23:17:47 -07:00
Jason Lunn
59e19a7db8 Add JRuby 9.3 and 9.4 to the test matrix under both Bazel versions. (#13296)
Prepare for 9.2 to be removed.

Closes #13296

COPYBARA_INTEGRATE_REVIEW=https://github.com/protocolbuffers/protobuf/pull/13296 from protocolbuffers:jruby_version_bump 82924ab6b3
PiperOrigin-RevId: 548279470
2023-07-14 20:11:41 -07:00
Joshua Haberman
3f98af287b Updated Ruby min version to 2.7, and removed some compat code
PiperOrigin-RevId: 547245820
2023-07-11 11:32:03 -07:00
Joyce
010fde9a18 Set top level permissions to read only on GitHub Workflows (#12971)
Hi, here is Joyce from Google again.

I'd like starting suggesting the [Token-Permission check](https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions) fix.

Let me know if I might be missing any permission. Thanks!

### Security Reason

This is needed because, by default, github grants write-all permission to all workflows, which could be exploit by an attacker in case of a compromised workflow. Limiting permissions is a simple and effective way to also limit the impact of an eventual compromised workflow.

Thus, it is both a recommendation from [OpenSSF Scorecard](https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions) and the [Github](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions) to always use credentials that are minimally scoped.

Closes #12971

COPYBARA_INTEGRATE_REVIEW=https://github.com/protocolbuffers/protobuf/pull/12971 from joycebrum:main 6d6dac5678
PiperOrigin-RevId: 537973051
2023-06-05 13:56:32 -07:00
Mike Kruskal
f6c7fdf88c Add -ex switch to all docker bash commands.
Without this, certain failures will be silently ignored.

PiperOrigin-RevId: 527718574
2023-04-27 16:48:31 -07:00
Mike Kruskal
723bd4c3c1 Modify release artifacts for protoc to statically link system libraries.
Closes #12063

PiperOrigin-RevId: 513034570
2023-02-28 14:13:48 -08:00