Add the publish-to-bcr workflow, .bazelci config

.bazelci/presubmit.yml

@@ -0,0 +1,36 @@
+---
+validate_config: 1
+
+# rolling` and `last_green` builds are broken until grpc v1.80.0 includes:
+# - https://github.com/grpc/grpc/commit/a1e64a2ed6a81c2f51b65c4d28b265db5892dfec
+matrix:
+  platform: ["ubuntu2204", "macos", "macos_arm64", "windows"]
+  bazel: [7.x, 8.x, 9.x]
+
+tasks:
+  ubuntu2204:
+    build_targets:
+      - "//..."
+  macos:
+    build_targets:
+      - "//..."
+  macos_arm64:
+    build_targets:
+      - "//..."
+  windows:
+    build_targets:
+      - "//..."
+  bcr_presubmit:
+    # Keep in sync with .bcr/presubmit.yml.
+    name: "BCR {bcr_bazel}"
+    working_directory: "test/bcr"
+    platform: ${{ bcr_platform }}
+    bazel: ${{ bcr_bazel }}
+    build_targets:
+      # Matches hooks/pre-commit
+      - "@bazel_remote_apis//build/bazel/remote/asset/v1:remote_asset_proto"
+      - "@bazel_remote_apis//build/bazel/remote/execution/v2:remote_execution_proto"
+      - "@bazel_remote_apis//build/bazel/remote/logstream/v1:remote_logstream_proto"
+      - "@bazel_remote_apis//build/bazel/semver:semver_proto"
+    soft_fail:
+      - exit_status: "*"

.bazelignore

@@ -0,0 +1,5 @@
+# Remove once the following is fixed:
+# - bazelbuild/bazel: Loading top-level targets in local_path_override modules
+#   in child directory breaks the build #22208
+#   https://github.com/bazelbuild/bazel/issues/22208
+test/bcr

.bazelrc

@@ -1,2 +1,25 @@
 # Include comments in generated code for godoc.
 build --experimental_proto_descriptor_sets_include_source_info
+
+# Ensure that the `MODULE.bazel.lock` files don't change silently.
+# - Set to `refresh` to actually update the lockfiles.
+# - Set to `update` when testing a Bazel version different from .bazelversion
+#   (or comment it out, since `update` is the default).
+common --lockfile_mode=error
+
+# - cc_binary, java_library required for protobuf v30.0 + Bazel 8 compatibility
+# - cc_library required for Bazel 9 until grpc v1.80.0 becomes the default
+#   https://github.com/grpc/grpc/commit/a1e64a2ed6a81c2f51b65c4d28b265db5892dfec
+# - rolling` and `last_green` builds no longer support this flag, so those
+#   builds are broken until grpc v1.80.0 becomes the default.
+common --incompatible_autoload_externally=+cc_binary,+cc_library,+java_library
+
+common --enable_platform_specific_config
+
+# Required for Bazel 7 to compile protobuf v30.0 (actually, for abseil-cpp)
+common:linux --cxxopt=-std=c++17
+common:linux --host_cxxopt=-std=c++17
+common:macos --cxxopt=-std=c++17
+common:macos --host_cxxopt=-std=c++17
+common:windows --cxxopt=/std=c++17
+common:windows --host_cxxopt=/std=c++17

.bazelversion

@@ -1 +1 @@
-9.0.0
+9.0.1

.bcr/metadata.template.json

@@ -0,0 +1,15 @@
+{
+  "homepage": "https://github.com/bazelbuild/remote-apis",
+  "maintainers": [
+    {
+      "name": "Tiago Quelhas",
+      "email": "tjgq@google.com",
+      "github": "tjgq"
+    }
+  ],
+  "versions": [],
+  "yanked_versions": {},
+  "repository": [
+    "github:bazelbuild/remote-apis"
+  ]
+}

.bcr/presubmit.yml

@@ -0,0 +1,19 @@
+# Keep in sync with the bcr_presubmit job from .bazelci/presubmit.yml.
+bcr_test_module:
+  module_path: "test/bcr"
+  matrix:
+    platform: ["ubuntu2204", "macos", "macos_arm64", "windows"]
+    # rolling` and `last_green` builds are broken until grpc v1.80.0 includes:
+    # - https://github.com/grpc/grpc/commit/a1e64a2ed6a81c2f51b65c4d28b265db5892dfec
+    bazel: [7.x, 8.x, 9.x]
+  tasks:
+    run_tests:
+      name: "Build @bazel_remote_apis targets from the test/bcr module"
+      platform: ${{ platform }}
+      bazel: ${{ bazel }}
+      build_targets:
+        # Matches hooks/pre-commit
+        - "@bazel_remote_apis//build/bazel/remote/asset/v1:remote_asset_proto"
+        - "@bazel_remote_apis//build/bazel/remote/execution/v2:remote_execution_proto"
+        - "@bazel_remote_apis//build/bazel/remote/logstream/v1:remote_logstream_proto"
+        - "@bazel_remote_apis//build/bazel/semver:semver_proto"

.bcr/source.template.json

@@ -0,0 +1,5 @@
+{
+  "integrity": "",
+  "strip_prefix": "{REPO}-{VERSION}",
+  "url": "https://github.com/{OWNER}/{REPO}/releases/download/{TAG}/{REPO}-{TAG}.tar.gz"
+}

.github/workflows/publish-to-bcr.yml

@@ -0,0 +1,40 @@
+# Publishes to the Bazel Central Registry.
+#
+# Based on .github/workflows/publish-to-bcr.yml from
+# bazel-contrib/rules_scala v7.2.4.
+name: Publish to the Bazel Central Registry
+
+on:
+  # Run from release.yml.
+  workflow_call:
+    inputs:
+      tag_name:
+        required: true
+        type: string
+    secrets:
+      bcr_publish_token:
+        required: true
+
+  # In case of problems, enable manual dispatch from the GitHub UI.
+  workflow_dispatch:
+    inputs:
+      tag_name:
+        required: true
+        type: string
+
+jobs:
+  publish-to-bcr:
+    uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@v1.1.0
+    with:
+      tag_name: ${{ inputs.tag_name }}
+      # bazelbuild/bazel-central-registry fork used to open a pull request.
+      registry_fork: bazel-io/bazel-central-registry
+      # No need to create a draft since PRs are opened by a machine account
+      draft: false
+    permissions:
+      attestations: write
+      contents: write
+      id-token: write
+    secrets:
+      # Necessary to push to the BCR fork and open a pull request.
+      publish_token: ${{ secrets.bcr_publish_token }}

.github/workflows/release.yml

@@ -0,0 +1,43 @@
+# Cut a release whenever a new tag is pushed to the repo.
+# You should use an annotated tag, like `git tag -a v1.2.3`.
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+
+  # In case of problems, enable manual dispatch from the GitHub UI.
+  workflow_dispatch:
+    inputs:
+      tag_name:
+        required: true
+        type: string
+
+# Uses the `release_ruleset` workflow to generate provenance attestation files
+# referenced by the `publish-to-bcr` workflow.
+#
+# Based on .github/workflows/release.yml from bazel-contrib/rules_scala v7.2.4.
+# See .bcr/README.md.
+
+permissions:
+  attestations: write # Needed to attest provenance
+  contents: write # Needed to create release
+  id-token: write # Needed to attest provenance
+
+jobs:
+  release:
+    uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@v7.4.0
+    with:
+      bazel_test_command: "bazel build //..."
+      prerelease: false
+      release_files: remote-apis-*.tar.gz
+      tag_name: ${{ inputs.tag_name || github.ref_name }}
+
+  publish-to-bcr:
+    needs: release
+    uses: ./.github/workflows/publish-to-bcr.yml
+    with:
+      tag_name: ${{ inputs.tag_name || github.ref_name }}
+    secrets:
+      bcr_publish_token: ${{ secrets.bcr_publish_token }}

.github/workflows/release_prep.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+
+set -o errexit -o nounset -o pipefail
+
+# Single tag arg passed by
+# https://github.com/bazel-contrib/.github/blob/master/.github/workflows/release_ruleset.yaml
+TAG="$1"
+VERSION="${TAG#v}"
+PREFIX="remote-apis-${VERSION}"
+ARCHIVE="remote-apis-$TAG.tar.gz"
+
+# Don't archive .bazelversion symlinks, as they break Bazel as of
+# bazelbuild/bazel@f942a706a39f9803e5611b1973172ece361197ac.
+# See: https://github.com/bazelbuild/bazel-worker-api/issues/21
+git archive --format=tar --prefix=${PREFIX}/ ${TAG} \
+  ':!:**.bazelversion' \
+  ':!:.bazelci/' \
+  ':!:.bcr/' \
+  ':!:.github/' \
+  ':!:hooks/' \
+  ':!:test/bcr/' \
+  | gzip > $ARCHIVE
+SHA=$(shasum -a 256 $ARCHIVE | awk '{print $1}')
+
+cat << EOF
+## Using Bzlmod
+
+Paste this snippet into your \`MODULE.bazel\` file:
+
+\`\`\`starlark
+bazel_dep(name = "bazel_remote_apis", version = "${VERSION}")
+\`\`\`
+
+## Using WORKSPACE
+
+Paste this snippet into your legacy \`WORKSPACE\` file:
+
+\`\`\`starlark
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
+http_archive(
+    name = "bazel_remote_apis",
+    sha256 = "${SHA}",
+    strip_prefix = "${PREFIX}",
+    url = "https://github.com/bazelbuild/remote-apis/releases/download/${TAG}/${ARCHIVE}",
+)
+\`\`\`
+EOF

.gitignore

@@ -3,8 +3,4 @@
 # Ignore Vim swap files.
 .*.sw*
 # Ignore bazel directories
-/bazel-bin
-/bazel-genfiles
-/bazel-out
-/bazel-remote-apis
-/bazel-testlogs
+bazel-*

MODULE.bazel

@@ -3,14 +3,22 @@ module(
     version = "",
 )
 
-bazel_dep(name = "grpc", version = "1.76.0.bcr.1")
-bazel_dep(name = "rules_proto", version = "7.1.0")
-bazel_dep(name = "protobuf", version = "33.5")
+# For compatibility with newer Bazels
+# https://github.com/grpc/grpc/commit/ed7916161a405b0e01aa7c39494c7dd536264ea4
+bazel_dep(name = "grpc", version = "1.73.1")
+bazel_dep(name = "rules_proto", version = "7.0.2")
+bazel_dep(name = "protobuf", version = "30.0")
 bazel_dep(name = "googleapis", version = "0.0.0-20260130-c0fcb356")
+# https://github.com/bazel-contrib/rules_foreign_cc/commit/3b0ebe8094f03577166ba0356e9c30ac05f0850a
+bazel_dep(name = "rules_foreign_cc", version = "0.13.0")
 bazel_dep(name = "rules_go", version = "0.59.0")
-bazel_dep(name = "gazelle", version = "0.47.0")
+bazel_dep(name = "gazelle", version = "0.47.0", dev_dependency = True)
 
-go_deps = use_extension("@gazelle//:extensions.bzl", "go_deps")
+go_deps = use_extension(
+    "@gazelle//:extensions.bzl",
+    "go_deps",
+    dev_dependency = True,
+)
 go_deps.from_file(go_mod = "//:go.mod")
 use_repo(
     go_deps,