chore: bump Bazel from 6.5.0 to 7.7.1 (#475)

Summary of changes introduced:

* Updates:
  * Updated Bazel to 7.7.1
  * Updated platforms from 0.0.10 -> 1.0.0
  * Updated rules_cc from 0.0.9 -> 0.1.5
  * Updated toolchains_llvm from 0.10.3 -> v1.4.0
  * Updated rules_foreign_cc from 0.7.1 -> 0.15.1
  * Updated rules_fuzzing from 0.5.2 -> 0.6.0
  * Updated rules_python from 0.34.0 -> 1.6.1
  * Updated rules_rust from 0.42.1 -> 0.68.1
  * Updated com_google_protobuf from 3.17.3 -> 29.1
  * Updated llvm (for WAMR) from 15.0.7 -> 19.1.0
  * Updated rustc from 1.77.2 -> 1.91.0
  * Updated python toolchain from 3.9 -> 3.11
  * Added bazel_features, aspect_rules_lint, bazel_lib, aspect_bazel_lib, aspect_rules_js
  * Updated wasmsign to wasmsign2
* User-facing changes:
  * Migrates to wasmsign2. The old wasmsign library was not compatible with the updated rustc, since new wasm instructions failed validation in the wasmsign library. The new wasm signature format changed to follow the wasm signature spec: https://github.com/WebAssembly/tool-conventions/blob/main/Signatures.md. See src/signature_util.cc for changes to the new signature format.
* Changes for developers:
  * Uses rules_aspect_lint for clang-tidy integration rather than bazel-clang-tidy
  * Updates s390x docker file to use 
  * Changes CI to use caching provided by bazel-contrib/setup-bazel
  * Updates macos CI runners to use macos 15
  * Updates all CI runners to use the vendored toolchain

---

Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>
Signed-off-by: Matt Leon <mattleon@google.com>

Author: mmorel-35

.bazelrc

@@ -58,10 +58,9 @@ build:clang-tsan --linkopt -fsanitize=thread
 build:clang-tsan --test_env=TSAN_OPTIONS=suppressions=bazel/tsan_suppressions.txt
 
 # Use Clang-Tidy tool.
-build:clang-tidy --config=clang
-build:clang-tidy --aspects @bazel_clang_tidy//clang_tidy:clang_tidy.bzl%clang_tidy_aspect
-build:clang-tidy --@bazel_clang_tidy//:clang_tidy_config=@proxy_wasm_cpp_host//:clang_tidy_config
-build:clang-tidy --output_groups=report
+build:clang-tidy --aspects //tools/lint:linters.bzl%clang_tidy
+build:clang-tidy --output_groups=rules_lint_report
+build:clang-tidy --config=hermetic-llvm
 
 # Use GCC compiler.
 build:gcc --action_env=BAZEL_COMPILER=gcc
@@ -72,11 +71,6 @@ build:hermetic-llvm --incompatible_enable_cc_toolchain_resolution
 build:hermetic-llvm --action_env BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
 build:hermetic-llvm --extra_toolchains @emsdk//emscripten_toolchain:cc-toolchain-wasm
 
-build:hermetic-llvm-macos --config=hermetic-llvm
-# Below flags mitigate https://github.com/bazel-contrib/toolchains_llvm/pull/229.
-build:hermetic-llvm-macos --features=-libtool
-build:hermetic-llvm-macos --features=-supports_dynamic_linker
-
 build --enable_platform_specific_config
 
 # Use C++20.

.bazelversion

@@ -1 +1 @@
-6.5.0
+7.7.1

.github/workflows/format.yml

@@ -88,6 +88,13 @@ jobs:
     steps:
     - uses: actions/checkout@v2
 
+    - uses: bazel-contrib/setup-bazel@0.16.0
+      with:
+        bazelisk-cache: true
+        disk-cache: ${{ github.job }}
+        external-cache: true
+        repository-cache: true
+
     - name: Format (bazel query)
       run: |
         bazel query 'deps(//bazel/cargo/...)'
@@ -122,43 +129,18 @@ jobs:
     steps:
     - uses: actions/checkout@v2
 
-    - name: Install dependencies (Linux)
-      run: sudo apt update -y && sudo apt install -y clang-tidy-18 lld-18 && sudo ln -sf /usr/bin/lld-18 /usr/bin/lld
-
-    - name: set cache name
-      id: vars
-      # The cache tag consists of the following parts:
-      # * clang-tidy- prefix
-      # * matrix.name, which separates the cache for each build type.
-      # * hash of WORKSPACE, .bazelrc, and .bazelversion, which is
-      #   purely to differentiate caches for substantial changes in bazel.
-      # * github.sha, which is the commit hash of the commit used to generate
-      #   the cache entry.
-      run: echo "CACHE_TAG=clang-tidy-${{ matrix.name }}-${{ hashFiles('WORKSPACE', '.bazelrc', '.bazelversion') }}" >> "$GITHUB_OUTPUT"
-
-    - name: bazel cache
-      uses: actions/cache/restore@v3
+    - uses: bazel-contrib/setup-bazel@0.16.0
       with:
-        path: /tmp/bazel/cache
-        key: ${{ steps.vars.outputs.CACHE_TAG }}-${{ github.sha }}
-        restore-keys: |
-          ${{ steps.vars.outputs.CACHE_TAG }}-${{ github.sha }}
-          ${{ steps.vars.outputs.CACHE_TAG }}-
-          clang-tidy-${{ matrix.name }}-
-          clang-tidy-
+        bazelisk-cache: true
+        disk-cache: ${{ github.job }}
+        external-cache: true
+        repository-cache: true
 
     - name: Bazel build
       run: >
         bazel build
+        --config=hermetic-llvm
         --config clang-tidy
         --define engine=multi
-        --disk_cache /tmp/bazel/cache
-        --copt=-DPROXY_WASM_VERIFY_WITH_ED25519_PUBKEY=\"$(xxd -p -c 256 test/test_data/signature_key1.pub | cut -b9-)\"
+        --copt=-DPROXY_WASM_VERIFY_WITH_ED25519_PUBKEY=\"$(xxd -p -c 256 test/test_data/signature_key1.pub | cut -c3-)\"
         //...
-
-    - name: save bazel cache
-      uses: actions/cache/save@v3
-      if: always()
-      with:
-        path: /tmp/bazel/cache
-        key: ${{ steps.vars.outputs.CACHE_TAG }}-${{ github.sha }}

.github/workflows/test.yml

@@ -48,34 +48,20 @@ jobs:
     steps:
     - uses: actions/checkout@v2
 
-    - name: set cache name
-      id: vars
-      # The cache tag consists of the following parts:
-      # * test-deps-bazel-cache- prefix
-      # * hash of WORKSPACE, .bazelrc, and .bazelversion, which is
-      #   purely to differentiate caches for substantial changes in bazel.
-      # * github.sha, which is the commit hash of the commit used to generate
-      #   the cache entry.
-      run: echo "CACHE_TAG=test-deps-bazel-cache-${{ hashFiles('WORKSPACE', '.bazelrc', '.bazelversion') }}" >> "$GITHUB_OUTPUT"
-
-    - name: bazel cache
-      uses: actions/cache/restore@v3
+    - uses: bazel-contrib/setup-bazel@0.16.0
       with:
-        path: /tmp/bazel/cache
-        key: ${{ steps.vars.outputs.CACHE_TAG }}-${{ github.sha }}
-        restore-keys: |
-          ${{ steps.vars.outputs.CACHE_TAG }}-${{ github.sha }}
-          ${{ steps.vars.outputs.CACHE_TAG }}-
-          test-deps-bazel-cache-${{ matrix.name }}-
-          test-deps-bazel-cache-
+        bazelisk-cache: true
+        disk-cache: ${{ github.job }}
+        external-cache: true
+        repository-cache: true
 
     - name: Bazel build
       run: >
         bazel build
         --verbose_failures
         --test_output=errors
         --config=clang
-        --disk_cache /tmp/bazel/cache
+        --config=hermetic-llvm
         -c opt
         $(bazel query 'kind(was.*_rust_binary, //test/test_data/...)')
         $(bazel query 'kind(_optimized_wasm_cc_binary, //test/test_data/...)')
@@ -99,22 +85,6 @@ jobs:
         if-no-files-found: error
         retention-days: 3
 
-    - name: remove unaccessed files from cache
-      shell: bash
-      run: >
-        find /tmp/bazel/cache
-        -type f
-        -name '*'
-        -amin +360
-        -exec rm {} \;
-
-    - name: save bazel cache
-      uses: actions/cache/save@v3
-      if: always()
-      with:
-        path: /tmp/bazel/cache
-        key: ${{ steps.vars.outputs.CACHE_TAG }}-${{ github.sha }}
-
   build:
     name: ${{ matrix.action }} with ${{ matrix.name }}
 
@@ -137,13 +107,13 @@ jobs:
           os: ubuntu-24.04-16core
           arch: x86_64
           action: test
-          flags: --config=clang-asan --define=crypto=system
+          flags: --config=hermetic-llvm --config=clang-asan --define=crypto=system
         - name: 'NullVM on Linux/x86_64 with TSan'
           engine: 'null'
           os: ubuntu-24.04-16core
           arch: x86_64
           action: test
-          flags: --config=clang-tsan
+          flags: --config=hermetic-llvm --config=clang-tsan
         - name: 'NullVM on Windows/x86_64'
           engine: 'null'
           os: windows-2022
@@ -194,67 +164,70 @@ jobs:
         - name: 'V8 on macOS/x86_64'
           engine: 'v8'
           repo: 'v8'
-          os: macos-13
+          os: macos-15
           arch: x86_64
           action: test
-          flags: --config=hermetic-llvm-macos
+          flags: --config=hermetic-llvm
           cache: true
         - name: 'WAMR interp on Linux/x86_64'
           engine: 'wamr-interp'
           repo: 'com_github_bytecodealliance_wasm_micro_runtime'
           os: ubuntu-24.04-16core
           arch: x86_64
           action: test
-          flags: --config=clang
+          flags: --config=hermetic-llvm
         - name: 'WAMR interp on macOS/x86_64'
           engine: 'wamr-interp'
           repo: 'com_github_bytecodealliance_wasm_micro_runtime'
-          os: macos-13
+          os: macos-15
           arch: x86_64
           action: test
+          flags: --config=hermetic-llvm
         - name: 'WAMR jit on Linux/x86_64'
           engine: 'wamr-jit'
           repo: 'com_github_bytecodealliance_wasm_micro_runtime'
           os: ubuntu-24.04-16core
           arch: x86_64
           action: test
-          flags: --config=clang
+          flags: --config=hermetic-llvm
           deps: lld-18
           cache: true
         - name: 'WAMR jit on macOS/x86_64'
           engine: 'wamr-jit'
           repo: 'com_github_bytecodealliance_wasm_micro_runtime'
-          os: macos-13
+          os: macos-15
           arch: x86_64
           action: test
           cache: true
+          flags: --config=hermetic-llvm
         - name: 'WasmEdge on Linux/x86_64'
           engine: 'wasmedge'
           repo: 'com_github_wasmedge_wasmedge'
           os: ubuntu-24.04-16core
           arch: x86_64
           action: test
-          flags: --config=clang
+          flags: --config=hermetic-llvm
         - name: 'WasmEdge on macOS/x86_64'
           engine: 'wasmedge'
           repo: 'com_github_wasmedge_wasmedge'
-          os: macos-13
+          os: macos-15
           arch: x86_64
           action: test
+          flags: --config=hermetic-llvm
         - name: 'Wasmtime on Linux/x86_64'
           engine: 'wasmtime'
           repo: 'com_github_bytecodealliance_wasmtime'
           os: ubuntu-24.04-16core
           arch: x86_64
           action: test
-          flags: --config=clang -c opt
+          flags: --config=hermetic-llvm -c opt
         - name: 'Wasmtime on Linux/x86_64 with ASan'
           engine: 'wasmtime'
           repo: 'com_github_bytecodealliance_wasmtime'
           os: ubuntu-24.04-16core
           arch: x86_64
           action: test
-          flags: --config=clang-asan --define=crypto=system
+          flags: --config=hermetic-llvm --config=clang-asan --define=crypto=system
         - name: 'Wasmtime on Linux/aarch64'
           engine: 'wasmtime'
           repo: 'com_github_bytecodealliance_wasmtime'
@@ -267,21 +240,28 @@ jobs:
           repo: 'com_github_bytecodealliance_wasmtime'
           os: ubuntu-24.04-16core
           arch: s390x
+          platform: linux/s390x
           action: test
           flags: --config=clang --test_timeout=1800
           # s390x build-tools image built from bazel/external/Dockerfile.bazel
-          run_under: docker run --rm --env HOME=$HOME --env USER=$(id -un) --volume "$HOME:$HOME" --workdir $(pwd) --user $(id -u):$(id -g) --platform linux/s390x ghcr.io/proxy-wasm/build-tools:ubuntu-22.04-bazel-6.5.0
+          run_under: docker run --rm --env HOME=$HOME --env USER=$(id -un) --volume "$HOME:$HOME" --workdir $(pwd) --user $(id -u):$(id -g) --platform linux/s390x proxy-wasm/build-tools:local-ci
           cache: true
         - name: 'Wasmtime on macOS/x86_64'
           engine: 'wasmtime'
           repo: 'com_github_bytecodealliance_wasmtime'
-          os: macos-13
+          os: macos-15
           arch: x86_64
           action: test
+          flags: --config=hermetic-llvm
 
     steps:
     - uses: actions/checkout@v2
 
+    - name: Compute job hash
+      id: job-hash
+      run: echo "hash=$(echo -n '${{ matrix.engine }}-${{ matrix.flags }}-${{ matrix.os }}-${{ matrix.arch }}' | sha1sum | cut -c1-10)" >> $GITHUB_OUTPUT
+      shell: bash
+
     - name: Install dependencies (Linux)
       if: ${{ matrix.deps != '' && startsWith(matrix.os, 'ubuntu') }}
       run: sudo apt update -y && sudo apt install -y ${{ matrix.deps }}
@@ -299,27 +279,16 @@ jobs:
       if: startsWith(matrix.run_under, 'docker')
       run: docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
 
-    - name: set cache name
-      id: vars
-      # The cache tag consists of the following parts:
-      # * bazel-cache- prefix
-      # * matrix.name, which separates the cache for each build type.
-      # * hash of WORKSPACE, .bazelrc, and .bazelversion, which is
-      #   purely to differentiate caches for substantial changes in bazel.
-      # * github.sha, which is the commit hash of the commit used to generate
-      #   the cache entry.
-      run: echo "CACHE_TAG=bazel-cache-${{ matrix.name }}-${{ hashFiles('WORKSPACE', '.bazelrc', '.bazelversion') }}" >> "$GITHUB_OUTPUT"
-
-    - name: bazel cache
-      uses: actions/cache/restore@v3
+    - name: Set up Docker Buildx
+      if: startsWith(matrix.run_under, 'docker')
+      uses: docker/setup-buildx-action@v3
+
+    - uses: bazel-contrib/setup-bazel@0.16.0
       with:
-        path: /tmp/bazel/cache
-        key: ${{ steps.vars.outputs.CACHE_TAG }}-${{ github.sha }}
-        restore-keys: |
-          ${{ steps.vars.outputs.CACHE_TAG }}-${{ github.sha }}
-          ${{ steps.vars.outputs.CACHE_TAG }}-
-          bazel-cache-${{ matrix.name }}-
-          bazel-cache-
+        bazelisk-cache: true
+        disk-cache: ${{ github.job }}-${{ steps.job-hash.outputs.hash }}
+        external-cache: true
+        repository-cache: true
 
     - name: Download test data
       uses: actions/download-artifact@v4
@@ -336,6 +305,18 @@ jobs:
           echo "filegroup(name = \"$i\", srcs = [\"$i.wasm\"])" >> test/test_data/BUILD; \
         done
 
+    - name: Build local Docker image
+      if: ${{ startsWith(matrix.run_under, 'docker') }}
+      uses: docker/build-push-action@v6
+      with:
+        context: .
+        file: bazel/external/Dockerfile.bazel
+        platforms: ${{ matrix.platform }}
+        tags: proxy-wasm/build-tools:local-ci
+        load: true
+        cache-from: type=gha,scope=build-tools-${{ matrix.platform }}
+        cache-to: type=gha,mode=max,scope=build-tools-${{ matrix.platform }}
+
     - name: Bazel build/test
       shell: bash
       run: >
@@ -344,7 +325,6 @@ jobs:
         --verbose_failures
         --test_output=errors
         --define engine=${{ matrix.engine }}
-        --disk_cache /tmp/bazel/cache
         ${{ matrix.flags }}
         -- //test/... ${{ matrix.targets }}
 
@@ -356,24 +336,7 @@ jobs:
         --verbose_failures
         --test_output=errors
         --define engine=${{ matrix.engine }}
-        --disk_cache /tmp/bazel/cache
         ${{ matrix.flags }}
-        --per_file_copt=src/signature_util.cc,test/signature_util_test.cc@-DPROXY_WASM_VERIFY_WITH_ED25519_PUBKEY=\"$(xxd -p -c 256 test/test_data/signature_key1.pub | cut -b9-)\"
+        --per_file_copt=src/signature_util.cc,test/signature_util_test.cc@-DPROXY_WASM_VERIFY_WITH_ED25519_PUBKEY=\"$(xxd -p -c 256 test/test_data/signature_key1.pub | cut -c3- | tr -d '\n')\"
         //test:signature_util_test
 
-    - name: remove unaccessed files from cache
-      shell: bash
-      run: >
-        find /tmp/bazel/cache
-        -type f
-        -name '*'
-        -amin +360
-        -exec rm {} \;
-
-    - name: save bazel cache
-      uses: actions/cache/save@v3
-      if: always()
-      with:
-        path: /tmp/bazel/cache
-        key: ${{ steps.vars.outputs.CACHE_TAG }}-${{ github.sha }}
-

.gitignore

@@ -2,3 +2,4 @@
 /external
 /compile_commands.json
 /.cache/
+/_codeql_detected_source_root